|
| 1 | +from datetime import timedelta |
| 2 | + |
| 3 | +import boto3 |
| 4 | +import cryptography |
| 5 | +import pytest |
| 6 | +from botocore.exceptions import ClientError |
| 7 | +from cryptography.hazmat.primitives import hashes, serialization |
| 8 | +from cryptography.hazmat.primitives.asymmetric import rsa |
| 9 | +from cryptography.x509 import Name, NameAttribute |
| 10 | +from cryptography.x509.oid import NameOID |
| 11 | + |
| 12 | +from moto.core.utils import utcnow |
| 13 | +from tests.test_iam import iam_aws_verified |
| 14 | + |
| 15 | + |
| 16 | +@iam_aws_verified(create_user=True) |
| 17 | +@pytest.mark.aws_verified |
| 18 | +def test_signing_certs(user_name=None): |
| 19 | + client = boto3.client("iam", region_name="us-east-1") |
| 20 | + certificate = create_certificate() |
| 21 | + |
| 22 | + # Upload the cert: |
| 23 | + resp = client.upload_signing_certificate( |
| 24 | + UserName=user_name, CertificateBody=certificate |
| 25 | + )["Certificate"] |
| 26 | + cert_id = resp["CertificateId"] |
| 27 | + |
| 28 | + assert resp["UserName"] == user_name |
| 29 | + assert resp["Status"] == "Active" |
| 30 | + assert resp["CertificateBody"] == certificate |
| 31 | + assert resp["CertificateId"] |
| 32 | + |
| 33 | + # Update: |
| 34 | + client.update_signing_certificate( |
| 35 | + UserName=user_name, CertificateId=cert_id, Status="Inactive" |
| 36 | + ) |
| 37 | + |
| 38 | + # List the certs: |
| 39 | + resp = client.list_signing_certificates(UserName=user_name)["Certificates"] |
| 40 | + assert len(resp) == 1 |
| 41 | + assert resp[0]["CertificateBody"] == certificate |
| 42 | + assert resp[0]["Status"] == "Inactive" # Changed with the update call above. |
| 43 | + |
| 44 | + # Delete: |
| 45 | + client.delete_signing_certificate(UserName=user_name, CertificateId=cert_id) |
| 46 | + |
| 47 | + |
| 48 | +@iam_aws_verified(create_user=True) |
| 49 | +@pytest.mark.aws_verified |
| 50 | +def test_create_too_many_certificates(user_name=None): |
| 51 | + client = boto3.client("iam", region_name="us-east-1") |
| 52 | + certificate1 = create_certificate() |
| 53 | + certificate2 = create_certificate() |
| 54 | + certificate3 = create_certificate() |
| 55 | + |
| 56 | + # Upload two certs |
| 57 | + cert_id1 = client.upload_signing_certificate( |
| 58 | + UserName=user_name, CertificateBody=certificate1 |
| 59 | + )["Certificate"]["CertificateId"] |
| 60 | + cert_id2 = client.upload_signing_certificate( |
| 61 | + UserName=user_name, CertificateBody=certificate2 |
| 62 | + )["Certificate"]["CertificateId"] |
| 63 | + assert cert_id1 != cert_id2 |
| 64 | + |
| 65 | + # Verify that a third certificate exceeds the limit |
| 66 | + with pytest.raises(ClientError) as exc: |
| 67 | + client.upload_signing_certificate( |
| 68 | + UserName=user_name, CertificateBody=certificate3 |
| 69 | + ) |
| 70 | + err = exc.value.response["Error"] |
| 71 | + assert err["Code"] == "LimitExceeded" |
| 72 | + assert err["Message"] == "Cannot exceed quota for CertificatesPerUser: 2" |
| 73 | + |
| 74 | + |
| 75 | +@iam_aws_verified(create_user=True) |
| 76 | +def test_retrieve_cert_details_using_credentials_report(user_name=None): |
| 77 | + """ |
| 78 | + AWS caches the Credentials Report for 4 hours |
| 79 | + Once you generate the report, you can request the report over and over again, but you'll always get that same report back in the next 4 hours |
| 80 | + # That makes it slightly impossible to verify this against AWS - that's why there is no `aws_verified`-marker |
| 81 | + """ |
| 82 | + client = boto3.client("iam", region_name="us-east-1") |
| 83 | + certificate1 = create_certificate() |
| 84 | + certificate2 = create_certificate() |
| 85 | + |
| 86 | + # Upload the cert: |
| 87 | + cert_id1 = client.upload_signing_certificate( |
| 88 | + UserName=user_name, CertificateBody=certificate1 |
| 89 | + )["Certificate"]["CertificateId"] |
| 90 | + |
| 91 | + result = client.generate_credential_report() |
| 92 | + while result["State"] != "COMPLETE": |
| 93 | + result = client.generate_credential_report() |
| 94 | + report = client.get_credential_report()["Content"].decode("utf-8") |
| 95 | + |
| 96 | + our_line = next(line for line in report.split("\n") if line.startswith(user_name)) |
| 97 | + cert1_active = our_line.split(",")[-4] |
| 98 | + assert cert1_active == "true" |
| 99 | + cert2_active = our_line.split(",")[-2] |
| 100 | + assert cert2_active == "false" |
| 101 | + |
| 102 | + client.upload_signing_certificate(UserName=user_name, CertificateBody=certificate2) |
| 103 | + |
| 104 | + result = client.generate_credential_report() |
| 105 | + while result["State"] != "COMPLETE": |
| 106 | + result = client.generate_credential_report() |
| 107 | + report = client.get_credential_report()["Content"].decode("utf-8") |
| 108 | + our_line = next(line for line in report.split("\n") if line.startswith(user_name)) |
| 109 | + |
| 110 | + cert1_active = our_line.split(",")[-4] |
| 111 | + assert cert1_active == "true" |
| 112 | + cert2_active = our_line.split(",")[-2] |
| 113 | + assert cert2_active == "true" |
| 114 | + |
| 115 | + # Set Certificate to Inactive |
| 116 | + client.update_signing_certificate( |
| 117 | + UserName=user_name, CertificateId=cert_id1, Status="Inactive" |
| 118 | + ) |
| 119 | + |
| 120 | + # Verify the credential report is updated |
| 121 | + result = client.generate_credential_report() |
| 122 | + while result["State"] != "COMPLETE": |
| 123 | + result = client.generate_credential_report() |
| 124 | + report = client.get_credential_report()["Content"].decode("utf-8") |
| 125 | + our_line = next(line for line in report.split("\n") if line.startswith(user_name)) |
| 126 | + |
| 127 | + cert1_active = our_line.split(",")[-4] |
| 128 | + assert cert1_active == "false" |
| 129 | + cert2_active = our_line.split(",")[-2] |
| 130 | + assert cert2_active == "true" |
| 131 | + |
| 132 | + |
| 133 | +@iam_aws_verified() |
| 134 | +@pytest.mark.aws_verified |
| 135 | +def test_upload_cert_for_unknown_user(user_name=None): |
| 136 | + client = boto3.client("iam", region_name="us-east-1") |
| 137 | + with pytest.raises(ClientError) as exc: |
| 138 | + client.upload_signing_certificate( |
| 139 | + UserName="notauser", CertificateBody=create_certificate() |
| 140 | + ) |
| 141 | + err = exc.value.response["Error"] |
| 142 | + assert err["Code"] == "NoSuchEntity" |
| 143 | + assert err["Message"] == "The user with name notauser cannot be found." |
| 144 | + |
| 145 | + with pytest.raises(ClientError) as exc: |
| 146 | + client.update_signing_certificate( |
| 147 | + UserName="notauser", |
| 148 | + CertificateId="asdfasdfasdfasdfasdfasdfasdasdf", |
| 149 | + Status="Inactive", |
| 150 | + ) |
| 151 | + err = exc.value.response["Error"] |
| 152 | + assert err["Code"] == "NoSuchEntity" |
| 153 | + assert err["Message"] == "The user with name notauser cannot be found." |
| 154 | + |
| 155 | + with pytest.raises(ClientError) as exc: |
| 156 | + client.list_signing_certificates(UserName="notauser") |
| 157 | + err = exc.value.response["Error"] |
| 158 | + assert err["Code"] == "NoSuchEntity" |
| 159 | + assert err["Message"] == "The user with name notauser cannot be found." |
| 160 | + |
| 161 | + with pytest.raises(ClientError): |
| 162 | + client.delete_signing_certificate(UserName="notauser", CertificateId="x" * 32) |
| 163 | + err = exc.value.response["Error"] |
| 164 | + assert err["Code"] == "NoSuchEntity" |
| 165 | + assert err["Message"] == "The user with name notauser cannot be found." |
| 166 | + |
| 167 | + |
| 168 | +@iam_aws_verified(create_user=True) |
| 169 | +@pytest.mark.aws_verified |
| 170 | +def test_upload_invalid_certificate(user_name=None): |
| 171 | + client = boto3.client("iam", region_name="us-east-1") |
| 172 | + with pytest.raises(ClientError) as ce: |
| 173 | + client.upload_signing_certificate( |
| 174 | + UserName=user_name, CertificateBody="notacert" |
| 175 | + ) |
| 176 | + assert ce.value.response["Error"]["Code"] == "MalformedCertificate" |
| 177 | + |
| 178 | + |
| 179 | +@iam_aws_verified(create_user=True) |
| 180 | +@pytest.mark.aws_verified |
| 181 | +def test_update_unknown_certificate(user_name=None): |
| 182 | + client = boto3.client("iam", region_name="us-east-1") |
| 183 | + fake_id_name = "x" * 32 |
| 184 | + with pytest.raises(ClientError) as ce: |
| 185 | + client.update_signing_certificate( |
| 186 | + UserName=user_name, CertificateId=fake_id_name, Status="Inactive" |
| 187 | + ) |
| 188 | + err = ce.value.response["Error"] |
| 189 | + |
| 190 | + assert err["Message"] == f"The Certificate with id {fake_id_name} cannot be found." |
| 191 | + |
| 192 | + |
| 193 | +def create_certificate(): |
| 194 | + key = rsa.generate_private_key(public_exponent=65537, key_size=2028) |
| 195 | + cert_subject = [NameAttribute(NameOID.COMMON_NAME, "iam.amazonaws.com")] |
| 196 | + issuer = [ |
| 197 | + NameAttribute(NameOID.COUNTRY_NAME, "US"), |
| 198 | + NameAttribute(NameOID.ORGANIZATION_NAME, "Amazon"), |
| 199 | + NameAttribute(NameOID.COMMON_NAME, "Amazon RSA 2048 M01"), |
| 200 | + ] |
| 201 | + cert = ( |
| 202 | + cryptography.x509.CertificateBuilder() |
| 203 | + .subject_name(Name(cert_subject)) |
| 204 | + .issuer_name(Name(issuer)) |
| 205 | + .public_key(key.public_key()) |
| 206 | + .serial_number(cryptography.x509.random_serial_number()) |
| 207 | + .not_valid_before(utcnow()) |
| 208 | + .not_valid_after(utcnow() + timedelta(days=365)) |
| 209 | + .sign(key, hashes.SHA256()) |
| 210 | + ) |
| 211 | + return cert.public_bytes(serialization.Encoding.PEM).decode("utf-8") |
0 commit comments