|  | 
| 10 | 10 | state_file = 'terraform.tfstate.d/kitchen-terraform-default-aws/terraform.tfstate' | 
| 11 | 11 | tf_state = JSON.parse(File.open(state_file).read) | 
| 12 | 12 | principal_account_id = tf_state['modules'][0]['outputs']['principal_account_id']['value'] | 
| 13 |  | -# rubocop:enable LineLength | 
| 14 |  | -account_id = tf_state['modules'][0]['outputs']['account_id']['value'] | 
| 15 |  | -vpc_id = tf_state['modules'][0]['outputs']['vpc_id']['value'] | 
| 16 |  | -security_group_id = tf_state['modules'][0]['outputs']['sg_id']['value'] | 
| 17 | 13 | account_id = tf_state['modules'][0]['outputs']['account_id']['value'] | 
| 18 | 14 | region = tf_state['modules'][0]['outputs']['region']['value'] | 
| 19 | 15 | ENV['AWS_REGION'] = region | 
| 20 | 16 | # this must match the format in examples/test_fixtures/locals.tf | 
| 21 | 17 | log_bucket_name = 'logs-' + region + '-' + account_id | 
|  | 18 | +policy = "{ | 
|  | 19 | +    \"Version\": \"2012-10-17\", | 
|  | 20 | +    \"Statement\": [ | 
|  | 21 | +        { | 
|  | 22 | +            \"Sid\": \"AllowToPutLoadBalancerLogsToS3Bucket\", | 
|  | 23 | +            \"Effect\": \"Allow\", | 
|  | 24 | +            \"Principal\": { | 
|  | 25 | +                \"AWS\": \"arn:aws:iam::#{principal_account_id}:root\" | 
|  | 26 | +            }, | 
|  | 27 | +            \"Action\": \"s3:PutObject\", | 
|  | 28 | +            \"Resource\": \"arn:aws:s3:::#{log_bucket_name}/#{log_location_prefix}/AWSLogs/#{account_id}/*\" | 
|  | 29 | +        } | 
|  | 30 | +    ] | 
|  | 31 | +}" | 
|  | 32 | +# rubocop:enable LineLength | 
|  | 33 | +log_object = "#{log_location_prefix}/AWSLogs/#{account_id}/ELBAccessLogTestFile" | 
|  | 34 | +vpc_id = tf_state['modules'][0]['outputs']['vpc_id']['value'] | 
|  | 35 | +security_group_id = tf_state['modules'][0]['outputs']['sg_id']['value'] | 
| 22 | 36 | 
 | 
| 23 | 37 | describe alb('test-alb') do | 
| 24 | 38 |   it { should exist } | 
|  | 
| 42 | 56 | 
 | 
| 43 | 57 | describe s3_bucket(log_bucket_name) do | 
| 44 | 58 |   it { should exist } | 
| 45 |  | -  # rubocop:disable LineLength | 
| 46 |  | -  it { should have_object("#{log_location_prefix}/AWSLogs/#{account_id}/ELBAccessLogTestFile") } | 
| 47 |  | -  it do | 
| 48 |  | -    should have_policy <<~POLICY | 
| 49 |  | -{ | 
| 50 |  | -    "Version": "2012-10-17", | 
| 51 |  | -    "Statement": [ | 
| 52 |  | -        { | 
| 53 |  | -            "Sid": "AllowToPutLoadBalancerLogsToS3Bucket", | 
| 54 |  | -            "Effect": "Allow", | 
| 55 |  | -            "Principal": { | 
| 56 |  | -                "AWS": "arn:aws:iam::#{principal_account_id}:root" | 
| 57 |  | -            }, | 
| 58 |  | -            "Action": "s3:PutObject", | 
| 59 |  | -            "Resource": "arn:aws:s3:::#{log_bucket_name}/#{log_location_prefix}/AWSLogs/#{account_id}/*" | 
| 60 |  | -        } | 
| 61 |  | -    ] | 
| 62 |  | -} | 
| 63 |  | -    POLICY | 
| 64 |  | -  end | 
| 65 |  | -  # rubocop:enable LineLength | 
|  | 59 | +  it { should have_object(log_object) } | 
|  | 60 | +  it { should have_policy(policy) } | 
| 66 | 61 | end | 
0 commit comments