@aws-cdk-testing/cli-integ/tests/cli-integ-tests/bootstrap/cdk-bootstrap-deploy-role-cannot-be-assumed-with-external-id.integtest.js

Integration tests for the AWS CDK CLI

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const client_sts_1 = require("@aws-sdk/client-sts");
const lib_1 = require("../../../lib");
jest.setTimeout(2 * 60 * 60_000); // Includes the time to acquire locks, worst-case single-threaded runtime
(0, lib_1.integTest)('deploy role cannot be assumed with external id', (0, lib_1.withoutBootstrap)(async (fixture) => {
    const bootstrapStackName = fixture.bootstrapStackName;
    await fixture.cdkBootstrapModern({
        toolkitStackName: bootstrapStackName,
        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
    });
    const account = await fixture.aws.account();
    const deployRoleArn = `arn:aws:iam::${account}:role/cdk-${fixture.qualifier}-deploy-role-${account}-${fixture.aws.region}`;
    // Attempt to assume the deploy role with an external ID should fail
    await expect(fixture.aws.sts.send(new client_sts_1.AssumeRoleCommand({
        RoleArn: deployRoleArn,
        RoleSessionName: 'test-external-id-failure',
        ExternalId: 'some-external-id',
    }))).rejects.toThrow();
}));
(0, lib_1.integTest)('deploy role can be assumed with ExternalId if protection is switched off', (0, lib_1.withoutBootstrap)(async (fixture) => {
    const bootstrapStackName = fixture.bootstrapStackName;
    await fixture.cdkBootstrapModern({
        toolkitStackName: bootstrapStackName,
        cfnExecutionPolicy: 'arn:aws:iam::aws:policy/AdministratorAccess',
        denyExternalId: false,
    });
    const account = await fixture.aws.account();
    const deployRoleArn = `arn:aws:iam::${account}:role/cdk-${fixture.qualifier}-deploy-role-${account}-${fixture.aws.region}`;
    // Attempt to assume the deploy role with an external ID should fail
    await expect(fixture.aws.sts.send(new client_sts_1.AssumeRoleCommand({
        RoleArn: deployRoleArn,
        RoleSessionName: 'test-external-id-failure',
        ExternalId: 'some-external-id',
    }))).resolves.toBeTruthy();
}));
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2RrLWJvb3RzdHJhcC1kZXBsb3ktcm9sZS1jYW5ub3QtYmUtYXNzdW1lZC13aXRoLWV4dGVybmFsLWlkLmludGVndGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNkay1ib290c3RyYXAtZGVwbG95LXJvbGUtY2Fubm90LWJlLWFzc3VtZWQtd2l0aC1leHRlcm5hbC1pZC5pbnRlZ3Rlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxvREFBd0Q7QUFDeEQsc0NBQTJEO0FBRTNELElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLHlFQUF5RTtBQUUzRyxJQUFBLGVBQVMsRUFBQyxnREFBZ0QsRUFBRSxJQUFBLHNCQUFnQixFQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUM3RixNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixnQkFBZ0IsRUFBRSxrQkFBa0I7UUFDcEMsa0JBQWtCLEVBQUUsNkNBQTZDO0tBQ2xFLENBQUMsQ0FBQztJQUVILE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUM1QyxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsT0FBTyxhQUFhLE9BQU8sQ0FBQyxTQUFTLGdCQUFnQixPQUFPLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUUzSCxvRUFBb0U7SUFDcEUsTUFBTSxNQUFNLENBQ1YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksOEJBQWlCLENBQUM7UUFDekMsT0FBTyxFQUFFLGFBQWE7UUFDdEIsZUFBZSxFQUFFLDBCQUEwQjtRQUMzQyxVQUFVLEVBQUUsa0JBQWtCO0tBQy9CLENBQUMsQ0FBQyxDQUNKLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0FBQ3RCLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFSixJQUFBLGVBQVMsRUFBQywwRUFBMEUsRUFBRSxJQUFBLHNCQUFnQixFQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtJQUN2SCxNQUFNLGtCQUFrQixHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztJQUV0RCxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQixnQkFBZ0IsRUFBRSxrQkFBa0I7UUFDcEMsa0JBQWtCLEVBQUUsNkNBQTZDO1FBQ2pFLGNBQWMsRUFBRSxLQUFLO0tBQ3RCLENBQUMsQ0FBQztJQUVILE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUM1QyxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsT0FBTyxhQUFhLE9BQU8sQ0FBQyxTQUFTLGdCQUFnQixPQUFPLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUUzSCxvRUFBb0U7SUFDcEUsTUFBTSxNQUFNLENBQ1YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksOEJBQWlCLENBQUM7UUFDekMsT0FBTyxFQUFFLGFBQWE7UUFDdEIsZUFBZSxFQUFFLDBCQUEwQjtRQUMzQyxVQUFVLEVBQUUsa0JBQWtCO0tBQy9CLENBQUMsQ0FBQyxDQUNKLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO0FBQzFCLENBQUMsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBBc3N1bWVSb2xlQ29tbWFuZCB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1zdHMnO1xuaW1wb3J0IHsgaW50ZWdUZXN0LCB3aXRob3V0Qm9vdHN0cmFwIH0gZnJvbSAnLi4vLi4vLi4vbGliJztcblxuamVzdC5zZXRUaW1lb3V0KDIgKiA2MCAqIDYwXzAwMCk7IC8vIEluY2x1ZGVzIHRoZSB0aW1lIHRvIGFjcXVpcmUgbG9ja3MsIHdvcnN0LWNhc2Ugc2luZ2xlLXRocmVhZGVkIHJ1bnRpbWVcblxuaW50ZWdUZXN0KCdkZXBsb3kgcm9sZSBjYW5ub3QgYmUgYXNzdW1lZCB3aXRoIGV4dGVybmFsIGlkJywgd2l0aG91dEJvb3RzdHJhcChhc3luYyAoZml4dHVyZSkgPT4ge1xuICBjb25zdCBib290c3RyYXBTdGFja05hbWUgPSBmaXh0dXJlLmJvb3RzdHJhcFN0YWNrTmFtZTtcblxuICBhd2FpdCBmaXh0dXJlLmNka0Jvb3RzdHJhcE1vZGVybih7XG4gICAgdG9vbGtpdFN0YWNrTmFtZTogYm9vdHN0cmFwU3RhY2tOYW1lLFxuICAgIGNmbkV4ZWN1dGlvblBvbGljeTogJ2Fybjphd3M6aWFtOjphd3M6cG9saWN5L0FkbWluaXN0cmF0b3JBY2Nlc3MnLFxuICB9KTtcblxuICBjb25zdCBhY2NvdW50ID0gYXdhaXQgZml4dHVyZS5hd3MuYWNjb3VudCgpO1xuICBjb25zdCBkZXBsb3lSb2xlQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnR9OnJvbGUvY2RrLSR7Zml4dHVyZS5xdWFsaWZpZXJ9LWRlcGxveS1yb2xlLSR7YWNjb3VudH0tJHtmaXh0dXJlLmF3cy5yZWdpb259YDtcblxuICAvLyBBdHRlbXB0IHRvIGFzc3VtZSB0aGUgZGVwbG95IHJvbGUgd2l0aCBhbiBleHRlcm5hbCBJRCBzaG91bGQgZmFpbFxuICBhd2FpdCBleHBlY3QoXG4gICAgZml4dHVyZS5hd3Muc3RzLnNlbmQobmV3IEFzc3VtZVJvbGVDb21tYW5kKHtcbiAgICAgIFJvbGVBcm46IGRlcGxveVJvbGVBcm4sXG4gICAgICBSb2xlU2Vzc2lvbk5hbWU6ICd0ZXN0LWV4dGVybmFsLWlkLWZhaWx1cmUnLFxuICAgICAgRXh0ZXJuYWxJZDogJ3NvbWUtZXh0ZXJuYWwtaWQnLFxuICAgIH0pKSxcbiAgKS5yZWplY3RzLnRvVGhyb3coKTtcbn0pKTtcblxuaW50ZWdUZXN0KCdkZXBsb3kgcm9sZSBjYW4gYmUgYXNzdW1lZCB3aXRoIEV4dGVybmFsSWQgaWYgcHJvdGVjdGlvbiBpcyBzd2l0Y2hlZCBvZmYnLCB3aXRob3V0Qm9vdHN0cmFwKGFzeW5jIChmaXh0dXJlKSA9PiB7XG4gIGNvbnN0IGJvb3RzdHJhcFN0YWNrTmFtZSA9IGZpeHR1cmUuYm9vdHN0cmFwU3RhY2tOYW1lO1xuXG4gIGF3YWl0IGZpeHR1cmUuY2RrQm9vdHN0cmFwTW9kZXJuKHtcbiAgICB0b29sa2l0U3RhY2tOYW1lOiBib290c3RyYXBTdGFja05hbWUsXG4gICAgY2ZuRXhlY3V0aW9uUG9saWN5OiAnYXJuOmF3czppYW06OmF3czpwb2xpY3kvQWRtaW5pc3RyYXRvckFjY2VzcycsXG4gICAgZGVueUV4dGVybmFsSWQ6IGZhbHNlLFxuICB9KTtcblxuICBjb25zdCBhY2NvdW50ID0gYXdhaXQgZml4dHVyZS5hd3MuYWNjb3VudCgpO1xuICBjb25zdCBkZXBsb3lSb2xlQXJuID0gYGFybjphd3M6aWFtOjoke2FjY291bnR9OnJvbGUvY2RrLSR7Zml4dHVyZS5xdWFsaWZpZXJ9LWRlcGxveS1yb2xlLSR7YWNjb3VudH0tJHtmaXh0dXJlLmF3cy5yZWdpb259YDtcblxuICAvLyBBdHRlbXB0IHRvIGFzc3VtZSB0aGUgZGVwbG95IHJvbGUgd2l0aCBhbiBleHRlcm5hbCBJRCBzaG91bGQgZmFpbFxuICBhd2FpdCBleHBlY3QoXG4gICAgZml4dHVyZS5hd3Muc3RzLnNlbmQobmV3IEFzc3VtZVJvbGVDb21tYW5kKHtcbiAgICAgIFJvbGVBcm46IGRlcGxveVJvbGVBcm4sXG4gICAgICBSb2xlU2Vzc2lvbk5hbWU6ICd0ZXN0LWV4dGVybmFsLWlkLWZhaWx1cmUnLFxuICAgICAgRXh0ZXJuYWxJZDogJ3NvbWUtZXh0ZXJuYWwtaWQnLFxuICAgIH0pKSxcbiAgKS5yZXNvbHZlcy50b0JlVHJ1dGh5KCk7XG59KSk7XG4iXX0=