Skip to content

Commit 1e21cf0

Browse files
mabuaishamabuaisha
committed
Address minor suggestions & concerns raised by core team
1 parent 564e22a commit 1e21cf0

File tree

5 files changed

+96
-21
lines changed

5 files changed

+96
-21
lines changed

‎localstack-core/localstack/services/secretsmanager/provider.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,7 @@ def backend_rotate_secret(
738738
# Resolve rotation_lambda_arn and fallback to previous value if its missing
739739
# from the current request
740740
rotation_lambda_arn = rotation_lambda_arn or secret.rotation_lambda_arn
741-
741+
rotation_period = 0
742742
if rotation_lambda_arn:
743743
if len(rotation_lambda_arn) > 2048:
744744
msg = "RotationLambdaARN must <= 2048 characters long."

‎localstack-core/localstack/testing/snapshots/transformer_utility.py

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,6 +648,19 @@ def secretsmanager_api():
648648
),
649649
"version_uuid",
650650
),
651+
KeyValueBasedTransformer(
652+
lambda k, v: (
653+
v
654+
if (
655+
isinstance(k, str)
656+
and k == "RotationLambdaARN"
657+
and isinstance(v, str)
658+
and re.match(PATTERN_ARN, v)
659+
)
660+
else None
661+
),
662+
"lambda-arn",
663+
),
651664
SortingTransformer("VersionStages"),
652665
SortingTransformer("Versions", lambda e: e.get("CreatedDate")),
653666
]

‎tests/aws/services/secretsmanager/test_secretsmanager.py

Lines changed: 39 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,6 @@ def _setup_rotation_secret(
117117
Description="testing rotation of secrets",
118118
)
119119

120-
sm_snapshot.add_transformer(
121-
sm_snapshot.transform.key_value("RotationLambdaARN", "lambda-arn")
122-
)
123120
sm_snapshot.add_transformers_list(
124121
sm_snapshot.transform.secretsmanager_secret_id_arn(cre_res, 0)
125122
)
@@ -139,6 +136,29 @@ def _setup_rotation_secret(
139136
)
140137
return cre_res["VersionId"], function_arn
141138

139+
@staticmethod
140+
def _setup_invalid_rotation_secret(
141+
invalid_arn: str | None, invalid_snapshot_key: str, sm_snapshot, secret_name, aws_client
142+
):
143+
create_secret = aws_client.secretsmanager.create_secret(
144+
Name=secret_name, SecretString="init"
145+
)
146+
sm_snapshot.add_transformer(
147+
sm_snapshot.transform.secretsmanager_secret_id_arn(create_secret, 0)
148+
)
149+
sm_snapshot.match("create_secret", create_secret)
150+
rotation_config = {
151+
"SecretId": secret_name,
152+
"RotationRules": {
153+
"AutomaticallyAfterDays": 1,
154+
},
155+
}
156+
if invalid_arn:
157+
rotation_config["RotationLambdaARN"] = invalid_arn
158+
with pytest.raises(Exception) as e:
159+
aws_client.secretsmanager.rotate_secret(**rotation_config)
160+
sm_snapshot.match(invalid_snapshot_key, e.value.response)
161+
142162
def _assert_after_rotate_secret_with_lambda_success(
143163
self,
144164
sm_snapshot,
@@ -672,28 +692,27 @@ def test_rotate_secret_multiple_times_with_lambda_success(
672692
def test_rotate_secret_invalid_lambda_arn(
673693
self, secret_name, aws_client, account_id, sm_snapshot
674694
):
675-
create_secret = aws_client.secretsmanager.create_secret(
676-
Name=secret_name, SecretString="init"
677-
)
678-
sm_snapshot.add_transformer(
679-
sm_snapshot.transform.secretsmanager_secret_id_arn(create_secret, 0)
680-
)
681-
sm_snapshot.match("create_secret", create_secret)
682-
683695
region_name = aws_client.secretsmanager.meta.region_name
684696
invalid_arn = (
685697
f"arn:aws:lambda:{region_name}:{account_id}:function:rotate_secret_invalid_lambda_arn"
686698
)
687-
with pytest.raises(Exception) as e:
688-
aws_client.secretsmanager.rotate_secret(
689-
SecretId=secret_name,
690-
RotationLambdaARN=invalid_arn,
691-
RotationRules={
692-
"AutomaticallyAfterDays": 1,
693-
},
694-
)
695-
sm_snapshot.match("rotate_secret_invalid_arn_exc", e.value.response)
699+
self._setup_invalid_rotation_secret(
700+
invalid_arn, "rotate_secret_invalid_arn_exc", sm_snapshot, secret_name, aws_client
701+
)
702+
describe_secret = aws_client.secretsmanager.describe_secret(SecretId=secret_name)
703+
sm_snapshot.match("describe_secret", describe_secret)
704+
assert "RotationEnabled" not in describe_secret
705+
assert "RotationRules" not in describe_secret
706+
assert "RotationLambdaARN" not in describe_secret
696707

708+
@markers.snapshot.skip_snapshot_verify(paths=["$..Error", "$..Message"])
709+
@markers.aws.validated
710+
def test_first_rotate_secret_with_missing_lambda_arn(
711+
self, secret_name, aws_client, account_id, sm_snapshot
712+
):
713+
self._setup_invalid_rotation_secret(
714+
None, "rotate_secret_no_arn_exc", sm_snapshot, secret_name, aws_client
715+
)
697716
describe_secret = aws_client.secretsmanager.describe_secret(SecretId=secret_name)
698717
sm_snapshot.match("describe_secret", describe_secret)
699718
assert "RotationEnabled" not in describe_secret

‎tests/aws/services/secretsmanager/test_secretsmanager.snapshot.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4860,5 +4860,45 @@
48604860
}
48614861
}
48624862
}
4863+
},
4864+
"tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_first_rotate_secret_with_missing_lambda_arn": {
4865+
"recorded-date": "27-03-2025, 16:33:46",
4866+
"recorded-content": {
4867+
"create_secret": {
4868+
"ARN": "arn:<partition>:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
4869+
"Name": "<SecretId-0idx>",
4870+
"VersionId": "<version_uuid:1>",
4871+
"ResponseMetadata": {
4872+
"HTTPHeaders": {},
4873+
"HTTPStatusCode": 200
4874+
}
4875+
},
4876+
"rotate_secret_no_arn_exc": {
4877+
"Error": {
4878+
"Code": "InvalidRequestException",
4879+
"Message": "No Lambda rotation function ARN is associated with this secret."
4880+
},
4881+
"Message": "No Lambda rotation function ARN is associated with this secret.",
4882+
"ResponseMetadata": {
4883+
"HTTPHeaders": {},
4884+
"HTTPStatusCode": 400
4885+
}
4886+
},
4887+
"describe_secret": {
4888+
"ARN": "arn:<partition>:secretsmanager:<region>:111111111111:secret:<SecretId-0idx><ArnPart-0idx>",
4889+
"CreatedDate": "datetime",
4890+
"LastChangedDate": "datetime",
4891+
"Name": "<SecretId-0idx>",
4892+
"VersionIdsToStages": {
4893+
"<version_uuid:1>": [
4894+
"AWSCURRENT"
4895+
]
4896+
},
4897+
"ResponseMetadata": {
4898+
"HTTPHeaders": {},
4899+
"HTTPStatusCode": 200
4900+
}
4901+
}
4902+
}
48634903
}
48644904
}

‎tests/aws/services/secretsmanager/test_secretsmanager.validation.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@
4141
"tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_exp_raised_on_creation_of_secret_scheduled_for_deletion": {
4242
"last_validated_date": "2024-03-15T08:13:16+00:00"
4343
},
44+
"tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_first_rotate_secret_with_missing_lambda_arn": {
45+
"last_validated_date": "2025-03-27T16:33:46+00:00"
46+
},
4447
"tests/aws/services/secretsmanager/test_secretsmanager.py::TestSecretsManager::test_force_delete_deleted_secret": {
4548
"last_validated_date": "2024-10-11T14:33:45+00:00"
4649
},

0 commit comments

Comments
 (0)