Skip to content

Add fixture for creating an IAM role and attaching existing policy #12251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 12, 2025
Merged

Add fixture for creating an IAM role and attaching existing policy #12251

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 58 additions & 2 deletions localstack-core/localstack/testing/pytest/fixtures.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1755,11 +1755,61 @@ def lambda_su_role(aws_client):
run_safe(aws_client.iam.delete_policy(PolicyArn=policy_arn))


@pytest.fixture
def create_iam_role_and_attach_policy(aws_client):
"""
Fixture that creates an IAM role with given role definition and predefined policy ARN.

Use this fixture with AWS managed policies like 'AmazonS3ReadOnlyAccess' or 'AmazonKinesisFullAccess'.
"""
roles = []

def _inner(**kwargs: dict[str, any]) -> str:
"""
:param dict RoleDefinition: role definition document
:param str PolicyArn: policy ARN
:param str RoleName: role name (autogenerated if omitted)
:return: role ARN
"""
if "RoleName" not in kwargs:
kwargs["RoleName"] = f"test-role-{short_uid()}"

role = kwargs["RoleName"]
role_policy = json.dumps(kwargs["RoleDefinition"])

result = aws_client.iam.create_role(RoleName=role, AssumeRolePolicyDocument=role_policy)
role_arn = result["Role"]["Arn"]

policy_arn = kwargs["PolicyArn"]
aws_client.iam.attach_role_policy(PolicyArn=policy_arn, RoleName=role)

roles.append(role)
return role_arn

yield _inner

for role in roles:
try:
aws_client.iam.delete_role(RoleName=role)
except Exception as exc:
LOG.debug("Error deleting IAM role '%s': %s", role, exc)


@pytest.fixture
def create_iam_role_with_policy(aws_client):
"""
Fixture that creates an IAM role with given role definition and policy definition.
"""
roles = {}

def _create_role_and_policy(**kwargs: dict[str, any]) -> str:
"""
:param dict RoleDefinition: role definition document
:param dict PolicyDefinition: policy definition document
:param str PolicyName: policy name (autogenerated if omitted)
:param str RoleName: role name (autogenerated if omitted)
:return: role ARN
"""
if "RoleName" not in kwargs:
kwargs["RoleName"] = f"test-role-{short_uid()}"
role = kwargs["RoleName"]
Expand All @@ -1781,8 +1831,14 @@ def _create_role_and_policy(**kwargs: dict[str, any]) -> str:
yield _create_role_and_policy

for role_name, policy_name in roles.items():
aws_client.iam.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
aws_client.iam.delete_role(RoleName=role_name)
try:
aws_client.iam.delete_role_policy(RoleName=role_name, PolicyName=policy_name)
except Exception as exc:
LOG.debug("Error deleting IAM role policy '%s' '%s': %s", role_name, policy_name, exc)
try:
aws_client.iam.delete_role(RoleName=role_name)
except Exception as exc:
LOG.debug("Error deleting IAM role '%s': %s", role_name, exc)


@pytest.fixture
Expand Down
Loading