1+ # vim:set ft= ts=4 sw=4 et fdm=marker:
2+ use lib ' lib'
3+ use Test ::Nginx::Socket::Lua;
4+ use Cwd qw(cwd);
5+
6+ # worker_connections(1014);
7+ # master_process_enabled(1);
8+ # log_level('warn');
9+
10+ repeat_each(1 );
11+
12+ plan tests => repeat_each() * (blocks())+ 2;
13+
14+ my $ pwd = cwd();
15+
16+ # try to read the nameservers used by the system resolver:
17+ my @ nameservers ;
18+ if (open my $ in , " /etc/resolv.conf"
19+ while (<$in >) {
20+ if (/^ \s * nameserver\s + (\d + (? :\. \d + ){ 3 } )(? :\s + | $ )
21+ push @ nameservers , $1 ;
22+ if (@ nameservers > 10 ) {
23+ last ;
24+ }
25+ }
26+ }
27+ close $ in ;
28+ }
29+
30+ if (! @ nameservers ) {
31+ # default to Google's open DNS servers
32+ push @ nameservers , " 8.8.8.8" " 8.8.4.4"
33+ }
34+
35+
36+ warn " Using nameservers: \n @ nameservers\n "
37+
38+ our $ HttpConfig = <<_EOC_;
39+ # lua_package_path "$pwd/scripts/?.lua;;";
40+ lua_package_path 'src/lua/?.lua;/usr/local/lib/lua/?.lua;;';
41+
42+ client_body_temp_path /tmp/;
43+ proxy_temp_path /tmp/;
44+ fastcgi_temp_path /tmp/;
45+
46+ # lua_package_cpath 'src/lua/?.so;;';
47+ init_by_lua '
48+ local v = require "jit.v"
49+ v.on("$Test::Nginx::Util::ErrLogFile")
50+ require "resty.core"
51+ ';
52+ lua_shared_dict shared_cache 1m;
53+ resolver @nameservers;
54+
55+ server {
56+ listen 80;
57+ location / {
58+ proxy_pass http://127.0.0.1:\$TEST_NGINX_PORT/sts-mock;
59+ }
60+ }
61+
62+ _EOC_
63+
64+ #no_diff();
65+ no_long_string();
66+ run_tests();
67+
68+ __DATA__
69+
70+
71+ === TEST 1: test response of the SecurityTokenService
72+ --- http_config eval: $::HttpConfig
73+ --- config
74+
75+ location = /latest/meta-data/iam/security-credentials/ {
76+ return 200 'test-iam-user';
77+ }
78+
79+ location = /latest/meta-data/iam/security-credentials/test-iam-user {
80+ set_by_lua $expiration '
81+ local offset = os.time() - os.time(os.date("!*t"))
82+ return os.date("%Y-%m-%dT%H:%M:%SZ", os.time() + math.abs(offset) + 20)
83+ ';
84+ return 200 '{
85+ "Code" : "Success",
86+ "LastUpdated" : "2014-11-03T01:56:20Z",
87+ "Type" : "AWS-HMAC",
88+ "AccessKeyId" : "TEST_NGINX_AWS_CLIENT_ID",
89+ "SecretAccessKey" : "TEST_NGINX_AWS_SECRET",
90+ "Token" : "TEST_NGINX_AWS_SECURITY_TOKEN",
91+ "Expiration" : "$expiration"
92+ }';
93+ }
94+
95+ location = /sts-mock {
96+ return 200 '
97+ {
98+ "AssumedRoleUser": {
99+ "AssumedRoleId": "AROA3XFRBF535PLBIFPI4:s3-access-example",
100+ "Arn": "arn:aws:sts::123456789012:assumed-role/xaccounts3access/s3-access-example"
101+ },
102+ "Credentials": {
103+ "SecretAccessKey": "9drTJvcXLB89EXAMPLELB8923FB892xMFI",
104+ "SessionToken": "AQoXdzELDDY//////////wEaoAK1wvxJY12r2IrDFT2IvAzTCn3zHoZ7YNtpiQLF0MqZye/qwjzP2iEXAMPLEbw/m3hsj8VBTkPORGvr9jM5sgP+w9IZWZnU+LWhmg+a5fDi2oTGUYcdg9uexQ4mtCHIHfi4citgqZTgco40Yqr4lIlo4V2b2Dyauk0eYFNebHtYlFVgAUj+7Indz3LU0aTWk1WKIjHmmMCIoTkyYp/k7kUG7moeEYKSitwQIi6Gjn+nyzM+PtoA3685ixzv0R7i5rjQi0YE0lf1oeie3bDiNHncmzosRM6SFiPzSvp6h/32xQuZsjcypmwsPSDtTPYcs0+YN/8BRi2/IcrxSpnWEXAMPLEXSDFTAQAM6Dl9zR0tXoybnlrZIwMLlMi1Kcgo5OytwU=",
105+ "Expiration": "2016-03-15T00:05:07Z",
106+ "AccessKeyId": "ASIAJEXAMPLEXEG2JICEA"
107+ }
108+ }
109+ ';
110+ }
111+
112+ location /test {
113+ content_by_lua '
114+ local SecurityTokenService = require "api-gateway.aws.sts.SecurityTokenService"
115+ local sts = SecurityTokenService:new({
116+ security_credentials_host = "127.0.0.1",
117+ security_credentials_port = $TEST_NGINX_PORT,
118+ aws_region = "us-east-1",
119+ aws_debug = true, -- print warn level messages on the nginx logs
120+ aws_conn_keepalive = 60000, -- how long to keep the sockets used for AWS alive
121+ aws_conn_pool = 100 -- the connection pool size for sockets used to connect to AWS
122+ })
123+ sts.getAWSHost = function(self)
124+ return "127.0.0.1"
125+ end
126+
127+ sts.performAction = function(self, actionName, arguments, path, http_method, useSSL, timeout, contentType, extra_headers)
128+ -- force useSSL to false
129+ return SecurityTokenService.performAction(self, actionName, arguments, path, http_method, false, timeout, contentType, extra_headers)
130+ end
131+
132+ local response, code, headers, status, body = sts:assumeRole("", "", nil, nil, nil)
133+ ngx.say(":" .. tostring(response.Credentials.AccessKeyId))
134+ ';
135+ }
136+ --- request
137+ GET /test
138+ --- response_body_like eval
139+ ["ASIAJEXAMPLEXEG2JICEA"]
140+ --- error_code: 200
141+ --- no_error_log
142+ [error]
143+ --- more_headers
144+ X-Test: test
0 commit comments