Merge pull request #1477 from snyk/feat/add_aws_iam_group

Add aws_iam_group

pkg/iac/terraform/state/terraform_state_reader_test.go

@@ -199,6 +199,7 @@ func TestTerraformStateReader_AWS_Resources(t *testing.T) {
 		{name: "Load balancer listener", dirName: "aws_lb_listener", wantErr: false},
 		{name: "Classic load balancer", dirName: "aws_elb", wantErr: false},
 		{name: "ElastiCache Cluster", dirName: "aws_elasticache_cluster", wantErr: false},
+		{name: "IAM Group", dirName: "aws_iam_group", wantErr: false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/iac/terraform/state/test/aws_iam_group/results.golden.json

@@ -0,0 +1,13 @@
+[
+ {
+  "Id": "developers",
+  "Type": "aws_iam_group",
+  "Attrs": {
+   "arn": "arn:aws:iam::533948124879:group/users/developers",
+   "id": "developers",
+   "name": "developers",
+   "path": "/users/",
+   "unique_id": "AGPAXYUOJZ3HYXMHVQXQK"
+  }
+ }
+]

pkg/iac/terraform/state/test/aws_iam_group/terraform.tfstate

@@ -0,0 +1,29 @@
+{
+  "version": 4,
+  "terraform_version": "1.0.0",
+  "serial": 9,
+  "lineage": "6658c307-5bb4-bd91-52b9-085d3abbc215",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "aws_iam_group",
+      "name": "my_developers",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "arn": "arn:aws:iam::533948124879:group/users/developers",
+            "id": "developers",
+            "name": "developers",
+            "path": "/users/",
+            "unique_id": "AGPAXYUOJZ3HYXMHVQXQK"
+          },
+          "sensitive_attributes": [],
+          "private": "bnVsbA=="
+        }
+      ]
+    }
+  ]
+}

pkg/remote/aws/iam_group_enumerator.go

@@ -0,0 +1,46 @@
+package aws
+
+import (
+	"github.com/snyk/driftctl/pkg/remote/aws/repository"
+	remoteerror "github.com/snyk/driftctl/pkg/remote/error"
+	"github.com/snyk/driftctl/pkg/resource"
+	"github.com/snyk/driftctl/pkg/resource/aws"
+)
+
+type IamGroupEnumerator struct {
+	repository repository.IAMRepository
+	factory    resource.ResourceFactory
+}
+
+func NewIamGroupEnumerator(repo repository.IAMRepository, factory resource.ResourceFactory) *IamGroupEnumerator {
+	return &IamGroupEnumerator{
+		repository: repo,
+		factory:    factory,
+	}
+}
+
+func (e *IamGroupEnumerator) SupportedType() resource.ResourceType {
+	return aws.AwsIamGroupResourceType
+}
+
+func (e *IamGroupEnumerator) Enumerate() ([]*resource.Resource, error) {
+	groups, err := e.repository.ListAllGroups()
+	if err != nil {
+		return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), aws.AwsIamGroupResourceType)
+	}
+
+	results := make([]*resource.Resource, 0, len(groups))
+
+	for _, group := range groups {
+		results = append(
+			results,
+			e.factory.CreateAbstractResource(
+				string(e.SupportedType()),
+				*group.GroupName,
+				map[string]interface{}{},
+			),
+		)
+	}
+
+	return results, err
+}

pkg/remote/aws/iam_group_policy_enumerator.go

@@ -26,8 +26,7 @@ func (e *IamGroupPolicyEnumerator) SupportedType() resource.ResourceType {
 func (e *IamGroupPolicyEnumerator) Enumerate() ([]*resource.Resource, error) {
 	groups, err := e.repository.ListAllGroups()
 	if err != nil {
-		// TODO Use constant instead of string for `aws_iam_group` here when we'll add support for the group resource
-		return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), "aws_iam_group")
+		return nil, remoteerror.NewResourceListingErrorWithType(err, string(e.SupportedType()), aws.AwsIamGroupResourceType)
 	}
 	groupPolicies, err := e.repository.ListAllGroupPolicies(groups)
 	if err != nil {

pkg/remote/aws/init.go

@@ -182,6 +182,7 @@ func Init(version string, alerter *alerter.Alerter,
 	remoteLibrary.AddEnumerator(NewIamUserPolicyAttachmentEnumerator(iamRepository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsIamUserPolicyAttachmentResourceType, common.NewGenericDetailsFetcher(aws.AwsIamUserPolicyAttachmentResourceType, provider, deserializer))
 	remoteLibrary.AddEnumerator(NewIamGroupPolicyEnumerator(iamRepository, factory))
+	remoteLibrary.AddEnumerator(NewIamGroupEnumerator(iamRepository, factory))
 
 	remoteLibrary.AddEnumerator(NewECRRepositoryEnumerator(ecrRepository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsEcrRepositoryResourceType, common.NewGenericDetailsFetcher(aws.AwsEcrRepositoryResourceType, provider, deserializer))

pkg/remote/aws_iam_scanner_test.go

@@ -1193,8 +1193,7 @@ func TestIamGroupPolicy(t *testing.T) {
 			mocks: func(repository *repository.MockIAMRepository) {
 				repository.On("ListAllGroups").Return(nil, dummyError)
 			},
-			// TODO Use constant instead of string for `aws_iam_group` here when we'll add support for the group resource
-			wantErr: remoteerr.NewResourceListingErrorWithType(dummyError, resourceaws.AwsIamGroupPolicyResourceType, "aws_iam_group"),
+			wantErr: remoteerr.NewResourceListingErrorWithType(dummyError, resourceaws.AwsIamGroupPolicyResourceType, resourceaws.AwsIamGroupResourceType),
 		},
 		{
 			test: "cannot list policies",
@@ -1244,3 +1243,80 @@ func TestIamGroupPolicy(t *testing.T) {
 		})
 	}
 }
+
+func TestIamGroup(t *testing.T) {
+	dummyError := errors.New("this is an error")
+
+	tests := []struct {
+		test           string
+		mocks          func(*repository.MockIAMRepository)
+		assertExpected func(t *testing.T, got []*resource.Resource)
+		wantErr        error
+	}{
+		{
+			test: "multiple groups, with multiples groups",
+			mocks: func(repository *repository.MockIAMRepository) {
+				repository.On("ListAllGroups").Return([]*iam.Group{
+					{
+						GroupName: aws.String("group1"),
+					},
+					{
+						GroupName: aws.String("group2"),
+					},
+				}, nil)
+			},
+			assertExpected: func(t *testing.T, got []*resource.Resource) {
+				assert.Len(t, got, 2)
+				assert.Equal(t, resourceaws.AwsIamGroupResourceType, got[0].ResourceType())
+				assert.Equal(t, "group1", got[0].ResourceId())
+				assert.Equal(t, resourceaws.AwsIamGroupResourceType, got[1].ResourceType())
+				assert.Equal(t, "group2", got[1].ResourceId())
+			},
+		},
+		{
+			test: "cannot list groups",
+			mocks: func(repository *repository.MockIAMRepository) {
+				repository.On("ListAllGroups").Return(nil, dummyError)
+			},
+			wantErr: remoteerr.NewResourceListingError(dummyError, resourceaws.AwsIamGroupResourceType),
+		},
+	}
+
+	providerVersion := "3.19.0"
+	schemaRepository := testresource.InitFakeSchemaRepository("aws", providerVersion)
+	resourceaws.InitResourcesMetadata(schemaRepository)
+	factory := terraform.NewTerraformResourceFactory(schemaRepository)
+
+	for _, c := range tests {
+		t.Run(c.test, func(tt *testing.T) {
+			scanOptions := ScannerOptions{}
+			remoteLibrary := common.NewRemoteLibrary()
+
+			// Initialize mocks
+			alerter := &mocks.AlerterInterface{}
+			fakeRepo := &repository.MockIAMRepository{}
+			c.mocks(fakeRepo)
+
+			var repo repository.IAMRepository = fakeRepo
+
+			remoteLibrary.AddEnumerator(remoteaws.NewIamGroupEnumerator(
+				repo, factory,
+			))
+
+			testFilter := &filter.MockFilter{}
+			testFilter.On("IsTypeIgnored", mock.Anything).Return(false)
+
+			s := NewScanner(remoteLibrary, alerter, scanOptions, testFilter)
+			got, err := s.Resources()
+			assert.Equal(tt, c.wantErr, err)
+			if err != nil {
+				return
+			}
+
+			c.assertExpected(tt, got)
+			alerter.AssertExpectations(tt)
+			fakeRepo.AssertExpectations(tt)
+			testFilter.AssertExpectations(tt)
+		})
+	}
+}

pkg/resource/aws/aws_iam_group.go

@@ -0,0 +1,3 @@
+package aws
+
+const AwsIamGroupResourceType = "aws_iam_group"

pkg/resource/aws/aws_iam_group_test.go

@@ -0,0 +1,30 @@
+package aws_test
+
+import (
+	"testing"
+
+	"github.com/snyk/driftctl/test"
+	"github.com/snyk/driftctl/test/acceptance"
+)
+
+func TestAcc_Aws_IamGoup(t *testing.T) {
+	acceptance.Run(t, acceptance.AccTestCase{
+		TerraformVersion: "0.15.5",
+		Paths:            []string{"./testdata/acc/aws_iam_group"},
+		Args:             []string{"scan"},
+		Checks: []acceptance.AccCheck{
+			{
+				Env: map[string]string{
+					"AWS_REGION": "us-east-1",
+				},
+				Check: func(result *test.ScanResult, stdout string, err error) {
+					if err != nil {
+						t.Fatal(err)
+					}
+					result.AssertInfrastructureIsInSync()
+					result.AssertManagedCount(1)
+				},
+			},
+		},
+	})
+}

pkg/resource/aws/metadata_test.go

@@ -114,6 +114,7 @@ func TestAWS_Metadata_Flags(t *testing.T) {
 		AwsClassicLoadBalancerResourceType:             {},
 		AwsLoadBalancerListenerResourceType:            {},
 		AwsApplicationLoadBalancerListenerResourceType: {},
+		AwsIamGroupResourceType:                        {},
 	}
 
 	schemaRepository := testresource.InitFakeSchemaRepository(tf.AWS, "3.19.0")

pkg/resource/aws/testdata/acc/aws_iam_group/.driftignore

@@ -0,0 +1,2 @@
+*
+!aws_iam_group

pkg/resource/aws/testdata/acc/aws_iam_group/.terraform.lock.hcl

@@ -0,0 +1,20 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "3.19.0"
+  constraints = "3.19.0"
+  hashes = [
+    "h1:+7Vi7p13+cnrxjXbfJiTimGSFR97xCaQwkkvWcreLns=",
+    "zh:185a5259153eb9ee4699d4be43b3d509386b473683392034319beee97d470c3b",
+    "zh:2d9a0a01f93e8d16539d835c02b8b6e1927b7685f4076e96cb07f7dd6944bc6c",
+    "zh:703f6da36b1b5f3497baa38fccaa7765fb8a2b6440344e4c97172516b49437dd",
+    "zh:770855565462abadbbddd98cb357d2f1a8f30f68a358cb37cbd5c072cb15b377",
+    "zh:8008db43149fe4345301f81e15e6d9ddb47aa5e7a31648f9b290af96ad86e92a",
+    "zh:8cdd27d375da6dcb7687f1fed126b7c04efce1671066802ee876dbbc9c66ec79",
+    "zh:be22ae185005690d1a017c1b909e0d80ab567e239b4f06ecacdba85080667c1c",
+    "zh:d2d02e72dbd80f607636cd6237a6c862897caabc635c7b50c0cb243d11246723",
+    "zh:d8f125b66a1eda2555c0f9bbdf12036a5f8d073499a22ca9e4812b68067fea31",
+    "zh:f5a98024c64d5d2973ff15b093725a074c0cb4afde07ef32c542e69f17ac90bc",
+  ]
+}

pkg/resource/aws/testdata/acc/aws_iam_group/terraform.tf

@@ -0,0 +1,14 @@
+provider "aws" {
+    region = "us-east-1"
+}
+
+terraform {
+    required_providers {
+        aws = "3.19.0"
+    }
+}
+
+resource "aws_iam_group" "my_developers" {
+    name = "developers"
+    path = "/users/"
+}

pkg/resource/resource_types.go

@@ -61,6 +61,7 @@ var supportedTypes = map[string]ResourceTypeMeta{
 		"aws_iam_policy_attachment",
 	}},
 	"aws_iam_group_policy": {},
+	"aws_iam_group":        {},
 	"aws_instance": {children: []ResourceType{
 		"aws_ebs_volume",
 	}},