Merge pull request #821 from cloudskiff/issue_723_split_iam_policy

Split iam policy supplier

pkg/remote/aws/iam_policy_enumerator.go

@@ -0,0 +1,47 @@
+package aws
+
+import (
+	awssdk "github.com/aws/aws-sdk-go/aws"
+	"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
+	remoteerror "github.com/cloudskiff/driftctl/pkg/remote/error"
+	"github.com/cloudskiff/driftctl/pkg/resource"
+	"github.com/cloudskiff/driftctl/pkg/resource/aws"
+)
+
+type IamPolicyEnumerator struct {
+	repository repository.IAMRepository
+	factory    resource.ResourceFactory
+}
+
+func NewIamPolicyEnumerator(repo repository.IAMRepository, factory resource.ResourceFactory) *IamPolicyEnumerator {
+	return &IamPolicyEnumerator{
+		repository: repo,
+		factory:    factory,
+	}
+}
+
+func (e *IamPolicyEnumerator) SupportedType() resource.ResourceType {
+	return aws.AwsIamPolicyResourceType
+}
+
+func (e *IamPolicyEnumerator) Enumerate() ([]resource.Resource, error) {
+	policies, err := e.repository.ListAllPolicies()
+	if err != nil {
+		return nil, remoteerror.NewResourceEnumerationError(err, string(e.SupportedType()))
+	}
+
+	results := make([]resource.Resource, len(policies))
+
+	for _, policy := range policies {
+		results = append(
+			results,
+			e.factory.CreateAbstractResource(
+				string(e.SupportedType()),
+				awssdk.StringValue(policy.Arn),
+				map[string]interface{}{},
+			),
+		)
+	}
+
+	return results, err
+}

pkg/remote/aws/iam_policy_supplier.go

@@ -1,68 +0,0 @@
-package aws
-
-import (
-	"github.com/aws/aws-sdk-go/service/iam"
-
-	"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
-	remoteerror "github.com/cloudskiff/driftctl/pkg/remote/error"
-
-	"github.com/cloudskiff/driftctl/pkg/resource"
-	resourceaws "github.com/cloudskiff/driftctl/pkg/resource/aws"
-
-	"github.com/cloudskiff/driftctl/pkg/terraform"
-
-	"github.com/sirupsen/logrus"
-	"github.com/zclconf/go-cty/cty"
-)
-
-type IamPolicySupplier struct {
-	reader       terraform.ResourceReader
-	deserializer *resource.Deserializer
-	repository   repository.IAMRepository
-	runner       *terraform.ParallelResourceReader
-}
-
-func NewIamPolicySupplier(provider *AWSTerraformProvider, deserializer *resource.Deserializer, repository repository.IAMRepository) *IamPolicySupplier {
-	return &IamPolicySupplier{
-		provider,
-		deserializer,
-		repository,
-		terraform.NewParallelResourceReader(provider.Runner().SubRunner()),
-	}
-}
-
-func (s *IamPolicySupplier) Resources() ([]resource.Resource, error) {
-	policies, err := s.repository.ListAllPolicies()
-	if err != nil {
-		return nil, remoteerror.NewResourceEnumerationError(err, resourceaws.AwsIamPolicyResourceType)
-	}
-	results := make([]cty.Value, 0)
-	if len(policies) > 0 {
-		for _, policy := range policies {
-			u := *policy
-			s.runner.Run(func() (cty.Value, error) {
-				return s.readPolicy(&u)
-			})
-		}
-		results, err = s.runner.Wait()
-		if err != nil {
-			return nil, err
-		}
-	}
-	return s.deserializer.Deserialize(resourceaws.AwsIamPolicyResourceType, results)
-}
-
-func (s *IamPolicySupplier) readPolicy(resource *iam.Policy) (cty.Value, error) {
-	res, err := s.reader.ReadResource(
-		terraform.ReadResourceArgs{
-			Ty: resourceaws.AwsIamPolicyResourceType,
-			ID: *resource.Arn,
-		},
-	)
-	if err != nil {
-		logrus.Warnf("Error reading iam policy %s[%s]: %+v", *resource.Arn, resourceaws.AwsIamPolicyResourceType, err)
-		return cty.NilVal, err
-	}
-
-	return *res, nil
-}

pkg/remote/aws/iam_policy_supplier_test.go

@@ -1,113 +0,0 @@
-package aws
-
-import (
-	"context"
-	"testing"
-
-	"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
-	"github.com/cloudskiff/driftctl/pkg/remote/cache"
-	remoteerror "github.com/cloudskiff/driftctl/pkg/remote/error"
-	testresource "github.com/cloudskiff/driftctl/test/resource"
-
-	resourceaws "github.com/cloudskiff/driftctl/pkg/resource/aws"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-
-	"github.com/cloudskiff/driftctl/pkg/parallel"
-
-	"github.com/aws/aws-sdk-go/aws"
-
-	"github.com/aws/aws-sdk-go/service/iam"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-
-	"github.com/cloudskiff/driftctl/test/mocks"
-
-	"github.com/cloudskiff/driftctl/pkg/resource"
-	"github.com/cloudskiff/driftctl/pkg/terraform"
-	"github.com/cloudskiff/driftctl/test"
-	"github.com/cloudskiff/driftctl/test/goldenfile"
-)
-
-func TestIamPolicySupplier_Resources(t *testing.T) {
-
-	cases := []struct {
-		test    string
-		dirName string
-		mocks   func(repo *repository.MockIAMRepository)
-		err     error
-	}{
-		{
-			test:    "no iam custom policies",
-			dirName: "iam_policy_empty",
-			mocks: func(repo *repository.MockIAMRepository) {
-				repo.On("ListAllPolicies").Once().Return([]*iam.Policy{}, nil)
-			},
-			err: nil,
-		},
-		{
-			test:    "iam multiples custom policies",
-			dirName: "iam_policy_multiple",
-			mocks: func(repo *repository.MockIAMRepository) {
-				repo.On("ListAllPolicies").Once().Return([]*iam.Policy{
-					{
-						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-0"),
-					},
-					{
-						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-1"),
-					},
-					{
-						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-2"),
-					},
-				}, nil)
-			},
-			err: nil,
-		},
-		{
-			test:    "cannot list iam custom policies",
-			dirName: "iam_policy_empty",
-			mocks: func(repo *repository.MockIAMRepository) {
-				repo.On("ListAllPolicies").Once().Return(nil, awserr.NewRequestFailure(nil, 403, ""))
-			},
-			err: remoteerror.NewResourceEnumerationError(awserr.NewRequestFailure(nil, 403, ""), resourceaws.AwsIamPolicyResourceType),
-		},
-	}
-	for _, c := range cases {
-		shouldUpdate := c.dirName == *goldenfile.Update
-
-		providerLibrary := terraform.NewProviderLibrary()
-		supplierLibrary := resource.NewSupplierLibrary()
-
-		repo := testresource.InitFakeSchemaRepository("aws", "3.19.0")
-		resourceaws.InitResourcesMetadata(repo)
-		factory := terraform.NewTerraformResourceFactory(repo)
-
-		deserializer := resource.NewDeserializer(factory)
-		if shouldUpdate {
-			provider, err := InitTestAwsProvider(providerLibrary)
-			if err != nil {
-				t.Fatal(err)
-			}
-			supplierLibrary.AddSupplier(NewIamPolicySupplier(provider, deserializer, repository.NewIAMRepository(provider.session, cache.New(0))))
-		}
-
-		t.Run(c.test, func(tt *testing.T) {
-			fakeIam := repository.MockIAMRepository{}
-			c.mocks(&fakeIam)
-
-			provider := mocks.NewMockedGoldenTFProvider(c.dirName, providerLibrary.Provider(terraform.AWS), shouldUpdate)
-			s := &IamPolicySupplier{
-				provider,
-				deserializer,
-				&fakeIam,
-				terraform.NewParallelResourceReader(parallel.NewParallelRunner(context.TODO(), 10)),
-			}
-			got, err := s.Resources()
-			assert.Equal(tt, c.err, err)
-
-			mock.AssertExpectationsForObjects(tt)
-			test.CtyTestDiff(got, c.dirName, provider, deserializer, shouldUpdate, t)
-		})
-	}
-}

pkg/remote/aws/init.go

@@ -139,6 +139,9 @@ func Init(version string, alerter *alerter.Alerter,
 	remoteLibrary.AddEnumerator(NewDynamoDBTableEnumerator(dynamoDBRepository, factory))
 	remoteLibrary.AddDetailsFetcher(aws.AwsDynamodbTableResourceType, NewDynamoDBTableDetailsFetcher(provider, deserializer))
 
+	remoteLibrary.AddEnumerator(NewIamPolicyEnumerator(iamRepository, factory))
+	remoteLibrary.AddDetailsFetcher(aws.AwsIamPolicyResourceType, common.NewGenericDetailsFetcher(aws.AwsIamPolicyResourceType, provider, deserializer))
+
 	supplierLibrary.AddSupplier(NewS3BucketAnalyticSupplier(provider, s3Repository, deserializer))
 	supplierLibrary.AddSupplier(NewLambdaFunctionSupplier(provider, deserializer, lambdaRepository))
 	supplierLibrary.AddSupplier(NewIamUserSupplier(provider, deserializer, iamRepository))
@@ -146,7 +149,6 @@ func Init(version string, alerter *alerter.Alerter,
 	supplierLibrary.AddSupplier(NewIamUserPolicyAttachmentSupplier(provider, deserializer, iamRepository))
 	supplierLibrary.AddSupplier(NewIamAccessKeySupplier(provider, deserializer, iamRepository))
 	supplierLibrary.AddSupplier(NewIamRoleSupplier(provider, deserializer, iamRepository))
-	supplierLibrary.AddSupplier(NewIamPolicySupplier(provider, deserializer, iamRepository))
 	supplierLibrary.AddSupplier(NewIamRolePolicySupplier(provider, deserializer, iamRepository))
 	supplierLibrary.AddSupplier(NewIamRolePolicyAttachmentSupplier(provider, deserializer, iamRepository))
 	supplierLibrary.AddSupplier(NewVPCSecurityGroupRuleSupplier(provider, deserializer, ec2repository))

pkg/remote/iam_scanner_test.go

@@ -0,0 +1,123 @@
+package remote
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/cloudskiff/driftctl/mocks"
+	remoteaws "github.com/cloudskiff/driftctl/pkg/remote/aws"
+	"github.com/cloudskiff/driftctl/pkg/remote/aws/repository"
+	"github.com/cloudskiff/driftctl/pkg/remote/cache"
+	"github.com/cloudskiff/driftctl/pkg/remote/common"
+	"github.com/cloudskiff/driftctl/pkg/resource"
+	resourceaws "github.com/cloudskiff/driftctl/pkg/resource/aws"
+	"github.com/cloudskiff/driftctl/pkg/terraform"
+	"github.com/cloudskiff/driftctl/test"
+	"github.com/cloudskiff/driftctl/test/goldenfile"
+	testresource "github.com/cloudskiff/driftctl/test/resource"
+	terraform2 "github.com/cloudskiff/driftctl/test/terraform"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestIamPolicy(t *testing.T) {
+
+	cases := []struct {
+		test    string
+		dirName string
+		mocks   func(repo *repository.MockIAMRepository)
+		wantErr error
+	}{
+		{
+			test:    "no iam custom policies",
+			dirName: "iam_policy_empty",
+			mocks: func(repo *repository.MockIAMRepository) {
+				repo.On("ListAllPolicies").Once().Return([]*iam.Policy{}, nil)
+			},
+			wantErr: nil,
+		},
+		{
+			test:    "iam multiples custom policies",
+			dirName: "iam_policy_multiple",
+			mocks: func(repo *repository.MockIAMRepository) {
+				repo.On("ListAllPolicies").Once().Return([]*iam.Policy{
+					{
+						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-0"),
+					},
+					{
+						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-1"),
+					},
+					{
+						Arn: aws.String("arn:aws:iam::929327065333:policy/policy-2"),
+					},
+				}, nil)
+			},
+			wantErr: nil,
+		},
+		{
+			test:    "cannot list iam custom policies",
+			dirName: "iam_policy_empty",
+			mocks: func(repo *repository.MockIAMRepository) {
+				repo.On("ListAllPolicies").Once().Return(nil, awserr.NewRequestFailure(nil, 403, ""))
+			},
+			wantErr: nil,
+		},
+	}
+
+	schemaRepository := testresource.InitFakeSchemaRepository("aws", "3.19.0")
+	resourceaws.InitResourcesMetadata(schemaRepository)
+	factory := terraform.NewTerraformResourceFactory(schemaRepository)
+	deserializer := resource.NewDeserializer(factory)
+
+	for _, c := range cases {
+		t.Run(c.test, func(tt *testing.T) {
+			shouldUpdate := c.dirName == *goldenfile.Update
+
+			sess := session.Must(session.NewSessionWithOptions(session.Options{
+				SharedConfigState: session.SharedConfigEnable,
+			}))
+
+			scanOptions := ScannerOptions{Deep: true}
+			providerLibrary := terraform.NewProviderLibrary()
+			remoteLibrary := common.NewRemoteLibrary()
+
+			// Initialize mocks
+			alerter := &mocks.AlerterInterface{}
+			alerter.On("SendAlert", mock.Anything, mock.Anything).Maybe().Return()
+			fakeRepo := &repository.MockIAMRepository{}
+			c.mocks(fakeRepo)
+			var repo repository.IAMRepository = fakeRepo
+			providerVersion := "3.19.0"
+			realProvider, err := terraform2.InitTestAwsProvider(providerLibrary, providerVersion)
+			if err != nil {
+				t.Fatal(err)
+			}
+			provider := terraform2.NewFakeTerraformProvider(realProvider)
+			provider.WithResponse(c.dirName)
+
+			// Replace mock by real resources if we are in update mode
+			if shouldUpdate {
+				err := realProvider.Init()
+				if err != nil {
+					t.Fatal(err)
+				}
+				provider.ShouldUpdate()
+				repo = repository.NewIAMRepository(sess, cache.New(0))
+			}
+
+			remoteLibrary.AddEnumerator(remoteaws.NewIamPolicyEnumerator(repo, factory))
+			remoteLibrary.AddDetailsFetcher(resourceaws.AwsIamPolicyResourceType, common.NewGenericDetailsFetcher(resourceaws.AwsIamPolicyResourceType, provider, deserializer))
+
+			s := NewScanner(nil, remoteLibrary, alerter, scanOptions)
+			got, err := s.Resources()
+			assert.Equal(tt, err, c.wantErr)
+			if err != nil {
+				return
+			}
+			test.TestAgainstGoldenFile(got, resourceaws.AwsIamPolicyResourceType, c.dirName, provider, deserializer, shouldUpdate, tt)
+		})
+	}
+}