如何使用CDK断言测试用户是否具有托管策略?

Question

我已经在CDK v2中定义了一个用户和一个托管策略，类似于:

const policy = new iam.ManagedPolicy(this, `s3access`, {
statements: [
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['s3:PutObject', 's3:GetObject'],
resources: ['*']
})
]
})

const someUser = new iam.User(this, 'some-user', { managedPolicies: [policy] });

我想测试用户是否使用CDK测试断言应用了托管策略，但是我正在努力弄清楚如何使用现有的测试构造:

template.hasResourceProperties('AWS::IAM::ManagedPolicy', {
PolicyDocument: Match.objectLike({
Statement: [
{
Action: ['s3:PutObject', 's3:GetObject'],
Effect: 'Allow',
Resource: [
'*'
]
},
]
})
})

…匹配托管策略，但不测试用户是否应用了托管策略。

这样做的模式/最佳实践是什么?

Answer 1

您需要匹配用户管理的策略编号，因为它出现在模板中:

"Type": "AWS::IAM::User",
"Properties": {
"ManagedPolicyArns": [
{
"Ref": "s3access10922181"
}
]

技巧是获取策略的{"Ref": "s3access10922181"}引用。下面是两个等价的方法:

方法1:stack.node.tryFindChild

const managedPolicyChild = stack.node.tryFindChild('s3access') as iam.ManagedPolicy | undefined;
if (!managedPolicyChild) throw new Error('Expected a defined ManagedPolicy');
const policyArnRef = stack.resolve(managedPolicyChild.managedPolicyArn);
template.hasResourceProperties('AWS::IAM::User', {
ManagedPolicyArns: Match.arrayWith([policyArnRef]),
});

方法2:template.findResources

const managedPolicyResources = template.findResources('AWS::IAM::ManagedPolicy');
const managedPolicyLogicalId = Object.keys(managedPolicyResources).find((k) => k.startsWith('s3access'));
if (!managedPolicyLogicalId) throw new Error('Expected to find a ManagedPolicy Id');
template.hasResourceProperties('AWS::IAM::User', {
ManagedPolicyArns: Match.arrayWith([{ Ref: managedPolicyLogicalId }]),
});