Skip to content

Commit b6991e5

Browse files
authored
Add integration test for AWS web identity credential fetching (#1063)
JAVA-4234
1 parent cbb8d04 commit b6991e5

File tree

2 files changed

+81
-1
lines changed

2 files changed

+81
-1
lines changed

.evergreen/.evg.yml

Lines changed: 79 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,13 @@ functions:
344344
345345
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
346346
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
347-
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
347+
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
348+
349+
"iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
350+
"iam_web_identity_issuer": "${iam_web_identity_issuer}",
351+
"iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
352+
"iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
353+
"iam_web_identity_token_file": "${iam_web_identity_token_file}"
348354
}
349355
EOF
350356
@@ -429,6 +435,67 @@ functions:
429435
echo "" > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
430436
JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} .evergreen/run-mongodb-aws-test.sh
431437
438+
"run aws auth test with web identity credentials":
439+
- command: shell.exec
440+
type: test
441+
params:
442+
working_dir: "src"
443+
shell: "bash"
444+
script: |
445+
${PREPARE_SHELL}
446+
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
447+
. ./activate-authawsvenv.sh
448+
mongo aws_e2e_web_identity.js
449+
- command: shell.exec
450+
type: test
451+
params:
452+
working_dir: "src"
453+
shell: "bash"
454+
silent: true
455+
script: |
456+
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
457+
cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
458+
export AWS_ROLE_ARN="${iam_auth_assume_web_role_name}"
459+
export AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}"
460+
EOF
461+
- command: shell.exec
462+
type: test
463+
params:
464+
working_dir: "src"
465+
shell: "bash"
466+
script: |
467+
${PREPARE_SHELL}
468+
if [ "${AWS_CREDENTIAL_PROVIDER}" = "builtIn" ]; then
469+
echo "Built-in AWS credential provider does not support the web identity auth test, skipping..."
470+
exit 0
471+
fi
472+
JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} ASSERT_NO_URI_CREDS=true .evergreen/run-mongodb-aws-test.sh
473+
- command: shell.exec
474+
type: test
475+
params:
476+
working_dir: "src"
477+
shell: "bash"
478+
silent: true
479+
script: |
480+
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
481+
cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
482+
export AWS_ROLE_ARN="${iam_auth_assume_web_role_name}"
483+
export AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}"
484+
export AWS_ROLE_SESSION_NAME="test"
485+
EOF
486+
- command: shell.exec
487+
type: test
488+
params:
489+
working_dir: "src"
490+
shell: "bash"
491+
script: |
492+
${PREPARE_SHELL}
493+
if [ "${AWS_CREDENTIAL_PROVIDER}" = "builtIn" ]; then
494+
echo "Built-in AWS credential provider does not support the web identity auth test, skipping..."
495+
exit 0
496+
fi
497+
JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} ASSERT_NO_URI_CREDS=true .evergreen/run-mongodb-aws-test.sh
498+
432499
"run aws auth test with aws credentials as environment variables":
433500
- command: shell.exec
434501
type: test
@@ -884,6 +951,16 @@ tasks:
884951
- func: "add aws auth variables to file"
885952
- func: "run aws auth test with aws EC2 credentials"
886953

954+
- name: "aws-auth-test-with-web-identity-credentials"
955+
commands:
956+
- func: "bootstrap mongo-orchestration"
957+
vars:
958+
AUTH: "auth"
959+
ORCHESTRATION_FILE: "auth-aws.json"
960+
TOPOLOGY: "server"
961+
- func: "add aws auth variables to file"
962+
- func: "run aws auth test with web identity credentials"
963+
887964
- name: "aws-ECS-auth-test"
888965
commands:
889966
- func: "bootstrap mongo-orchestration"
@@ -1893,6 +1970,7 @@ buildvariants:
18931970
- name: "aws-auth-test-with-aws-credentials-as-environment-variables"
18941971
- name: "aws-auth-test-with-aws-credentials-and-session-token-as-environment-variables"
18951972
- name: "aws-auth-test-with-aws-EC2-credentials"
1973+
- name: "aws-auth-test-with-web-identity-credentials"
18961974

18971975
- matrix_name: "aws-ecs-auth-test"
18981976
matrix_spec: { ssl: "nossl", jdk: ["jdk8", "jdk17"], version: ["4.4", "5.0", "6.0", "latest"], os: "ubuntu" }

driver-core/build.gradle

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,9 @@ dependencies {
5151
// Optionally depend on both AWS SDK v2 and v1. The driver will use v2 is present, v1 if present, or built-in functionality if
5252
// neither are present
5353
implementation "software.amazon.awssdk:auth:$awsSdkV2Version", optional
54+
implementation "software.amazon.awssdk:sts:$awsSdkV2Version", optional
5455
implementation "com.amazonaws:aws-java-sdk-core:$awsSdkV1Version", optional
56+
implementation "com.amazonaws:aws-java-sdk-sts:$awsSdkV1Version", optional
5557

5658
implementation "org.xerial.snappy:snappy-java:$snappyVersion", optional
5759
implementation "com.github.luben:zstd-jni:$zstdVersion", optional

0 commit comments

Comments
 (0)