gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-15 17:11:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: update STS e2e assertion for unconditional AccessDenied masking on missing roles

Browse Source
This commit is contained in:
Julian Sommer
2026-07-03 15:23:30 +10:00
parent 3821d94613
commit 378ba01fd5
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/iam/sts_test.go
+5 -5
View File
@@ -439,11 +439,11 @@ func runSTS(t *testing.T, fix *Fixture) {
return e
})
// Same-account miss → NoSuchEntity. Cross-account miss is masked to
// AccessDenied by the handler; that's covered by handlers/sts unit tests
// since the single-node fixture only has one account.
harness.Step(t, "assume-role missing role (expect NoSuchEntity)")
harness.ExpectError(t, "NoSuchEntity", func() error {
// All missing-role lookups are masked to AccessDenied by the handler,
// matching AWS and preventing role enumeration; same- vs cross-account
// masking is covered by handlers/sts unit tests.
harness.Step(t, "assume-role missing role (expect AccessDenied)")
harness.ExpectError(t, "AccessDenied", func() error {
_, e := fix.AWS.STS.AssumeRole(&sts.AssumeRoleInput{
RoleArn: aws.String(harness.IAMRoleARN(adminAccount,
"sts-e2e-no-such-role")),