From 7b4a83ccfe363cdf72d3fff8ed03c9ab99c4cf81 Mon Sep 17 00:00:00 2001 From: Julian Sommer <115516918+juliansommer@users.noreply.github.com> Date: Thu, 3 Sep 2026 15:51:27 +1000 Subject: [PATCH] fix: expect InvalidSnapshot.NotFound for cross-account DeleteSnapshot Snapshot metadata is now keyed by owning account, so a snapshot outside the caller's prefix is absent rather than forbidden. The e2e assertion still encoded the pre-partitioning UnauthorizedOperation contract. --- tests/e2e/single/account_test.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/e2e/single/account_test.go b/tests/e2e/single/account_test.go index 214add9df..f3f267d98 100644 --- a/tests/e2e/single/account_test.go +++ b/tests/e2e/single/account_test.go @@ -481,9 +481,10 @@ func runAccountScoping(t *testing.T, fix *Fixture) { assert.Equal(t, alpha.AccountID, aws.StringValue(alphaSnaps.Snapshots[0].OwnerId), "alpha snapshot OwnerId mismatch") - // DeleteSnapshot returns UnauthorizedOperation (not NotFound) across accounts. - harness.Step(t, "cross-account delete-snapshot blocked (UnauthorizedOperation)") - harness.ExpectError(t, "UnauthorizedOperation", func() error { + // Snapshot metadata is keyed by owning account, so a snapshot outside the + // caller's prefix is absent rather than forbidden. + harness.Step(t, "cross-account delete-snapshot blocked (InvalidSnapshot.NotFound)") + harness.ExpectError(t, "InvalidSnapshot.NotFound", func() error { _, err := beta.Client.EC2.DeleteSnapshot(&ec2.DeleteSnapshotInput{ SnapshotId: aws.String(alphaSnap), })