test(integration): migrate serial-console access checks off live guests

Enable/Disable/GetSerialConsoleAccessEnabled is pure gateway+account-settings
logic with no guest involved, so it moves to the in-process integration tier
against the real AccountSettingsServiceImpl wired into DaemonLite.

tests/e2e/single/discovery_test.go

@@ -146,33 +146,3 @@ func runDiscovery(t *testing.T, fix *Fixture) {
 	az := needAZ(t, fix)
 	harness.Detail(t, "instance_type", instType, "arch", arch, "az", az)
 }
-
-// runSerialConsoleAccess flips serial-console-access on then off and verifies
-// each transition with both the action-returned bool and a follow-up
-// get-status round-trip. Maps to run-e2e.sh ~166–202.
-func runSerialConsoleAccess(t *testing.T, fix *Fixture) {
-	harness.Phase(t, "Single — Serial Console Access")
-
-	harness.Step(t, "default state should be disabled")
-	if got := harness.GetSerialConsoleAccessEnabled(t, fix.AWS); got {
-		t.Fatalf("expected serial console default disabled, got enabled")
-	}
-
-	harness.Step(t, "enable")
-	if got := harness.EnableSerialConsoleAccess(t, fix.AWS); !got {
-		t.Fatalf("enable: action returned enabled=false")
-	}
-	if got := harness.GetSerialConsoleAccessEnabled(t, fix.AWS); !got {
-		t.Fatalf("enable: subsequent get-status returned disabled")
-	}
-	harness.Detail(t, "state", "enabled")
-
-	harness.Step(t, "disable")
-	if got := harness.DisableSerialConsoleAccess(t, fix.AWS); got {
-		t.Fatalf("disable: action returned enabled=true")
-	}
-	if got := harness.GetSerialConsoleAccessEnabled(t, fix.AWS); got {
-		t.Fatalf("disable: subsequent get-status returned enabled")
-	}
-	harness.Detail(t, "state", "disabled")
-}

tests/e2e/single/tests_test.go

@@ -25,11 +25,6 @@ func TestDiscovery(t *testing.T) {
 	runDiscovery(t, requireSingleNodeFixture(t))
 }
 
-func TestSerialConsoleAccess(t *testing.T) {
-	t.Parallel()
-	runSerialConsoleAccess(t, requireSingleNodeFixture(t))
-}
-
 func TestImage(t *testing.T) {
 	t.Parallel()
 	runImage(t, requireSingleNodeFixture(t))

tests/integration/daemon_lite.go

@@ -194,8 +194,9 @@ func sub(t *testing.T, nc *nats.Conn, subject string, handler nats.MsgHandler) {
 
 // subscribe wires every subject the in-scope ported tests (TestKeyPairs,
 // TestTagManagement, TestRouteTableValidation, TestReplaceRouteConvergence,
-// TestAccountScoping_*) exercise, plus their supporting VPC/subnet/SG/IGW/
-// EIGW/account-settings subjects, to the real service impls held on dl.
+// TestAccountScoping_*, TestSerialConsoleAccess) exercise, plus their
+// supporting VPC/subnet/SG/IGW/EIGW/account-settings subjects, to the real
+// service impls held on dl.
 func (dl *DaemonLite) subscribe(t *testing.T, nc *nats.Conn) {
 	t.Helper()
 
@@ -267,4 +268,7 @@ func (dl *DaemonLite) subscribe(t *testing.T, nc *nats.Conn) {
 	sub(t, nc, "ec2.EnableEbsEncryptionByDefault", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.EnableEbsEncryptionByDefault) })
 	sub(t, nc, "ec2.DisableEbsEncryptionByDefault", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.DisableEbsEncryptionByDefault) })
 	sub(t, nc, "ec2.GetEbsEncryptionByDefault", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.GetEbsEncryptionByDefault) })
+	sub(t, nc, "ec2.EnableSerialConsoleAccess", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.EnableSerialConsoleAccess) })
+	sub(t, nc, "ec2.DisableSerialConsoleAccess", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.DisableSerialConsoleAccess) })
+	sub(t, nc, "ec2.GetSerialConsoleAccessStatus", func(m *nats.Msg) { dispatch(m, dl.AccountSettings.GetSerialConsoleAccessStatus) })
 }

tests/integration/serial_console_test.go

@@ -0,0 +1,45 @@
+//go:build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSerialConsoleAccess ports tests/e2e/single/discovery_test.go's
+// runSerialConsoleAccess: it flips the account-wide serial-console-access
+// setting on then off, checking every transition with both the
+// action-returned bool and a follow-up get-status round-trip, against the
+// real AccountSettingsServiceImpl DaemonLite wires up (the same production
+// code and NATS JetStream KV persistence a live daemon uses).
+func TestSerialConsoleAccess(t *testing.T) {
+	t.Parallel()
+
+	gw := StartGateway(t)
+	StartDaemonLite(t, gw)
+	ec2Cli := gw.EC2Client(t)
+
+	statusOut, err := ec2Cli.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	require.NoError(t, err, "get-serial-console-access-status (default)")
+	require.False(t, aws.BoolValue(statusOut.SerialConsoleAccessEnabled), "expected serial console default disabled")
+
+	enableOut, err := ec2Cli.EnableSerialConsoleAccess(&ec2.EnableSerialConsoleAccessInput{})
+	require.NoError(t, err, "enable-serial-console-access")
+	require.True(t, aws.BoolValue(enableOut.SerialConsoleAccessEnabled), "enable: action returned enabled=false")
+
+	statusOut, err = ec2Cli.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	require.NoError(t, err, "get-serial-console-access-status (after enable)")
+	require.True(t, aws.BoolValue(statusOut.SerialConsoleAccessEnabled), "enable: subsequent get-status returned disabled")
+
+	disableOut, err := ec2Cli.DisableSerialConsoleAccess(&ec2.DisableSerialConsoleAccessInput{})
+	require.NoError(t, err, "disable-serial-console-access")
+	require.False(t, aws.BoolValue(disableOut.SerialConsoleAccessEnabled), "disable: action returned enabled=true")
+
+	statusOut, err = ec2Cli.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	require.NoError(t, err, "get-serial-console-access-status (after disable)")
+	require.False(t, aws.BoolValue(statusOut.SerialConsoleAccessEnabled), "disable: subsequent get-status returned enabled")
+}