Examples with AwsConfusedDeputyException com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException used on opensource projects

Example 1 with AwsConfusedDeputyException

use of com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException in project cloudbreak by hortonworks.

the class AwsCredentialConnectorTest method testVerifyByServiceIfRoleBasedCredentialVerificationThrowsAwsConfusedDeputyExceptionThenFailed503StatusShouldReturn.

@Test
public void testVerifyByServiceIfRoleBasedCredentialVerificationThrowsAwsConfusedDeputyExceptionThenFailed503StatusShouldReturn() throws IOException {
    URL url = Resources.getResource("definitions/aws-environment-minimal-policy.json");
    String awsEnvPolicy = Resources.toString(url, UTF_8);
    String encodedAwsEnvPolicy = Base64.getEncoder().encodeToString(awsEnvPolicy.getBytes());
    List<String> services = List.of("ml");
    Map<String, String> experiencePrerequisites = Map.of("ml", encodedAwsEnvPolicy);
    String roleArn = "someRoleArn";
    when(credentialView.getRoleArn()).thenReturn(roleArn);
    String exceptionMessageComesFromSdk = "Unable to verify credential: check if the role 'someRoleArn' exists " + "and it's created with the correct external ID. Cause: 'SomethingTerribleHappened!!";
    Exception sdkException = new AwsConfusedDeputyException("SomethingTerribleHappened");
    when(awsPlatformParameters.getEnvironmentMinimalPoliciesJson()).thenReturn(Map.of(PolicyType.PUBLIC, encodedAwsEnvPolicy, PolicyType.GOV, encodedAwsEnvPolicy));
    when(credentialClient.retrieveSessionCredentials(any())).thenThrow(sdkException);
    CDPServicePolicyVerificationResponses result = underTest.verifyByServices(authenticatedContext, services, experiencePrerequisites);
    assertNotNull(result);
    assertEquals(result.getResults().size(), 1);
    assertEquals(result.getResults().stream().findFirst().get().getServiceName(), "ml");
    assertEquals(result.getResults().stream().findFirst().get().getServiceStatus(), "SomethingTerribleHappened");
    assertEquals(result.getResults().stream().findFirst().get().getStatusCode(), 503);
}

Example 2 with AwsConfusedDeputyException

use of com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException in project cloudbreak by hortonworks.

the class AwsCredentialConnector method verifyIamRoleIsAssumable.

private CDPServicePolicyVerificationResponses verifyIamRoleIsAssumable(CloudCredential cloudCredential, List<String> services, Map<String, String> experiencePrerequisites) {
    AwsCredentialView awsCredential = credentialViewProvider.createAwsCredentialView(cloudCredential);
    CDPServicePolicyVerificationResponses credentialStatus;
    Map<String, String> servicesWithPolicies = new HashMap<>();
    services.forEach(service -> experiencePrerequisites.keySet().stream().filter(AwsCredentialConnector::isPolicyServiceMatchesForName).findFirst().ifPresent(policyKey -> servicesWithPolicies.put(service, experiencePrerequisites.get(policyKey))));
    try {
        credentialClient.retrieveSessionCredentials(awsCredential);
        credentialStatus = verifyCredentialsPermission(awsCredential, servicesWithPolicies);
    } catch (AmazonClientException ae) {
        String errorMessage = getErrorMessageForAwsClientException(awsCredential, ae);
        LOGGER.warn(errorMessage, ae);
        credentialStatus = new CDPServicePolicyVerificationResponses(getServiceStatus(services, errorMessage));
    } catch (AwsConfusedDeputyException confusedDeputyEx) {
        credentialStatus = new CDPServicePolicyVerificationResponses(getServiceStatus(services, confusedDeputyEx.getMessage()));
    } catch (RuntimeException e) {
        String errorMessage = String.format("Unable to verify credential: check if the role '%s' exists and it's created with the correct external ID. " + "Cause: '%s'", awsCredential.getRoleArn(), e.getMessage());
        LOGGER.warn(errorMessage, e);
        credentialStatus = new CDPServicePolicyVerificationResponses(getServiceStatus(services, errorMessage));
    }
    return credentialStatus;
}

Example 3 with AwsConfusedDeputyException

use of com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException in project cloudbreak by hortonworks.

the class AwsCredentialConnectorTest method testVerifyByServiceIfRoleBasedCredentialVerificationThrowsSdkBaseExceptionThenFailedStatusShouldReturn.

@Test
public void testVerifyByServiceIfRoleBasedCredentialVerificationThrowsSdkBaseExceptionThenFailedStatusShouldReturn() throws IOException {
    URL url = Resources.getResource("definitions/aws-environment-minimal-policy.json");
    String awsEnvPolicy = Resources.toString(url, UTF_8);
    String encodedAwsEnvPolicy = Base64.getEncoder().encodeToString(awsEnvPolicy.getBytes());
    List<String> services = List.of("ml");
    Map<String, String> experiencePrerequisites = Map.of("ml", encodedAwsEnvPolicy);
    String roleArn = "someRoleArn";
    when(credentialView.getRoleArn()).thenReturn(roleArn);
    String exceptionMessageComesFromSdk = "Unable to verify credential: check if the role 'someRoleArn' exists " + "and it's created with the correct external ID. Cause: 'SomethingTerribleHappened!!";
    Exception sdkException = new AwsConfusedDeputyException("SomethingTerribleHappened");
    when(awsPlatformParameters.getEnvironmentMinimalPoliciesJson()).thenReturn(Map.of(PolicyType.PUBLIC, encodedAwsEnvPolicy, PolicyType.GOV, encodedAwsEnvPolicy));
    when(credentialClient.retrieveSessionCredentials(any())).thenThrow(sdkException);
    CDPServicePolicyVerificationResponses result = underTest.verifyByServices(authenticatedContext, services, experiencePrerequisites);
    assertNotNull(result);
    assertEquals(result.getResults().size(), 1);
    assertEquals(result.getResults().stream().findFirst().get().getServiceName(), "ml");
    assertEquals(result.getResults().stream().findFirst().get().getServiceStatus(), "SomethingTerribleHappened");
    assertEquals(result.getResults().stream().findFirst().get().getStatusCode(), 503);
}

Example 4 with AwsConfusedDeputyException

use of com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException in project cloudbreak by hortonworks.

the class AwsCredentialConnectorTest method testInternalAlternativeLookupShouldWorkFine.

@Test
public void testInternalAlternativeLookupShouldWorkFine() throws IOException {
    String awsEnvPolicy = Resources.toString(Resources.getResource("definitions/aws-environment-minimal-policy.json"), UTF_8);
    String encodedAwsEnvPolicy = Base64.getEncoder().encodeToString(awsEnvPolicy.getBytes());
    String service = MLX.getInternalAlternatives().stream().findFirst().get();
    List<String> services = List.of(service);
    Map<String, String> experiencePrerequisites = Map.of(MLX.getPublicName(), encodedAwsEnvPolicy);
    when(credentialView.getRoleArn()).thenReturn("someRoleArn");
    Exception sdkException = new AwsConfusedDeputyException("SomethingTerribleHappened");
    when(awsPlatformParameters.getEnvironmentMinimalPoliciesJson()).thenReturn(Map.of(PolicyType.PUBLIC, encodedAwsEnvPolicy, PolicyType.GOV, encodedAwsEnvPolicy));
    when(credentialClient.retrieveSessionCredentials(any())).thenThrow(sdkException);
    CDPServicePolicyVerificationResponses result = underTest.verifyByServices(authenticatedContext, services, experiencePrerequisites);
    assertNotNull(result);
    assertEquals(result.getResults().size(), 1);
    assertEquals(result.getResults().stream().findFirst().get().getServiceName(), service);
    assertEquals(result.getResults().stream().findFirst().get().getServiceStatus(), "SomethingTerribleHappened");
    assertEquals(result.getResults().stream().findFirst().get().getStatusCode(), 503);
}

Example 5 with AwsConfusedDeputyException

use of com.sequenceiq.cloudbreak.cloud.aws.common.exception.AwsConfusedDeputyException in project cloudbreak by hortonworks.

the class AwsCredentialConnector method verifyIamRoleIsAssumable.

private CloudCredentialStatus verifyIamRoleIsAssumable(CloudCredential cloudCredential, CredentialVerificationContext credentialVerificationContext) {
    AwsCredentialView awsCredential = credentialViewProvider.createAwsCredentialView(cloudCredential);
    CloudCredentialStatus credentialStatus = new CloudCredentialStatus(cloudCredential, CredentialStatus.VERIFIED);
    try {
        credentialClient.retrieveSessionCredentials(awsCredential);
        checkRoleIsAssumableWithoutExternalId(credentialVerificationContext, awsCredential);
        credentialStatus = verifyCredentialsPermission(cloudCredential, awsCredential, credentialStatus);
        credentialStatus = determineDefaultRegion(cloudCredential, credentialStatus);
    } catch (AmazonClientException ae) {
        String errorMessage = getErrorMessageForAwsClientException(awsCredential, ae);
        LOGGER.warn(errorMessage, ae);
        credentialStatus = new CloudCredentialStatus(cloudCredential, CredentialStatus.FAILED, ae, errorMessage);
    } catch (AwsConfusedDeputyException confusedDeputyEx) {
        credentialStatus = new CloudCredentialStatus(cloudCredential, CredentialStatus.FAILED, confusedDeputyEx, confusedDeputyEx.getMessage());
    } catch (RuntimeException e) {
        String errorMessage = String.format("Unable to verify credential: check if the role '%s' exists and it's created with the correct external ID. " + "Cause: '%s'", awsCredential.getRoleArn(), e.getMessage());
        LOGGER.warn(errorMessage, e);
        credentialStatus = new CloudCredentialStatus(cloudCredential, CredentialStatus.FAILED, e, errorMessage);
    }
    return credentialStatus;
}