1import * as AWS from "@/AWS";
2import { AccessKey, LoginProfile, User } from "@/AWS/IAM";
3import * as Test from "@/Test/Alchemy";
4import * as IAM from "@distilled.cloud/aws/iam";
5import { describe, expect } from "alchemy-test";
6import * as Effect from "effect/Effect";
7
8const { test } = Test.make({ providers: AWS.providers() });
9
10describe(
11 "AWS.IAM sensitive resources",
12 { tags: ["provider:aws", "provider:aws:iam", "live"] },
13 () => {
14 test.provider(
15 "create, update, and delete access key plus login profile",
16 (stack) =>
17 Effect.gen(function* () {
18 yield* stack.destroy();
19
20 const resources = yield* stack.deploy(
21 Effect.gen(function* () {
22 const user = yield* User("CredentialUser", {});
23 const accessKey = yield* AccessKey("AccessKey", {
24 userName: user.userName,
25 status: "Active",
26 });
27 const loginProfile = yield* LoginProfile("LoginProfile", {
28 userName: user.userName,
29 password: "TempPassword123!",
30 passwordResetRequired: true,
31 });
32 return { user, accessKey, loginProfile };
33 }),
34 );
35
36 expect(resources.accessKey.secretAccessKey).toBeDefined();
37
38 yield* stack.deploy(
39 Effect.gen(function* () {
40 const user = yield* User("CredentialUser", {});
41 yield* AccessKey("AccessKey", {
42 userName: user.userName,
43 status: "Inactive",
44 });
45 yield* LoginProfile("LoginProfile", {
46 userName: user.userName,
47 password: "UpdatedPassword123!",
48 passwordResetRequired: false,
49 });
50 }),
51 );
52
53 const accessKeys = yield* IAM.listAccessKeys({
54 UserName: resources.user.userName,
55 });
56 expect(accessKeys.AccessKeyMetadata[0]?.Status).toBe("Inactive");
57
58 const loginProfile = yield* IAM.getLoginProfile({
59 UserName: resources.user.userName,
60 });
61 expect(loginProfile.LoginProfile.PasswordResetRequired).toBe(false);
62
63 yield* stack.destroy();
64
65 // The user (and with it the access key + login profile) is gone.
66 const deletedUser = yield* IAM.getUser({
67 UserName: resources.user.userName,
68 }).pipe(Effect.option);
69 expect(deletedUser._tag).toBe("None");
70 }),
71 );
72 },
73);