Tests for the new data-migration structure

uktrade · Jan 27, 2025 · 96a15e5 · 96a15e5
1 parent 9e6bd3c
commit 96a15e5
Show file tree

Hide file tree

Showing 3 changed files with 140 additions and 10 deletions.
diff --git a/data-migration/outputs.tf b/data-migration/outputs.tf
@@ -2,3 +2,7 @@
 output "module_exists" {
   value = true
 }
+
+output "sources" {
+  value = var.sources
+}
diff --git a/data-migration/tests/unit.tftest.hcl b/data-migration/tests/unit.tftest.hcl
@@ -1,11 +1,17 @@
 mock_provider "aws" {}
 
 variables {
-  config = {
-    "source_bucket_arn"  = "test-source-bucket-arn"
-    "source_kms_key_arn" = "test-source-kms-key-arn"
-    "worker_role_arn"    = "test-role-arn"
-  }
+  sources = [
+    {
+      "source_bucket_arn"  = "test-source-bucket-arn"
+      "source_kms_key_arn" = "test-source-kms-key-arn"
+      "worker_role_arn"    = "test-role-arn"
+    },
+    {
+      "source_bucket_arn" = "test-source-bucket-arn-2"
+      "worker_role_arn"   = "test-role-arn-2"
+    }
+  ]
   destination_bucket_arn        = "test-destination-bucket-arn"
   destination_bucket_identifier = "test-destination-bucket-name"
 }
@@ -63,16 +69,61 @@ run "data_migration_unit_test" {
     condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[3].actions, "kms:Decrypt")
     error_message = "Statement should contain kms:Decrypt"
   }
+  # source buckets
+  assert {
+    condition     = length(data.aws_iam_policy_document.s3_migration_policy_document.statement[0].resources) == 4
+    error_message = "Should have 4 elements"
+  }
+  assert {
+    condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[0].resources, "test-source-bucket-arn")
+    error_message = "Should contain: test-source-bucket-arn"
+  }
+  assert {
+    condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[0].resources, "test-source-bucket-arn/*")
+    error_message = "Should contain: test-source-bucket-arn/*"
+  }
+  assert {
+    condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[0].resources, "test-source-bucket-arn-2")
+    error_message = "Should contain: test-source-bucket-arn-2"
+  }
+  assert {
+    condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[0].resources, "test-source-bucket-arn-2/*")
+    error_message = "Should contain: test-source-bucket-arn-2/*"
+  }
+  # worker arns
+  assert {
+    condition     = length(tolist(data.aws_iam_policy_document.allow_assume_role.statement[0].principals)[0].identifiers) == 2
+    error_message = "Should have 2 elements"
+  }
+  assert {
+    condition     = contains(tolist(data.aws_iam_policy_document.allow_assume_role.statement[0].principals)[0].identifiers, "test-role-arn")
+    error_message = "Should contain: test-role-arn"
+  }
+  assert {
+    condition     = contains(tolist(data.aws_iam_policy_document.allow_assume_role.statement[0].principals)[0].identifiers, "test-role-arn-2")
+    error_message = "Should contain: test-role-arn-2"
+  }
+  # kms keys
+  assert {
+    condition     = length(data.aws_iam_policy_document.s3_migration_policy_document.statement[3].resources) == 1
+    error_message = "Should have 1 elements"
+  }
+  assert {
+    condition     = contains(data.aws_iam_policy_document.s3_migration_policy_document.statement[3].resources, "test-source-kms-key-arn")
+    error_message = "Should contain: test-source-kms-key-arn"
+  }
 }
 
 run "data_migration_without_source_kms_key" {
   command = plan
 
   variables {
-    config = {
-      "source_bucket_arn" = "test-source-bucket-arn"
-      "worker_role_arn"   = "test-role-arn"
-    }
+    sources = [
+      {
+        "source_bucket_arn" = "test-source-bucket-arn"
+        "worker_role_arn"   = "test-role-arn"
+      }
+    ]
     destination_bucket_arn        = "test-destination-bucket-arn"
     destination_bucket_identifier = "test-destination-bucket-name"
   }

diff --git a/s3/tests/unit.tftest.hcl b/s3/tests/unit.tftest.hcl
@@ -215,7 +215,7 @@ run "aws_s3_bucket_lifecycle_configuration_no_prefix_unit_test" {
   }
 }
 
-run "aws_s3_bucket_data_migration_unit_test" {
+run "aws_s3_bucket_data_migration_legacy_config_unit_test" {
   command = plan
 
   variables {
@@ -236,6 +236,81 @@ run "aws_s3_bucket_data_migration_unit_test" {
     condition     = module.data_migration[0].module_exists
     error_message = "data migration module should be created"
   }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].worker_role_arn == "arn:aws:iam::1234:role/service-role/my-privileged-arn"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].source_kms_key_arn == "arn:aws:iam::1234:my-external-kms-key-arn"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].source_bucket_arn == "arn:aws:s3::1234:my-source-bucket"
+    error_message = "data migration worker_role_arn should be present"
+  }
+}
+
+run "aws_s3_bucket_data_migration_unit_test" {
+  command = plan
+
+  variables {
+    config = {
+      "bucket_name" = "dbt-terraform-test-s3-cross-account",
+      "type"        = "s3",
+      "data_migration" = {
+        "import_sources" = [
+          {
+            "worker_role_arn"    = "arn:aws:iam::1234:role/service-role/my-privileged-arn",
+            "source_kms_key_arn" = "arn:aws:iam::1234:my-external-kms-key-arn",
+            "source_bucket_arn"  = "arn:aws:s3::1234:my-source-bucket"
+          },
+          {
+            "worker_role_arn"    = "arn:aws:iam::1234:role/service-role/my-privileged-arn-2",
+            "source_kms_key_arn" = "arn:aws:iam::1234:my-external-kms-key-arn-2",
+            "source_bucket_arn"  = "arn:aws:s3::1234:my-source-bucket-2"
+          },
+        ]
+      }
+    }
+  }
+
+  assert {
+    condition     = module.data_migration[0].module_exists
+    error_message = "data migration module should be created"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].worker_role_arn == "arn:aws:iam::1234:role/service-role/my-privileged-arn"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].source_kms_key_arn == "arn:aws:iam::1234:my-external-kms-key-arn"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[0].source_bucket_arn == "arn:aws:s3::1234:my-source-bucket"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[1].worker_role_arn == "arn:aws:iam::1234:role/service-role/my-privileged-arn-2"
+    error_message = "data migration worker_role_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[1].source_kms_key_arn == "arn:aws:iam::1234:my-external-kms-key-arn-2"
+    error_message = "data migration source_kms_key_arn should be present"
+  }
+
+  assert {
+    condition     = module.data_migration[0].sources[1].source_bucket_arn == "arn:aws:s3::1234:my-source-bucket-2"
+    error_message = "data migration source_bucket_arn should be present"
+  }
 }
 
 run "aws_s3_bucket_not_data_migration_unit_test" {