Fix/scp s3 read (#504)

* correctly read SCP content from S3

* chore: preparing for release

Co-authored-by: Rob Brazier <RobBrazier@users.noreply.github.com>

pyproject.toml

@@ -3,7 +3,7 @@
 
 [tool.poetry]
 name = "aws-service-catalog-puppet"
-version = "0.165.0"
+version = "0.166.0"
 description = "Making it easier to deploy ServiceCatalog products"
 classifiers = ["Development Status :: 5 - Production/Stable", "Intended Audience :: Developers", "Programming Language :: Python :: 3", "License :: OSI Approved :: Apache Software License", "Operating System :: OS Independent", "Natural Language :: English"]
 homepage = "https://service-catalog-tools-workshop.com/"

servicecatalog_puppet/workflow/service_control_policies/get_or_create_policy_task.py

@@ -34,19 +34,29 @@ def api_calls_used(self):
             )
         return calls
 
+    def get_unwrapped_policy(self):
+        if self.policy_content.get("default") is not None:
+            unwrapped = tasks.unwrap(self.policy_content.get("default"))
+        elif self.policy_content.get("s3") is not None:
+            with self.hub_client("s3") as s3:
+                bucket = self.policy_content.get("s3").get("bucket")
+                key = self.policy_content.get("s3").get("key")
+                raw_data = (
+                    s3.get_object(Bucket=bucket, Key=key)
+                    .get("Body")
+                    .read()
+                    .decode("utf-8")
+                )
+                unwrapped = json.loads(raw_data)
+        else:
+            raise Exception("Not supported policy content structure")
+        return unwrapped
+
     def run(self):
         with self.organizations_policy_client() as orgs:
-            if self.policy_content.get("default") is not None:
-                unwrapped = tasks.unwrap(self.policy_content.get("default"))
-            elif self.policy_content.get("s3") is not None:
-                with self.hub_client("s3") as s3:
-                    bucket = self.policy_content.get("s3").get("bucket")
-                    key = self.policy_content.get("s3").get("key")
-                    unwrapped = s3.get_object(Bucket=bucket, Key=key).read()
-            else:
-                raise Exception("Not supported policy content structure")
-
+            unwrapped = self.get_unwrapped_policy()
             content = json.dumps(unwrapped, indent=0, default=str)
+
             tags = [dict(Key="ServiceCatalogPuppet:Actor", Value="generated")]
             for tag in self.tags:
                 tags.append(dict(Key=tag.get("Key"), Value=tag.get("Value")))

servicecatalog_puppet/workflow/service_control_policies/get_or_create_policy_task_test.py

@@ -0,0 +1,81 @@
+#  Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#  SPDX-License-Identifier: Apache-2.0
+
+import io
+import json
+from botocore.response import StreamingBody
+
+from servicecatalog_puppet.workflow import tasks_unit_tests_helper
+
+
+class GetOrCreatePolicyTaskTest(tasks_unit_tests_helper.PuppetTaskUnitTest):
+    service_control_policy_name = "service_control_policy_name"
+    puppet_account_id = "puppet_account_id"
+    manifest_file_path = "manifest_file_path"
+
+    def setUp(self) -> None:
+        from servicecatalog_puppet.workflow.service_control_policies import (
+            get_or_create_policy_task,
+        )
+
+        self.module = get_or_create_policy_task
+
+        self.policy = {
+            "Version": "2012-10-17",
+            "Statement": [
+                {
+                    "Effect": "Deny",
+                    "Action": ["organizations:LeaveOrganization"],
+                    "Resource": "*",
+                }
+            ],
+        }
+
+        self.sut = self.module.GetOrCreatePolicyTask(
+            puppet_account_id=self.puppet_account_id,
+            region="us-east-1",
+            policy_name="my_policy",
+            policy_description="my description",
+            policy_content=dict(default=self.policy),
+            tags=[],
+        )
+
+        self.wire_up_mocks()
+
+    def test_get_policy_content_inline(self):
+        # setup
+        expected_result = self.policy
+
+        # exercise
+        actual_result = self.sut.get_unwrapped_policy()
+
+        # verify
+        self.assertEqual(expected_result, actual_result)
+
+    def test_get_policy_content_s3(self):
+        # setup
+        expected_result = self.policy
+        self.sut.policy_content = dict(s3=dict(bucket="my_bucket", key="my_key"))
+
+        encoded_policy = json.dumps(self.policy).encode("utf-8")
+        self.hub_client_mock.get_object.return_value = {
+            "Body": StreamingBody(io.BytesIO(encoded_policy), len(encoded_policy))
+        }
+
+        # exercise
+        actual_result = self.sut.get_unwrapped_policy()
+
+        # verify
+        self.assertEqual(expected_result, actual_result)
+
+    def test_get_policy_content_unsupported(self):
+        # setup
+        expected_result = self.policy
+        self.sut.policy_content = dict(invalid=None)
+
+        # exercise
+        with self.assertRaises(Exception) as ex:
+            self.sut.get_unwrapped_policy()
+
+        # verify
+        self.assertTrue("Not supported policy content structure" in str(ex.exception))

setup.py

@@ -60,7 +60,7 @@
 
 setup_kwargs = {
     'name': 'aws-service-catalog-puppet',
-    'version': '0.165.0',
+    'version': '0.166.0',
     'description': 'Making it easier to deploy ServiceCatalog products',
     'long_description': '# aws-service-catalog-puppet\n\n![logo](./docs/logo.png) \n\n## Badges\n\n[![codecov](https://codecov.io/gh/awslabs/aws-service-catalog-puppet/branch/master/graph/badge.svg?token=e8M7mdsmy0)](https://codecov.io/gh/awslabs/aws-service-catalog-puppet)\n\n\n## What is it?\nThis is a python3 framework that makes it easier to share multi region AWS Service Catalog portfolios and makes it \npossible to provision products into accounts declaratively using a metadata based rules engine.\n\nWith this framework you define your accounts in a YAML file.  You give each account a set of tags, a default region and \na set of enabled regions.\n\nOnce you have done this you can define portfolios should be shared with each set of accounts using the tags and you \ncan specify which regions the shares occur in.\n\nIn addition to this, you can also define products that should be provisioned into accounts using the same tag based \napproach.  The framework will assume role into the target account and provision the product on your behalf.\n\n\n## Getting started\n\nYou can read the [installation how to](https://service-catalog-tools-workshop.com/30-how-tos/10-installation/30-service-catalog-puppet.html)\nor you can read through the [every day use](https://service-catalog-tools-workshop.com/30-how-tos/50-every-day-use.html)\nguides.\n\nYou can read the [documentation](https://aws-service-catalog-puppet.readthedocs.io/en/latest/) to understand the inner \nworkings. \n\n\n## Going further\n\nThe framework is one of a pair.  The other is [aws-service-catalog-factory](https://github.com/awslabs/aws-service-catalog-factory).\nWith Service Catalog Factory you can create pipelines that deploy multi region portfolios very easily. \n\n## License\n\nThis library is licensed under the Apache 2.0 License. \n \n',
     'author': 'Eamonn Faherty',