Fix AWS Parity Audit Bugs: Event Delivery, Tagging, Describe NotFound & More (#319)

cloudemu_test.go

@@ -7097,13 +7097,10 @@ func TestVolumeLifecycleAWS(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	vols, err = p.EC2.DescribeVolumes(ctx, []string{vol.ID})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(vols) != 0 {
-		t.Errorf("expected 0 volumes after delete, got %d", len(vols))
+	// Describing the deleted volume by ID now yields NotFound (issue #319,
+	// theme C: InvalidVolume.NotFound), not an empty success.
+	if _, err = p.EC2.DescribeVolumes(ctx, []string{vol.ID}); err == nil {
+		t.Error("expected NotFound describing a deleted volume, got nil")
 	}
 }
 

providers/aws/aws.go

@@ -205,6 +205,12 @@ func New(opts ...config.Option) *Provider {
 	p.Redshift.SetMonitoring(p.CloudWatch)
 	p.EKS.SetMonitoring(p.CloudWatch)
 	p.SageMaker.SetMonitoring(p.CloudWatch)
+	// SNS -> SQS fan-out: publishes deliver to SQS-protocol subscriptions.
+	p.SNS.SetSQSDeliverer(p.SQS)
+	// EventBridge -> SQS: matched rules deliver events to SQS targets.
+	p.EventBridge.SetSQSDeliverer(p.SQS)
+	// S3 -> SQS: object-create events deliver to bucket notification targets.
+	p.S3.SetSQSDeliverer(p.SQS)
 
 	p.ResourceDiscovery = resourcediscovery.New(
 		resourcediscovery.ProviderAWS, o.AccountID, o.Region,

providers/aws/awsiam/iam.go

@@ -53,6 +53,7 @@ type roleData struct {
 	Path                string
 	AssumeRolePolicyDoc string
 	Tags                map[string]string
+	inlinePolicies      map[string]string // policyName -> policy document JSON
 }
 
 type policyData struct {

providers/aws/awsiam/rolepolicy.go

@@ -0,0 +1,87 @@
+package awsiam
+
+import (
+	"context"
+	"sort"
+
+	"github.com/stackshy/cloudemu/v2/errors"
+)
+
+// PutRolePolicy adds or replaces an inline policy on a role (IAM
+// PutRolePolicy). Inline policies are embedded in the role, distinct from the
+// managed policies attached via AttachRolePolicy.
+func (m *Mock) PutRolePolicy(_ context.Context, roleName, policyName, policyDocument string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	if rd.inlinePolicies == nil {
+		rd.inlinePolicies = make(map[string]string)
+	}
+
+	rd.inlinePolicies[policyName] = policyDocument
+
+	return nil
+}
+
+// GetRolePolicy returns an inline policy document by name (IAM GetRolePolicy).
+func (m *Mock) GetRolePolicy(_ context.Context, roleName, policyName string) (string, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return "", errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	doc, ok := rd.inlinePolicies[policyName]
+	if !ok {
+		return "", errors.Newf(errors.NotFound, "policy %q not found on role %q", policyName, roleName)
+	}
+
+	return doc, nil
+}
+
+// DeleteRolePolicy removes an inline policy from a role (IAM DeleteRolePolicy).
+func (m *Mock) DeleteRolePolicy(_ context.Context, roleName, policyName string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	if _, ok := rd.inlinePolicies[policyName]; !ok {
+		return errors.Newf(errors.NotFound, "policy %q not found on role %q", policyName, roleName)
+	}
+
+	delete(rd.inlinePolicies, policyName)
+
+	return nil
+}
+
+// ListRolePolicies returns the names of a role's inline policies, sorted (IAM
+// ListRolePolicies).
+func (m *Mock) ListRolePolicies(_ context.Context, roleName string) ([]string, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return nil, errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	names := make([]string, 0, len(rd.inlinePolicies))
+	for name := range rd.inlinePolicies {
+		names = append(names, name)
+	}
+
+	sort.Strings(names)
+
+	return names, nil
+}

providers/aws/awsiam/roletags.go

@@ -0,0 +1,63 @@
+package awsiam
+
+import (
+	"context"
+
+	"github.com/stackshy/cloudemu/v2/errors"
+)
+
+// TagRole adds or overwrites tags on a role (IAM TagRole).
+func (m *Mock) TagRole(_ context.Context, roleName string, tags map[string]string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	if rd.Tags == nil {
+		rd.Tags = make(map[string]string, len(tags))
+	}
+
+	for k, v := range tags {
+		rd.Tags[k] = v
+	}
+
+	return nil
+}
+
+// UntagRole removes tags by key from a role (IAM UntagRole).
+func (m *Mock) UntagRole(_ context.Context, roleName string, keys []string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	for _, k := range keys {
+		delete(rd.Tags, k)
+	}
+
+	return nil
+}
+
+// ListRoleTags returns a role's tags (IAM ListRoleTags).
+func (m *Mock) ListRoleTags(_ context.Context, roleName string) (map[string]string, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	rd, ok := m.roles.Get(roleName)
+	if !ok {
+		return nil, errors.Newf(errors.NotFound, "role %q not found", roleName)
+	}
+
+	out := make(map[string]string, len(rd.Tags))
+	for k, v := range rd.Tags {
+		out[k] = v
+	}
+
+	return out, nil
+}

providers/aws/cloudwatchlogs/cloudwatchlogs_test.go

@@ -815,3 +815,30 @@ func TestDescribeMetricFilters(t *testing.T) {
 		require.Error(t, err)
 	})
 }
+
+// TestLogGroupTagging is a regression guard for issue #319: CloudWatch Logs
+// TagResource/UntagResource/ListTagsForResource were unimplemented.
+func TestLogGroupTagging(t *testing.T) {
+	m := newTestMock()
+	ctx := context.Background()
+
+	_, err := m.CreateLogGroup(ctx, driver.LogGroupConfig{Name: "g"})
+	require.NoError(t, err)
+
+	require.NoError(t, m.TagLogGroup(ctx, "g", map[string]string{"env": "prod", "team": "ops"}))
+
+	tags, err := m.ListLogGroupTags(ctx, "g")
+	require.NoError(t, err)
+	assert.Equal(t, "prod", tags["env"])
+	assert.Equal(t, "ops", tags["team"])
+
+	require.NoError(t, m.UntagLogGroup(ctx, "g", []string{"env"}))
+
+	tags, err = m.ListLogGroupTags(ctx, "g")
+	require.NoError(t, err)
+	_, has := tags["env"]
+	assert.False(t, has)
+	assert.Equal(t, "ops", tags["team"])
+
+	assert.Error(t, m.TagLogGroup(ctx, "missing", map[string]string{"a": "b"}))
+}

providers/aws/cloudwatchlogs/tags.go

@@ -0,0 +1,55 @@
+package cloudwatchlogs
+
+import (
+	"context"
+
+	"github.com/stackshy/cloudemu/v2/errors"
+)
+
+// TagLogGroup adds or overwrites tags on a log group (CloudWatch Logs
+// TagResource / TagLogGroup).
+func (m *Mock) TagLogGroup(_ context.Context, name string, tags map[string]string) error {
+	g, ok := m.groups.Get(name)
+	if !ok {
+		return errors.Newf(errors.NotFound, "log group %q not found", name)
+	}
+
+	if g.info.Tags == nil {
+		g.info.Tags = make(map[string]string, len(tags))
+	}
+
+	for k, v := range tags {
+		g.info.Tags[k] = v
+	}
+
+	return nil
+}
+
+// UntagLogGroup removes tags by key from a log group.
+func (m *Mock) UntagLogGroup(_ context.Context, name string, keys []string) error {
+	g, ok := m.groups.Get(name)
+	if !ok {
+		return errors.Newf(errors.NotFound, "log group %q not found", name)
+	}
+
+	for _, k := range keys {
+		delete(g.info.Tags, k)
+	}
+
+	return nil
+}
+
+// ListLogGroupTags returns a log group's tags.
+func (m *Mock) ListLogGroupTags(_ context.Context, name string) (map[string]string, error) {
+	g, ok := m.groups.Get(name)
+	if !ok {
+		return nil, errors.Newf(errors.NotFound, "log group %q not found", name)
+	}
+
+	out := make(map[string]string, len(g.info.Tags))
+	for k, v := range g.info.Tags {
+		out[k] = v
+	}
+
+	return out, nil
+}

providers/aws/dynamodb/dynamodb.go

@@ -347,6 +347,12 @@ func (m *Mock) matchQueryItems(
 			}
 		}
 
+		// Apply the FilterExpression (post key-condition), matching real
+		// DynamoDB: Query filters the key-matched set the same way Scan does.
+		if !matchesFilters(item, input.Filters) {
+			continue
+		}
+
 		matched = append(matched, item)
 	}
 

providers/aws/ec2/ec2.go

@@ -404,7 +404,7 @@ func (m *Mock) describeCandidates(instanceIDs []string, hidden, includeManaged b
 	for _, id := range instanceIDs {
 		inst, ok := m.instances.Get(id)
 		if !ok {
-			continue
+			return nil, cerrors.Newf(cerrors.NotFound, "instance %q not found", id)
 		}
 
 		if hiddenManaged(inst, hidden, includeManaged) {
@@ -607,8 +607,16 @@ func (m *Mock) DeleteVolume(_ context.Context, id string) error {
 	return nil
 }
 
-// DescribeVolumes returns volumes matching the given IDs.
+// DescribeVolumes returns volumes matching the given IDs. An explicit ID that
+// does not exist yields InvalidVolume.NotFound, matching real EC2 (an empty
+// success would break existence checks and Terraform drift detection).
 func (m *Mock) DescribeVolumes(_ context.Context, ids []string) ([]driver.VolumeInfo, error) {
+	for _, id := range ids {
+		if !m.volumes.Has(id) {
+			return nil, cerrors.Newf(cerrors.NotFound, "volume %q not found", id)
+		}
+	}
+
 	return describeResources(m.volumes, ids), nil
 }
 

providers/aws/ec2/ec2_test.go

@@ -376,10 +376,10 @@ func TestDeleteVolume(t *testing.T) {
 		err = m.DeleteVolume(ctx, vol.ID)
 		requireNoError(t, err)
 
-		// Should be gone
-		vols, err := m.DescribeVolumes(ctx, []string{vol.ID})
-		requireNoError(t, err)
-		assertEqual(t, 0, len(vols))
+		// Should be gone: describing the deleted ID now yields NotFound,
+		// matching real EC2 (InvalidVolume.NotFound) rather than empty success.
+		_, err = m.DescribeVolumes(ctx, []string{vol.ID})
+		assertError(t, err, true)
 	})
 
 	t.Run("not found", func(t *testing.T) {