diff --git a/ecs-cli/modules/cli/regcreds/create_task_execution_role_test.go b/ecs-cli/modules/cli/regcreds/create_task_execution_role_test.go index 77ffdbf4f..175819dc6 100644 --- a/ecs-cli/modules/cli/regcreds/create_task_execution_role_test.go +++ b/ecs-cli/modules/cli/regcreds/create_task_execution_role_test.go @@ -182,3 +182,69 @@ func TestCreateTaskExecutionRole_ErrorOnCreatePolicyFails(t *testing.T) { _, err := createTaskExecutionRole(testParams, mocks.MockIAM, mocks.MockKMS) assert.Error(t, err, "Expected error when CreatePolicy fails") } + +func TestCreateTaskExecutionRoleWithTags(t *testing.T) { + testRegistry := "myreg.test.io" + testRegCredARN := "arn:aws:secret/some-test-arn" + testRegKMSKey := "arn:aws:kms:key/67yt-756yth" + + testCreds := map[string]regcredio.CredsOutputEntry{ + testRegistry: regcredio.BuildOutputEntry(testRegCredARN, testRegKMSKey, []string{"test"}), + } + + testRoleName := "myNginxProjectRole" + + testPolicyArn := aws.String("arn:aws:iam::policy/" + testRoleName + "-policy") + testRoleArn := aws.String("arn:aws:iam::role/" + testRoleName) + + testParams := executionRoleParams{ + CredEntries: testCreds, + RoleName: testRoleName, + Region: "us-west-2", + Tags: map[string]*string{ + "Hey": aws.String("Jude"), + "Come": aws.String("Together"), + "Hello": aws.String("Goodbye"), + "Abbey": aws.String("Road"), + }, + } + + expectedTags := []*iam.Tag{ + &iam.Tag{ + Key: aws.String("Hey"), + Value: aws.String("Jude"), + }, + &iam.Tag{ + Key: aws.String("Come"), + Value: aws.String("Together"), + }, + &iam.Tag{ + Key: aws.String("Hello"), + Value: aws.String("Goodbye"), + }, + &iam.Tag{ + Key: aws.String("Abbey"), + Value: aws.String("Road"), + }, + } + + mocks := setupTestController(t) + gomock.InOrder( + mocks.MockIAM.EXPECT().CreateOrFindRole(testRoleName, roleDescriptionString, assumeRolePolicyDocString, gomock.Any()).Do(func(w, x, y, z interface{}) { + tags := z.([]*iam.Tag) + assert.ElementsMatch(t, tags, expectedTags, "Expected Tags to match") + }).Return(*testRoleArn, nil), + mocks.MockIAM.EXPECT().CreateRole(gomock.Any()).Return(&iam.CreateRoleOutput{Role: &iam.Role{Arn: testRoleArn}}, nil), + ) + gomock.InOrder( + // If KMSKeyID present, first thing to happen should be verifying its ARN + mocks.MockKMS.EXPECT().GetValidKeyARN(testRegKMSKey).Return(testRegKMSKey, nil), + mocks.MockIAM.EXPECT().CreatePolicy(gomock.Any()).Return(&iam.CreatePolicyOutput{Policy: &iam.Policy{Arn: testPolicyArn}}, nil), + mocks.MockIAM.EXPECT().AttachRolePolicy(getExecutionRolePolicyARN("us-west-2"), testRoleName).Return(nil, nil), + mocks.MockIAM.EXPECT().AttachRolePolicy(*testPolicyArn, testRoleName).Return(nil, nil), + ) + + policyCreateTime, err := createTaskExecutionRole(testParams, mocks.MockIAM, mocks.MockKMS) + assert.NoError(t, err, "Unexpected error when creating task execution role") + assert.NotNil(t, policyCreateTime, "Expected policy create time to be non-nil") +}