Fix issue 466: Add mock to rule test

rules/aws_cloudtrail_rules/aws_security_configuration_change.py

@@ -1,4 +1,6 @@
+import json
 from fnmatch import fnmatch
+from unittest.mock import MagicMock
 
 from panther_base_helpers import aws_rule_context, deep_get
 from panther_default import aws_cloudtrail_success
@@ -18,11 +20,15 @@
 
 ALLOW_LIST = [
     # Add expected events and users here to suppress alerts
-    {"userName": "ExampleUser", "eventName": "ExampleEvent"},
+    # {"userName": "ExampleUser", "eventName": "DeleteRule"},
 ]
 
 
 def rule(event):
+    global ALLOW_LIST  # pylint: disable=global-statement
+    if isinstance(ALLOW_LIST, MagicMock):
+        ALLOW_LIST = json.loads(ALLOW_LIST())  # pylint: disable=not-callable
+
     if not aws_cloudtrail_success(event):
         return False
 

rules/aws_cloudtrail_rules/aws_security_configuration_change.yml

@@ -206,11 +206,16 @@ Tests:
       }
   - Name: Security Configuration Changed - Allowlisted User
     ExpectedResult: false
+    Mocks:
+      - {
+          "objectName": "ALLOW_LIST",
+          "returnValue": '[{"userName": "ExampleUser", "eventName": "DeleteRule"}]',
+        }
     Log:
       {
         "awsRegion": "us-west-2",
         "eventID": "1111",
-        "eventName": "ExampleEvent",
+        "eventName": "DeleteRule",
         "eventSource": "cloudtrail.amazonaws.com",
         "eventTime": "2019-01-01T00:00:00Z",
         "eventType": "AwsApiCall",