用 pytest 模拟秘密管理器答案

【问题标题】：Mock secret manager with pytest用 pytest 模拟秘密管理器
【发布时间】：2022-08-18 22:43:41
【问题描述】：

我在这里使用默认的 Lambda 函数在 AWS 代码中轮换我们的 Aurora 密码：https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas/blob/master/SecretsManagerRDSMariaDBRotationSingleUser/lambda_function.py

我必须在部署此代码之前对其进行测试，但是我不知道该怎么做。有人可以帮忙吗？我知道代码可能完全错误，但只需要一些指导。我想用 Pytest 测试以下功能。

def test_secret(service_client, arn, token):
    \"\"\"Args:
     service_client (client): The secrets manager service client
     arn (string): The secret ARN or other identifier
     token (string): The ClientRequestToken associated with the secret version
   Raises:
     ResourceNotFoundException: If the secret with the specified arn and stage does not exist
     ValueError: If the secret is not valid JSON or valid credentials are found to login to the database
     KeyError: If the secret json does not contain the expected keys
 \"\"\"
    # Try to login with the pending secret, if it succeeds, return
    conn = get_connection(get_secret_dict(service_client, arn, \"AWSPENDING\", token))
    if conn:
        # This is where the lambda will validate the user\'s permissions. Uncomment/modify the below lines to
        # tailor these validations to your needs
        try:
            with conn.cursor() as cur:
                cur.execute(\"SELECT NOW()\")
                conn.commit()
        finally:
            conn.close()

        logger.info(\"testSecret: Successfully signed into MariaDB DB with AWSPENDING secret in %s.\" % arn)
        return
    else:
        logger.error(\"testSecret: Unable to log into database with pending secret of secret ARN %s\" % arn)
        raise ValueError(\"Unable to log into database with pending secret of secret ARN %s\" % arn)

import lambda_function.py as testpass
import boto3
import moto import mock_secretsmanager
#Not sure where to get these values from to mock\"
token = \"akd93939-383838-999388\"
arn = \"secret-arn\"
token = \"9393939302931883487\"

@mock_secretsmanager
def test_testsecret(mock_secret_manager):
    conn = boto3.client(\"secretsmanager\", region_name=\"us-east-1\")

    test = testpass.test_secret(\"secretsmanager\", arn, token)
    assert test

请编辑问题以将其限制为具有足够详细信息的特定问题，以确定适当的答案。

标签： python mocking pytest aws-secrets-manager

【解决方案1】：

您可以使用模拟功能模拟嵌套函数。我将函数从 test_secret 重命名为 secret_test，因为 pytest 对该名称不满意：

import uuid
from unittest.mock import patch, call, MagicMock

import boto3
import pytest
from moto import mock_secretsmanager

from lambda_function import secret_test

class TestSecret:
    TEST_SECRET_DICT = {'engine': 'mariadb', 'username': 'user123', 'password': 'test_pass', 'host': 'localhost'}
    TEST_ARN = "secret-arn"

    @pytest.fixture
    def mock_get_secret_dict(self):
        with patch('lambda_function.get_secret_dict') as mock:
            mock.return_value = self.TEST_SECRET_DICT
            yield mock

    @pytest.fixture
    def mock_get_connection(self):
        with patch('lambda_function.get_connection') as mock:
            yield mock

    @mock_secretsmanager
    def test_secret_test(self, mock_get_secret_dict, mock_get_connection):
        mock_cursor = MagicMock()
        mock_get_connection.return_value.cursor.return_value.__enter__.return_value = mock_cursor

        request_token = str(uuid.uuid4())

        sm_client = boto3.client("secretsmanager", region_name="us-east-1")

        result = secret_test(sm_client, self.TEST_ARN, request_token)

        assert result is None
        assert mock_get_secret_dict.call_args == call(
            sm_client, self.TEST_ARN, 'AWSPENDING', request_token
        )
        assert mock_get_connection.call_args == call(self.TEST_SECRET_DICT)
        assert mock_get_connection.return_value.method_calls == [
            call.cursor(),
            call.commit(),
            call.close()
        ]
        assert mock_cursor.method_calls == [call.execute('SELECT NOW()')]

【讨论】：