Mock测试【免费下载链接】motoA library that allows you to easily mock out tests based on AWS infrastructure.项目地址https://gitcode.com/gh_mirrors/mo/moto点击查看免费下载本篇指南聚焦 moto 开源项目对 AWS IAM Identity Center原 AWS SSOsso-admin服务的本地模拟实现。你将了解 moto 已实现/未实现的sso-adminAPI 全景、底层数据模型与分页机制并通过可直接运行的 boto3 代码示例掌握 Permission Set 生命周期管理、策略挂载与账户分配Account Assignment的核心用法从而在 CI 与本地测试中脱离真实 AWS 环境完成 SSO 相关逻辑的验证。moto 中的 sso-admin 服务能力边界总览sso-admin是 AWS IAM Identity Center 的 API 前缀botocore 中对应sso-adminclient用于管理 Permission Set、账户分配与 SSO 实例。moto 在 moto/ssoadmin/ 目录下提供了完整的模拟实现包含四层结构models.py核心数据模型与SSOAdminBackend后端逻辑responses.pyHTTP 请求到后端方法的转发层SSOAdminResponseurls.pyURL 路由注册匹配https?://sso.(.).amazonaws.comutils.py分页模型配置PAGINATION_MODEL。底层注册通过 moto/ssoadmin/init.py 导出ssoadmin_backends并由BackendDict(SSOAdminBackend, sso-admin)models.py按账户与区域隔离后端实例。已实现功能清单根据 docs/docs/services/sso-admin.rst 的勾选状态以下 API 已在 moto 中实现标记[X]分组已实现 APIPermission Set 生命周期create_permission_set、describe_permission_set、update_permission_set、delete_permission_set、list_permission_sets内联策略put_inline_policy_to_permission_set、get_inline_policy_for_permission_set、delete_inline_policy_from_permission_setAWS 托管策略attach_managed_policy_to_permission_set、detach_managed_policy_from_permission_set、list_managed_policies_in_permission_set客户托管策略attach_customer_managed_policy_reference_to_permission_set、detach_customer_managed_policy_reference_from_permission_set、list_customer_managed_policy_references_in_permission_set账户分配create_account_assignment、delete_account_assignment、list_account_assignments、list_account_assignments_for_principal、describe_account_assignment_creation_status、describe_account_assignment_deletion_status实例管理list_instances、update_instance预配Provisioningprovision_permission_set、list_permission_sets_provisioned_to_account、list_accounts_for_provisioned_permission_set注意原文档中list_account_assignments下方标注“MaxResults, NextToken, ProvisioningStatus尚未实现”但从当前源码看该方法已接入统一分页框架models.py 的paginate(PAGINATION_MODEL)与 utils.py 中的list_account_assignments分页条目文档标注存在滞后。ProvisioningStatus参数则确实未被解析。未实现功能清单以下 API 在 moto 中尚未实现标记[ ]add_region、remove_region、create_application、create_application_assignment、create_instance、create_instance_access_control_attribute_configuration、create_trusted_token_issuer、delete_application、delete_application_access_scope、delete_application_assignment、delete_application_authentication_method、delete_application_grant、delete_instance、delete_instance_access_control_attribute_configuration、delete_permissions_boundary_from_permission_set、delete_trusted_token_issuer、describe_application、describe_application_assignment、describe_application_provider、describe_instance、describe_instance_access_control_attribute_configuration、describe_permission_set_provisioning_status、describe_region、describe_trusted_token_issuer、get_application_access_scope、get_application_assignment_configuration、get_application_authentication_method、get_application_grant、get_application_session_configuration、get_permissions_boundary_for_permission_set、list_account_assignment_creation_status、list_account_assignment_deletion_status、list_application_access_scopes、list_application_assignments、list_application_assignments_for_principal、list_application_authentication_methods、list_application_grants、list_application_providers、list_applications、list_permission_set_provisioning_status、list_regions、list_tags_for_resource、list_trusted_token_issuers、put_application_access_scope、put_application_assignment_configuration、put_application_authentication_method、put_application_grant、put_application_session_configuration、put_permissions_boundary_to_permission_set、tag_resource、untag_resource、update_application、update_instance_access_control_attribute_configuration、update_trusted_token_issuer。可以看到Application 相关的 API 族应用、应用分配、授权等以及 Tag、Permissions Boundary、Trusted Token Issuer 相关能力尚未覆盖这类调用会命中 moto 的“未实现 API”错误路径。底层数据模型四个核心类models.py 中定义了模拟 SSO 所需的全部实体理解它们有助于预判 API 行为PermissionSetmodels.py持有name、description、session_duration、relay_state、tags以及inline_policy字符串、managed_policiesAWS 托管策略列表、customer_managed_policies客户托管策略列表和total_managed_policies_attached计数器。其 ARN 由instance_arn /ps- 16位随机小写字符串生成。AccountAssignmentmodels.py记录instance_arn、target_id、target_type、permission_set_arn、principal_type、principal_id与created_date创建时生成 UUID 作为request_id用于后续状态查询。Instancemodels.py模拟 SSO 实例生成形如arn:{partition}:sso:::instance/ssoins-{16位随机}的 ARN、d-{10位随机}的 Identity Store ID状态恒为ACTIVE并保存provisioned_permission_sets列表。ManagedPolicy/CustomerManagedPolicymodels.py前者以arn判等后者以path name组合判等。关键行为每个账户/区域的SSOAdminBackend初始化时会自动创建一个Instancemodels.py因此无需手动创建实例即可直接调用list_instances拿到默认实例 ARN。Permission Set 生命周期实战创建与查询在mock_aws装饰的测试中用 boto3sso-adminclient 操作即可import boto3 from moto import mock_aws mock_aws def test_permission_set_lifecycle(): client boto3.client(sso-admin, region_nameus-east-1) # moto 会自动创建一个 SSO 实例直接取用 instance_arn client.list_instances()[Instances][0][InstanceArn] resp client.create_permission_set( InstanceArninstance_arn, Namereadonly-s3, DescriptionRead only access to S3, SessionDurationPT8H, RelayStatehttps://console.aws.amazon.com/, ) ps_arn resp[PermissionSet][PermissionSetArn] # 查询详情 detail client.describe_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn )[PermissionSet] assert detail[Name] readonly-s3SessionDuration未显式传入时默认值为3600见 responses.py 与 responses.py。更新与删除update_permission_set仅允许更新description、session_duration、relay_statemodels.py。delete_permission_set会把 Permission Set 从实例的provisioned_permission_sets中一并移除models.pyclient.update_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn, DescriptionUpdated description, SessionDurationPT12H, ) client.delete_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn ) # 此时 list_permission_sets 返回空列表分页与列表list_permission_sets支持MaxResults/NextToken分页默认每页 100 条utils.py返回的是 Permission Set 的 ARN 列表responses.py。策略管理内联策略与托管策略内联策略put_inline_policy_to_permission_set接收 JSON 字符串形式的 IAM 策略moto 不校验其内容合法性仅做存储与覆盖models.pyimport json policy_doc { Version: 2012-10-17, Statement: [{ Effect: Allow, Action: s3:GetObject, Resource: arn:aws:s3:::your-bucket-name/*, }], } client.put_inline_policy_to_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn, InlinePolicyjson.dumps(policy_doc), ) assert client.get_inline_policy_for_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn )[InlinePolicy] json.dumps(policy_doc) client.delete_inline_policy_from_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn ) # 删除后 get_inline_policy_for_permission_set 返回 AWS 托管策略attach_managed_policy_to_permission_set会校验策略是否真实存在后端惰性加载 moto/iam/aws_managed_policies.py 中的托管策略数据用arn:{partition}:iam::aws:policy{path}{name}反推并比对 ARNmodels.py。传入不存在的策略会抛ResourceNotFoundExceptionPolicy does not exist with ARN: ...。同时 moto 复刻了 AWS 的配额限制每个 Permission Set 最多挂载 20 个托管策略含客户托管策略常量MAX_MANAGED_POLICIES_PER_PERMISSION_SET 20定义于 models.py超限抛ServiceQuotaExceededException重复挂载同一策略抛ConflictException。完整行为可参考 tests/test_ssoadmin/test_ssoadmin_policies.py 中的配额与冲突用例。客户托管策略引用客户托管策略用{Name: ..., Path: ...}引用Path缺省为/models.py。同一path name重复挂载抛ConflictException同样计入 20 条配额。list_customer_managed_policy_references_in_permission_set也支持MaxResults/NextToken分页utils.py。账户分配Account Assignment实战create_account_assignment将某个主体USER或GROUP授予某个目标账户TargetTypeAWS_ACCOUNT上某 Permission Set 的访问权限import uuid principal_id str(uuid.uuid4()) target_id 222222222222 # 目标 AWS 账户 ID status client.create_account_assignment( InstanceArninstance_arn, TargetIdtarget_id, TargetTypeAWS_ACCOUNT, PermissionSetArnps_arn, PrincipalTypeUSER, PrincipalIdprincipal_id, )[AccountAssignmentCreationStatus] assert status[Status] SUCCEEDED assert status[RequestId] # 用于 describe_*_status 查询moto 中该操作是同步完成的响应固定携带Status: SUCCEEDEDresponses.pyRequestId为随机 UUID可通过describe_account_assignment_creation_status/describe_account_assignment_deletion_status按 RequestId 回查models.py。查询与删除list_account_assignments按InstanceArn AccountId PermissionSetArn过滤models.py支持分页list_account_assignments_for_principal按PrincipalId PrincipalType过滤Filter中可带AccountIdmodels.pydelete_account_assignment需提供与创建时完全一致的六元组InstanceArn、TargetId、TargetType、PermissionSetArn、PrincipalType、PrincipalId删除成功后原记录移入deleted_account_assignments供状态查询使用models.py。这些用例与断言细节可参见 tests/test_ssoadmin/test_ssoadmin.py 的test_create_account_assignment、test_delete_account_assignment等。Permission Set 预配Provisioningprovision_permission_set模拟把 Permission Set 部署到目标账户的流程。需要注意实现边界原文档明确标注TargetType/TargetId参数当前被忽略Permission Set 只会被预配到调用者自己的账户models.py响应中的AccountId即当前账户responses.pystatus client.provision_permission_set( InstanceArninstance_arn, PermissionSetArnps_arn, TargetTypeAWS_ACCOUNT, # 参数被忽略固定预配到调用者账户 )[PermissionSetProvisioningStatus] assert status[Status] SUCCEEDED assert status[AccountId] 123456789012 # moto 默认账户 ID预配之后list_permission_sets_provisioned_to_account返回已预配的 Permission Set ARNmodels.py文档标注AccountId、ProvisioningStatus、MaxResults、NextToken参数未实现list_accounts_for_provisioned_permission_set返回承载该 Permission Set 的账户 ID 列表models.pyMaxResults、NextToken、ProvisioningStatus同样未实现。上述预配流程的完整断言见 tests/test_ssoadmin/test_ssoadmin_permission_sets.py预配前列表为空预配后两个列表分别返回[ps_arn]与[DEFAULT_ACCOUNT_ID]。实例管理自动创建的默认实例SSOAdminBackend初始化时会自动创建一个Instancemodels.py因此 mock 环境下list_instances永远至少返回一个实例。update_instance支持修改实例的Namemodels.py。create_instance等 API 未实现意味着你无法通过 SDK 创建更多实例只能使用自动生成的默认实例。实例相关用例见 tests/test_ssoadmin/test_ssoadmin_instances.py。异常行为约定sso-admin的模拟实现定义了三种异常均继承自JsonRESTErrorexceptions.py异常类型触发场景ResourceNotFoundException引用了不存在的 Permission Set、托管策略或账户分配ConflictException重复挂载同一策略AWS 托管或客户托管ServiceQuotaExceededException单 Permission Set 挂载策略数超过 20 条配额boto3 调用方会以ClientError形式收到这些异常Error.Code即上述类型名便于在测试中pytest.raises(ClientError)断言。典型使用场景小结在本地或 CI 中模拟 AWS SSO Admin 时推荐按如下顺序串联核心流程list_instances取默认实例 →create_permission_set→put_inline_policy_to_permission_set/attach_managed_policy_to_permission_set配置权限 →create_account_assignment授权主体 →provision_permission_set预配 → 用各类list_*接口断言状态。所有资源均按(account_id, region)隔离在后端实例中测试之间互不干扰。若你使用的 API 属于上文“未实现功能清单”则应调整测试设计改用已实现接口或对真实 AWS 行为做显式降级处理。赞分享Mock测试【免费下载链接】motoA library that allows you to easily mock out tests based on AWS infrastructure.项目地址https://gitcode.com/gh_mirrors/mo/moto点击查看免费下载相关推荐moto 中的 AWS Cloud Mapservicediscovery服务模拟实现完全指南moto 中的 AWS Cloud Mapservicediscovery服务模拟实现完全指南 本指南以 moto 仓库中 servicediscoveryMock测试kOps 中的 AWS SSO OIDC 客户端aws-sdk-go-v2/service/ssooidc 模块能力演进全解析kOps 中的 AWS SSO OIDC 客户端 aws sdk go v2/service/ssooidc 模块能力演进全解析 导读 本文聚焦 kOps 仓云原生集群管理运维IaCArgoCD用户管理全解析从本地账户到SSO集成ArgoCD用户管理全解析从本地账户到SSO集成 概述 ArgoCD作为一款流行的GitOps持续交付工具其用户管理系统是保障集群安全的重要环节。本文将全面云原生CI/CD容器编排DevOps后端上一篇SilentPatch让经典GTA游戏在现代PC上重获新生的终极音频修复方案下一篇Yaak API客户端插件依赖冲突如何快速解决npm包版本兼容性问题创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
