(integ-tests-alpha): Account ID not redacted in integration test

[jdukewich]

Describe the bug

In snapshots from integration tests, you will notice that any account IDs get redacted and replaced with ${AWS::AccountId}. However, if you try to write an integration test that creates a security group, it will not remove the account ID from the *.assets.json or manifest.json files.

Expected Behavior

I expected my AWS Account ID to be replaced by ${AWS::AccountId} in the generated snapshot files.

Current Behavior

My AWS Account ID is not replaced by ${AWS::AccountId} in the generated snapshot files.

Reproduction Steps

1. Create a new integration test packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group.ts
2. Make sure your AWS credentials are configured
3. Copy the following code into the test file

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

import { EC2_RESTRICT_DEFAULT_SECURITY_GROUP } from 'aws-cdk-lib/cx-api';
import { IntegTest } from '@aws-cdk/integ-tests-alpha';

const app = new cdk.App();

const env = {
  account: process.env.CDK_INTEG_ACCOUNT || process.env.CDK_DEFAULT_ACCOUNT,
  region: process.env.CDK_INTEG_REGION || process.env.CDK_DEFAULT_REGION,
};

class SgLookupStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    this.node.setContext(EC2_RESTRICT_DEFAULT_SECURITY_GROUP, false);

    const testVpc = new ec2.Vpc(this, 'MyVpc', {
      vpcName: 'my-vpc-name',
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      subnetConfiguration: [],
      natGateways: 0,
    });
    new ec2.SecurityGroup(this, 'MySgA', { vpc: testVpc, securityGroupName: 'my-sg' });
  }
}

const stack = new SgLookupStack(app, 'StackWithSg', { env });
new IntegTest(app, 'SgLookupTest', {
  testCases: [stack],
});

app.synth();

4. Run the test yarn build && yarn integ --update-on-failed aws-ec2/test/integ.security-group
5. Inspect the snapshot files (specifically *.assets.json and manifest.json) and observe that your AWS account ID is not redacted and replaced by the placeholder.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.148.1

Framework Version

No response

Node.js Version

v20.11.1

OS

Ubuntu via WSL2

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

@jdukewich Good afternoon. Please execute the following steps to re-generate the correct snapshots:

• Do not define and use env variable. In other words, modify your code to the one below:

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

import { EC2_RESTRICT_DEFAULT_SECURITY_GROUP } from 'aws-cdk-lib/cx-api';
import { IntegTest } from '@aws-cdk/integ-tests-alpha';

const app = new cdk.App();

class SgLookupStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    this.node.setContext(EC2_RESTRICT_DEFAULT_SECURITY_GROUP, false);

    const testVpc = new ec2.Vpc(this, 'MyVpc', {
      vpcName: 'my-vpc-name',
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      subnetConfiguration: [],
      natGateways: 0,
    });
    new ec2.SecurityGroup(this, 'MySgA', { vpc: testVpc, securityGroupName: 'my-sg' });
  }
}

const stack = new SgLookupStack(app, 'StackWithSg');
new IntegTest(app, 'SgLookupTest', {
  testCases: [stack],
});

app.synth();

• Delete your old snapshot directory integ.security-group.js.snapshot.
• Make sure the .ts file is transpiled to .js file (this could be easily done by using yarn watch in a separate terminal window)
• Re-run yarn integ --update-on-failed test/aws-ec2/test/integ.security-group.js from /projects/aws-cdk/packages/@aws-cdk-testing/framework-integ.

Thanks,
Ashish

[TheRealAmazonKendra]

After you have updated the snapshot, if you run the build again from root, your build should fail. We have a tool git-secrets-scan that specifically checks for account numbers added to code. I assume you are not running the entire build locally after updating integ tests, but we do upon submission of the PR and it cannot merge if there are account numbers or other secrets present.

[jdukewich]

Looks good removing env, thank you

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.