Skip to content

Latest commit

 

History

History
101 lines (73 loc) · 4.39 KB

cloud-integration.md

File metadata and controls

101 lines (73 loc) · 4.39 KB
Raw

Cloud Products

This test suite requires both Google Cloud Products and AWS access credentials.

AWS

These tests rely on test service providers (SPs) to validate behaviors. These SPs run on AWS EC2 instances. Because they are only needed for these tests, they do not run all the time. Therefore the test environment needs to be able to turn these instances on and off, so that humans don't have to.

Google Cloud Products (GCP)

GCP is used to upload test artifacts ("webdriver reports") as well as secrets (namely, test identity credentials). Developers with requisite permissions can access and edit those secrets here.

AWS & GCP Programmatic Access Keys

GCP

[REQUIRED]

In order to run these tests, you must have a GOOGLE_APPLICATION_CREDENTIALS environment variable set. The variable needs to point to the /path/to/some.json; the JSON file must have been downloaded from GCP after creating a Service Account.

This file should be unique to every user, and should not be shared.

Creating a Service Account

If you are an IAM developer with access to our GCP Aux. project, you can create a service account yourself. Otherwise, have someone with access do this for you and send you the JSON. This credential file cannot be retrieved; if you lose it, another one must be created, and the original revoked.

This is a one-time requirement.

  1. Log in to GCP using the link in the first section of this document.
  2. In the search bar, type "Service Accounts"; click the entry that reads "Service Accounts."
  3. Click on "+ Create Service Account"
  4. Fill in the form:
  • [Service account name] "uwit-iam-dev-${YOUR_NETID}"
  • [Service account ID] "uwit-iam-dev-${YOUR_NETID}"
  • [Service account description] "Developer access to the IAM GCP Aux. project."
  1. Click "Continue"
  2. On the next page, add the following roles:
  • Secret Manager Secret Accessor
  • Secret Manager Secret Version Manager (because that's not confusing at all)
  • Storage Object Viewer
  1. Click "Continue"
  2. Click "Done." You will be taken back to to the service account listing.
  3. Locate and click on the service account you just created.
  4. Under "Keys," click "ADD KEY" => "Create new key." Select JSON.
  5. Download this key to your machine; you should only ever have to do this once, so put this somewhere central and permanent.

It is recommended to export this key as part of your terminal activation. Users on Linux or MacOS can run:

echo "export GOOGLE_APPLICATION_CREDENTIALS=/path/to/some.json > ~/.bash_profile

  • /path/to/some.json should be replaced with the path to the JSON file you saved in step 11 above.
  • ~/.bash_profile may need to be replaced with ~/.bashrc, ~/.zshrc or some other name, depending on your personal terminal setup and preferences.

AWS

This is not required - There are shared access keys used by default that are accessed at runtime using your Google credentials (above). Only do this if you know you have a new use case!

For programmatic access to AWS, you need to first log in to the AWS console using the link in the first section of this document.

If offered the option on sign in, choose "sandbox-iamteam."

  1. Click on "Services"
  2. Search for "IAM", and click on the entry.
  3. Click on "Users."
  4. Click "Add user."
  5. Fill in the form:
  • User name => your UW netid
  • Access type => Programmatic Access (Do not select console management access!)
  1. Click "Next: Permissions"
  2. Click the box next to "idp-web-test-runners".
  3. Click "Next: Tags"
  4. Click "Next: Review"
  5. Click "Create user"
  6. Copy the access key id and paste it somewhere safe. (We'll come back to it in a minute.)
  7. Click "Show" under "Secret Access Key", copy it, and paste it somewhere safe.
  • Make very sure you have pasted the secret access key; you won't be able to see it again.
  1. Click "Close"

These should be exported as environment variables with the following names: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

You may also consider installing the AWS cli (pip install awscli), running aws config, and pasting the entries there.

Either option will work for Boto3, which creates AWS clients.