Test without AWS¶

Drive the provider's seams with the shipped mocks, so your wiring can be tested with no credentials and no billable calls.

Use the shipped mocks¶

Generated mocks live under mocks/ and ship as part of the module — a consumer should not have to generate their own.

import mocks "gitlab.com/phpboyscout/go/encryption-aws-kms/mocks"

pub := mocks.NewMockPublicKeyAPI(t)
pub.EXPECT().
    GetPublicKey(mock.Anything, mock.Anything).
    Return(&kms.GetPublicKeyOutput{
        PublicKey:              der,
        KeyUsage:               types.KeyUsageTypeKeyAgreement,
        KeyAgreementAlgorithms: []types.KeyAgreementAlgorithmSpec{types.KeyAgreementAlgorithmSpecEcdh},
    }, nil).
    Once()

There are three seams, each the slice of the KMS API one type actually uses: PublicKeyAPI, SharedSecretAPI and SignerAPI.

Test the failures, not just the happy path¶

The interesting behaviour here is what happens when AWS misbehaves, and mocks are the only way to produce most of it:

• a call that succeeds at construction and fails later — an expired session mid-run;
• an alias repointed between construction and use, which must give ErrKeyRotated;
• a response that is neither an error nor usable — nil output, or an empty SharedSecret;
• a key whose usage is right and whose type is wrong.

Each of these has a sentinel error, so assert with errors.Is rather than on message text.

A signer needs no mock at all¶

Signer implements crypto.Signer, so anything else that does can stand in. For testing code that takes a signer, a local RSA key is simpler and faster than a mock:

type fakeSigner struct{ key *rsa.PrivateKey }

func (s fakeSigner) Public() crypto.PublicKey { return &s.key.PublicKey }

func (s fakeSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
    return rsa.SignPKCS1v15(rand.Reader, s.key, opts.HashFunc(), digest)
}

Mock the KMS API when you are testing this provider; use a local key when you are testing something that consumes a signer.

Running the real thing¶

The integration tests need actual keys and make billable calls, so they are gated. See environment variables.