Function TestFetchCreds

tempodb/backend/s3/s3_test.go:61–230

TestFetchCreds verifies that fetchCreds() correctly handles individual credential sources. Each test only configures the specific source being validated.

(t *testing.T)

// credential sources. Each test only configures the specific source being
// validated.
func TestFetchCreds(t *testing.T) {
	cwd, err := os.Getwd()
	assert.NoError(t, err)

	// Set up mock IAM endpoint once for all tests (for security and efficiency)
	metadataSrv := httptest.NewServer(metadataMockedHandler(t))
	t.Cleanup(metadataSrv.Close)

	tests := []struct {
		name     string
		access   string
		secret   string
		envs     map[string]string
		profile  string
		expected credentials.Value
	}{
		{
			name: "no-creds",
			// anonymous access is the last in the chain of fetchCreds,
			// so we need to set an invalid endpoint to prevent IAM access
			envs: map[string]string{
				"TEST_IAM_ENDPOINT": "http://invalid-endpoint-to-prevent-iam-access:9999",
			},
			expected: credentials.Value{
				SignerType: credentials.SignatureAnonymous,
			},
		},
		{
			name: "aws-env",
			envs: map[string]string{
				"AWS_ACCESS_KEY_ID":     defaultAccessKey,
				"AWS_SECRET_ACCESS_KEY": defaultSecretKey,
			},
			expected: credentials.Value{
				AccessKeyID:     defaultAccessKey,
				SecretAccessKey: defaultSecretKey,
				SignerType:      credentials.SignatureV4,
			},
		},
		{
			name:   "aws-static",
			access: defaultAccessKey,
			secret: defaultSecretKey,
			expected: credentials.Value{
				AccessKeyID:     defaultAccessKey,
				SecretAccessKey: defaultSecretKey,
				SignerType:      credentials.SignatureDefault,
			},
		},
		{
			name: "minio-env",
			envs: map[string]string{
				"MINIO_ACCESS_KEY": defaultAccessKey,
				"MINIO_SECRET_KEY": defaultSecretKey,
			},
			expected: credentials.Value{
				AccessKeyID:     defaultAccessKey,
				SecretAccessKey: defaultSecretKey,