Add Unit Tests for cloudfront_access_logging_enabled Check#302
Conversation
| """Test error handling when a ClientError occurs.""" | ||
| self.mock_cf.list_distributions.side_effect = ClientError({"Error": {"Code": "AccessDenied"}}, "ListDistributions") | ||
| report = self.check.execute(self.mock_session) | ||
| assert report.status == CheckStatus.UNKNOWN |
There was a problem hiding this comment.
-
❌ Missing Test Case for
RealtimeLogConfigArnEnabled-
The implementation checks if either
Logging.EnabledorRealtimeLogConfigArnis present. -
Missing test where:
-
Logging.Enabled = False -
RealtimeLogConfigArnis set
➤ This path is untested and may introduce blind spots.
-
-
-
⚠️ No Test Case for Exception inget_distribution_config-
You handle exceptions in
get_distribution_config()(per distribution), but no test simulates a failure at this level.
➤ Add a test to mock exception only forget_distribution_config.
-
-
⚠️ ClientErrorTest Only Coverslist_distributions-
While the
ClientErroris tested forlist_distributions, there’s no test whereget_distribution_configraisesClientErrorfor one distribution.
➤ Add test for error during config fetch per distribution.
-
-
⚠️ Missing Mixed Scenario Test-
No test checks for mixed results (e.g., one distribution with logging, one without).
➤ This is important to confirm howreport.statusbehaves when some distributions pass and others fail.
-
✅ Improvements to Make
| Issue | Suggested Improvement |
|---|---|
| Missing Realtime log check | Add a test where RealtimeLogConfigArn is enabled and legacy logging is disabled |
| No partial failure test | Add a test where get_distribution_config fails for one distribution |
| Only one error type tested | Add ClientError or general exception test for get_distribution_config |
| No mixed outcome | Add test with multiple distributions with mixed logging states |
There was a problem hiding this comment.
cover all the points
2 participants
This PR adds unit tests for the cloudfront_access_logging_enabled check. It covers different scenarios to ensure the check behaves correctly for CloudFront distributions.
Test Cases Included:
No distributions present
Access logging is enabled
Access logging disabled
Client error from AWS
File Added:
library/aws/tests/cloudfront/test_cloudfront_access_logging_enabled.py