| 1 | import * as AWS from "@/AWS"; |
| 2 | import * as Test from "@/Test/Alchemy"; |
| 3 | import * as emr from "@distilled.cloud/aws/emr-serverless"; |
| 4 | import { expect } from "alchemy-test"; |
| 5 | import * as Effect from "effect/Effect"; |
| 6 | |
| 7 | const { test } = Test.make({ providers: AWS.providers() }); |
| 8 | |
| 9 | // Ungated platform-gate probe: `emr-serverless:GetResourceDashboard` is |
| 10 | // currently denied by the SERVICE for every caller — even a principal with |
| 11 | // `Action: "*"` (AdministratorAccess) receives |
| 12 | // AccessDeniedException: User: … is not authorized to perform: |
| 13 | // emr-serverless:GetResourceDashboard |
| 14 | // with no resource in the message, so the denial is service-side (the |
| 15 | // operation backs the console/interactive-session dashboards), not an IAM |
| 16 | // policy gap. This probe pins that behavior: if it ever starts failing, the |
| 17 | // operation has launched publicly and the Bindings test's expectation for |
| 18 | // the GetResourceDashboard runtime probe should be upgraded to a |
| 19 | // success/not-found assertion. |
| 20 | test.provider( |
| 21 | "getResourceDashboard is service-gated (typed AccessDenied)", |
| 22 | () => |
| 23 | Effect.gen(function* () { |
| 24 | const error = yield* Effect.flip( |
| 25 | emr.getResourceDashboard({ |
| 26 | applicationId: "00abcdefabcdef01", |
| 27 | resourceId: "00abcdefabcdef01", |
| 28 | resourceType: "SPARK_DRIVER", |
| 29 | }), |
| 30 | ); |
| 31 | expect(error._tag).toBe("AccessDeniedException"); |
| 32 | }), |
| 33 | { tags: ["provider:aws", "provider:aws:emrserverless", "live"] }, |
| 34 | ); |