1import * as AWS from "@/AWS";
2import { EIP } from "@/AWS/EC2";
3import { AWSEnvironment } from "@/AWS/Environment.ts";
4import { Protection, ProtectionGroup } from "@/AWS/Shield";
5import * as Output from "@/Output";
6import * as Test from "@/Test/Alchemy";
7import * as shield from "@distilled.cloud/aws/shield";
8import { describe, expect } from "alchemy-test";
9import * as Effect from "effect/Effect";
10
11const { test } = Test.make({ providers: AWS.providers() });
12
13// Shield Advanced costs $3,000/month with a mandatory 1-year auto-renewing
14// commitment, so the testing account is NOT subscribed and must never be. The
15// ungated probes below prove the distilled wiring and the patched typed
16// `SubscriptionNotFound` entitlement tag against the real API at near-zero
17// cost; the full lifecycle only runs on an already-subscribed account with
18// AWS_TEST_SHIELD_ADVANCED=1.
19describe(
20 "AWS.Shield",
21 { tags: ["provider:aws", "provider:aws:shield", "live"] },
22 () => {
23 test.provider(
24 "getSubscriptionState succeeds without a subscription",
25 () =>
26 Effect.gen(function* () {
27 // Available to every account, subscribed or not — proves endpoint
28 // resolution (shield pins to us-east-1) and response decoding.
29 const state = yield* shield.getSubscriptionState({});
30 expect(["ACTIVE", "INACTIVE"]).toContain(state.SubscriptionState);
31 }),
32 { timeout: 60_000 },
33 );
34
35 test.provider(
36 "describeSubscription on a non-subscribed account fails with typed SubscriptionNotFound",
37 () =>
38 Effect.gen(function* () {
39 // The entitlement probe: the wire error is ResourceNotFoundException
40 // "The subscription does not exist." — patched in distilled to the
41 // synthetic typed tag `SubscriptionNotFound`.
42 const error = yield* Effect.flip(shield.describeSubscription({}));
43 expect(error._tag).toBe("SubscriptionNotFound");
44 }),
45 { timeout: 60_000 },
46 );
47
48 test.provider(
49 "describeProtection without a subscription fails with typed SubscriptionNotFound",
50 () =>
51 Effect.gen(function* () {
52 const error = yield* Effect.flip(
53 shield.describeProtection({
54 ProtectionId: "00000000-0000-0000-0000-000000000000",
55 }),
56 );
57 expect(error._tag).toBe("SubscriptionNotFound");
58 }),
59 { timeout: 60_000 },
60 );
61
62 test.provider(
63 "listProtections without a subscription fails with typed SubscriptionNotFound",
64 () =>
65 Effect.gen(function* () {
66 const error = yield* Effect.flip(shield.listProtections({}));
67 expect(error._tag).toBe("SubscriptionNotFound");
68 }),
69 { timeout: 60_000 },
70 );
71
72 test.provider(
73 "describeProtectionGroup for a nonexistent group fails with typed ResourceNotFoundException",
74 () =>
75 Effect.gen(function* () {
76 // Unlike the other operations, protection-group reads report the
77 // missing group itself even on a non-subscribed account.
78 const error = yield* Effect.flip(
79 shield.describeProtectionGroup({
80 ProtectionGroupId: "alchemy-nonexistent-probe",
81 }),
82 );
83 expect(error._tag).toBe("ResourceNotFoundException");
84 }),
85 { timeout: 60_000 },
86 );
87
88 // Full lifecycle — requires an account with an ACTIVE Shield Advanced
89 // subscription. NEVER subscribe the testing account: deploying the
90 // Shield.Subscription resource starts a $3,000/month 1-year commitment.
91 test.provider.skipIf(!process.env.AWS_TEST_SHIELD_ADVANCED)(
92 "protection + protection group lifecycle on a subscribed account",
93 (stack) =>
94 Effect.gen(function* () {
95 yield* stack.destroy();
96
97 const deploy = (aggregation: "SUM" | "MAX") =>
98 stack.deploy(
99 Effect.gen(function* () {
100 const { accountId, region } = yield* AWSEnvironment.current;
101 const eip = yield* EIP("ProtectedEip", {});
102 const protection = yield* Protection("EipProtection", {
103 resourceArn: Output.interpolate`arn:aws:ec2:${region}:${accountId}:eip-allocation/${eip.allocationId}`,
104 tags: { fixture: "shield" },
105 });
106 const group = yield* ProtectionGroup("AllGroup", {
107 aggregation,
108 pattern: "ALL",
109 tags: { fixture: "shield" },
110 });
111 return { protection, group };
112 }),
113 );
114
115 const { protection, group } = yield* deploy("SUM");
116 expect(protection.protectionId).toBeDefined();
117 expect(protection.protectionArn).toContain(":protection/");
118 expect(protection.healthCheckIds).toEqual([]);
119 expect(group.aggregation).toBe("SUM");
120 expect(group.pattern).toBe("ALL");
121
122 // Out-of-band verification via distilled.
123 const observed = yield* shield.describeProtection({
124 ProtectionId: protection.protectionId,
125 });
126 expect(observed.Protection?.ResourceArn).toBe(protection.resourceArn);
127 const observedGroup = yield* shield.describeProtectionGroup({
128 ProtectionGroupId: group.protectionGroupId,
129 });
130 expect(observedGroup.ProtectionGroup.Aggregation).toBe("SUM");
131
132 // Update the group's aggregation in place (no replacement).
133 const updated = yield* deploy("MAX");
134 expect(updated.group.protectionGroupId).toBe(group.protectionGroupId);
135 expect(updated.group.aggregation).toBe("MAX");
136
137 // Destroy and verify both are gone out-of-band.
138 yield* stack.destroy();
139 const goneProtection = yield* Effect.flip(
140 shield.describeProtection({
141 ProtectionId: protection.protectionId,
142 }),
143 );
144 expect([
145 "ResourceNotFoundException",
146 "SubscriptionNotFound",
147 ]).toContain(goneProtection._tag);
148 const goneGroup = yield* Effect.flip(
149 shield.describeProtectionGroup({
150 ProtectionGroupId: group.protectionGroupId,
151 }),
152 );
153 expect(goneGroup._tag).toBe("ResourceNotFoundException");
154 }),
155 { tags: ["provider:aws:ec2"], timeout: 300_000 },
156 );
157 },
158);