# Plan-time tests for the host instance's metadata service settings.
# mock_provider means no AWS account and no credentials.
mock_provider "aws" {}

override_data {
  target = data.aws_vpcs.default
  values = { ids = ["vpc-0aaaaaaaaaaaaaaaa"] }
}

override_data {
  target = data.aws_caller_identity.current
  values = { account_id = "123456789012" }
}

# The termination queue's ARN feeds an EventBridge target, which the provider
# validates as an ARN; the mock's random string is not one.
override_resource {
  target = aws_sqs_queue.terminations
  values = { arn = "arn:aws:sqs:eu-west-1:123456789012:carlos-test-host-terminations" }
}

variables {
  name                  = "carlos-test-ie"
  sg_description        = "carlos test host"
  iam_name              = "carlos-test-host"
  instance_type         = "t4g.small"
  root_volume_size      = 20
  user_data             = "#!/bin/sh\n"
  deployment_bucket_arn = "arn:aws:s3:::carlos-test-platform"
  data_bucket_arn       = "arn:aws:s3:::carlos-test-ie"
  ssm_parameter_arn     = "arn:aws:ssm:eu-west-1:123456789012:parameter/carlos/*"
}


run "imdsv2_only" {
  command = plan
  assert {
    condition     = aws_instance.host.metadata_options[0].http_tokens == "required"
    error_message = "the host requires IMDSv2 tokens"
  }
  assert {
    condition     = aws_instance.host.metadata_options[0].http_put_response_hop_limit == 1
    error_message = "the IMDS token must not leave the box (hop limit 1)"
  }
  assert {
    condition     = aws_instance.host.metadata_options[0].http_endpoint == "enabled"
    error_message = "the endpoint stays on: the box role is how the host reaches AWS"
  }
}