fix(ssm_document): bounds-check, typed error, pattern coverage, comments

- Add bounds-check on CommandInvocations[0] in commandOutputContains and
  VerifyAgentAction to prevent panics on empty invocations slice.
- Replace string matching with errors.As(smithy.APIError) + ErrorCode()
  in VerifySSMSendCommandRejection for robust error detection.
- Add cross-reference comment on WaitForCommandCompletion string coupling
  in RunAndVerifySSMActionFailure.
- Add allowedPattern-rejection cases for backtick value and malformed key
  (digit prefix) via VerifySSMSendCommandRejection.
- Add clarifying comments on setEnvEmptyTest omitted status fields and
  update Validate doc comment to mention both envConfigPath and
  platformSetup.

Author: sky333999

go.mod

@@ -25,6 +25,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.26.2
 	github.com/aws/aws-sdk-go-v2/service/xray v1.23.2
 	github.com/aws/aws-xray-sdk-go v1.8.3
+	github.com/aws/smithy-go v1.18.1
 	github.com/cenkalti/backoff/v4 v4.2.1
 	github.com/google/uuid v1.4.0
 	github.com/mitchellh/mapstructure v1.5.0
@@ -64,7 +65,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.8 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.18.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.2 // indirect
-	github.com/aws/smithy-go v1.18.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-logr/logr v1.3.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect

test/ssm_document/constants.go

@@ -18,6 +18,12 @@ const (
 	actionSetEnvEmpty          = "set-env (empty)"
 	actionSetEnvInvalidPattern = "set-env (invalid pattern)"
 
+	// actionSetEnvInvalidBacktick exercises rejection of a value containing a backtick.
+	actionSetEnvInvalidBacktick = "set-env (invalid backtick)"
+
+	// actionSetEnvInvalidKey exercises rejection of a malformed key starting with a digit.
+	actionSetEnvInvalidKey = "set-env (invalid key)"
+
 	// Parameters
 	paramAction                        = "action"
 	paramOptionalConfigurationSource   = "optionalConfigurationSource"
@@ -40,6 +46,14 @@ const (
 	// optionalEnvironmentVariable allowedPattern and is rejected by SSM at SendCommand.
 	setEnvInvalidPatternValue = "CWA_TEST_INVALID=$not_allowed"
 
+	// setEnvInvalidBacktickValue contains a backtick which violates the document's
+	// optionalEnvironmentVariable allowedPattern and is rejected by SSM at SendCommand.
+	setEnvInvalidBacktickValue = "CWA_TEST_BACKTICK=val`ue"
+
+	// setEnvInvalidKeyValue has a malformed key starting with a digit, violating the
+	// allowedPattern's key portion ([A-Za-z_][A-Za-z0-9_]*=...) and rejected at SendCommand.
+	setEnvInvalidKeyValue = "1FOO=bar"
+
 	// setEnvOutputPrefix is printed by the ctl on a successful set-env ("Set <KEY>").
 	setEnvOutputPrefix = "Set "
 

test/ssm_document/helper.go

@@ -5,13 +5,15 @@ package ssm_document
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"os"
 	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	"github.com/aws/aws-sdk-go-v2/service/ssm/types"
+	"github.com/aws/smithy-go"
 
 	"github.com/aws/amazon-cloudwatch-agent-test/util/awsservice"
 )
@@ -65,6 +67,10 @@ func VerifyAgentAction(out *ssm.SendCommandOutput, instanceId, documentName stri
 		return fmt.Errorf("failed to get status result: %v", err)
 	}
 
+	if len(statusResult.CommandInvocations) == 0 {
+		return fmt.Errorf("no command invocations returned for status check")
+	}
+
 	for _, plugin := range statusResult.CommandInvocations[0].CommandPlugins {
 		if plugin.Status == types.CommandPluginStatusFailed {
 			return fmt.Errorf("command plugin failed: %s", *plugin.Name)
@@ -138,6 +144,7 @@ func RunAndVerifySSMActionFailure(documentName string, instanceIds []string, tc
 		return fmt.Errorf("%s action was expected to fail but succeeded\nCommand output:\n%s", tc.actionName, commandOutput)
 	}
 	// WaitForCommandCompletion also errors on Cancelled/TimedOut/deadline; require Failed specifically.
+	// The "terminal status " prefix is produced by awsservice.WaitForCommandCompletion.
 	if !strings.Contains(err.Error(), "terminal status "+string(types.CommandInvocationStatusFailed)) {
 		return fmt.Errorf("%s action reached an unexpected terminal state: %v\nCommand output:\n%s", tc.actionName, err, commandOutput)
 	}
@@ -181,6 +188,9 @@ func VerifyEnvConfigContent(expected map[string]string) error {
 
 // commandOutputContains reports whether any command plugin's output contains expected.
 func commandOutputContains(result *ssm.ListCommandInvocationsOutput, expected string) bool {
+	if len(result.CommandInvocations) == 0 {
+		return false
+	}
 	for _, plugin := range result.CommandInvocations[0].CommandPlugins {
 		if plugin.Output != nil && strings.Contains(*plugin.Output, expected) {
 			return true
@@ -200,9 +210,10 @@ func VerifySSMSendCommandRejection(documentName string, instanceIds []string, tc
 		return fmt.Errorf("%s action was expected to be rejected at SendCommand but succeeded", tc.actionName)
 	}
 
-	// SSM returns an InvalidParameters error when allowedPattern validation fails.
-	if !strings.Contains(err.Error(), "InvalidParameters") {
-		return fmt.Errorf("%s action failed with unexpected error (expected InvalidParameters): %v", tc.actionName, err)
+	// SSM returns an InvalidParameters API error when allowedPattern validation fails.
+	var apiErr smithy.APIError
+	if !errors.As(err, &apiErr) || apiErr.ErrorCode() != "InvalidParameters" {
+		return fmt.Errorf("%s action failed with unexpected error (expected InvalidParameters API error): %v", tc.actionName, err)
 	}
 
 	log.Printf("%s action rejected at SendCommand as expected: %v", tc.actionName, err)

test/ssm_document/validate.go

@@ -16,7 +16,8 @@ import (
 )
 
 // Validate runs the full SSM Document integration test sequence. Platform-specific
-// constants (envConfigPath) are defined in the build-tagged platform files.
+// constants (envConfigPath) and initialization (platformSetup) are defined in the
+// build-tagged platform files (ssm_document_unix.go, ssm_document_windows.go).
 func Validate() error {
 	log.Println("Starting SSM Document validation tests")
 
@@ -207,8 +208,35 @@ func Validate() error {
 		return err
 	}
 
+	// Test set-env action (allowedPattern rejection): a value containing a backtick violates
+	// the allowedPattern and is rejected by SSM at SendCommand time.
+	if err := VerifySSMSendCommandRejection(documentName, instanceIds, testCase{
+		parameters: map[string][]string{
+			paramAction:                      {actionSetEnv},
+			paramOptionalEnvironmentVariable: {setEnvInvalidBacktickValue},
+		},
+		actionName: actionSetEnvInvalidBacktick,
+	}); err != nil {
+		return err
+	}
+
+	// Test set-env action (allowedPattern rejection): a key starting with a digit violates
+	// the [A-Za-z_] prefix requirement and is rejected by SSM at SendCommand time.
+	if err := VerifySSMSendCommandRejection(documentName, instanceIds, testCase{
+		parameters: map[string][]string{
+			paramAction:                      {actionSetEnv},
+			paramOptionalEnvironmentVariable: {setEnvInvalidKeyValue},
+		},
+		actionName: actionSetEnvInvalidKey,
+	}); err != nil {
+		return err
+	}
+
 	// Test set-env action (error path): empty optionalEnvironmentVariable must fail
 	// with the document-level error message.
+	// expectedAgentStatus and expectedConfigStatus are intentionally omitted: the action
+	// fails at the document level (RunAndVerifySSMActionFailure), so VerifyAgentAction
+	// is never called and those fields are unused.
 	setEnvEmptyTest := testCase{
 		parameters: map[string][]string{
 			paramAction:                      {actionSetEnv},