Real-world integration test: AWS (Secrets Manager + SSM)

[smiggleworth]

Why

Every test for internal/aws runs against hand-written fakes (fakeSecrets, promotionFake, fakeSSM, codedFailSSM, rollbackFake, ssmRollbackFake). Nothing in this package has ever been run against a real AWS account. The fakes encode my own understanding of the SDK's behavior — if that understanding is wrong anywhere, unit tests can't catch it.

What to verify against a real AWS account (Secrets Manager + SSM Parameter Store)

Secrets Manager write path (Secrets.WriteMany)

• The UNO-PENDING-<token> staged write → UpdateSecretVersionStage → AWSCURRENT promotion sequence works end-to-end against a real secret.
• Compare-and-swap retry actually triggers and resolves correctly under genuine concurrent writers (two processes writing the same secret simultaneously).
• removePending's cleanup call succeeds normally, and confirm what a real PendingCleanupFailed looks like (e.g. induced via a permission that allows PutSecretValue but not UpdateSecretVersionStage).
• First-write-to-a-missing-secret path: confirm DescribeSecret-based create-race detection behaves as expected when two processes both try to create the same new secret concurrently.
• smithy.APIError.ErrorCode() values actually match what's hardcoded in remoteError (UnrecognizedClientException, InvalidSignatureException, ExpiredTokenException, InvalidClientTokenId, AccessDenied, AccessDeniedException, UnauthorizedOperation, InvalidParameterException, InvalidRequestException, ParameterAlreadyExists) — these were written from documentation, not observed real responses.

Secrets Manager rollback (Secrets.Rollback)

• AWSCURRENT/AWSPREVIOUS stage swap actually reverts to the prior value on a real secret with real version history.
• Correct InvalidState failure on a secret that's only ever been written once (no AWSPREVIOUS stage exists yet).

SSM Parameter Store

• PutParameter retry-on-throttle actually recovers under real API throttling (may require generating real load, or verifying against SSM's documented rate limits).
• aws-sdk-go-v2/aws/retry.Standard.IsErrorRetryable correctly classifies real SSM error responses the way the unit tests assume (they use synthetic smithy.GenericAPIError{Code: "ThrottlingException"} — never a genuine SSM throttle response).
• Rollback's "fetch name:N-1, PutParameter it forward as a new version" approach behaves as documented against real parameter version history.

Auth

• Default credential chain (awscfg.LoadDefaultConfig) resolves correctly against a real IAM role/profile/environment-variable combination, not just "doesn't error" in a fake.

Scope

Needs a disposable/sandboxed AWS account or a scoped-down IAM role, since this issue calls for writing, promoting, and rolling back real secrets and parameters.