@Test
public void testGetAWSTemporaryCredentialsForbidden() {

    
    Principal principal = SimplePrincipal.create("user_domain", "user102",
            "v=U1;d=user_domain;n=user102;s=signature", 0, null);
    CloudStore cloudStore = Mockito.mock(CloudStore.class);
    Mockito.when(cloudStore.isAwsEnabled()).thenReturn(true);
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    
    SignedDomain signedDomain = createAwsSignedDomain("athenz.product", "1234");
    store.processDomain(signedDomain, false);
    
    try {
        zts.getAWSTemporaryCredentials(createResourceContext(principal), "athenz.product", "aws_role_name", null, null);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}