Repository: clouditor/clouditor
Pull request #1062 (2023-04-08 08:55:45)

Various test improvements
Further cleanup of variables outside the `testdata` package. Making use of varargs in `NewAuthorizationService`. Consistent use of `NewAuthorizationService` mock.

codecov[bot]: ## [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) Report
> Merging [#1062](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (dfad158) into [main](https://codecov.io/gh/clouditor/clouditor/commit/cf4cfd99102be5aa7c497706c2bd9d8d54daa73c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (cf4cfd9) will **decrease** coverage by `0.10%`.
> The diff coverage is `100.00%`.

```diff
@@            Coverage Diff             @@
##             main    #1062      +/-   ##
==========================================
- Coverage   82.62%   82.52%   -0.10%     
==========================================
  Files          90       90              
  Lines        7624     7605      -19     
==========================================
- Hits         6299     6276      -23     
- Misses       1014     1019       +5     
+ Partials      311      310       -1     
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `82.52% <100.00%> (-0.10%)` | :arrow_down: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) | Coverage Δ | |
|---|---|---|
| [internal/testutil/auth.go](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-aW50ZXJuYWwvdGVzdHV0aWwvYXV0aC5nbw==) | `92.50% <ø> (+3.61%)` | :arrow_up: |
| [internal/testutil/servicetest/authz.go](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-aW50ZXJuYWwvdGVzdHV0aWwvc2VydmljZXRlc3QvYXV0aHouZ28=) | `100.00% <100.00%> (ø)` | |
| [service/orchestrator/orchestrator.go](https://codecov.io/gh/clouditor/clouditor/pull/1062?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9vcmNoZXN0cmF0b3Ivb3JjaGVzdHJhdG9yLmdv) | `75.97% <100.00%> (-2.03%)` | :arrow_down: |

... and [1 file with indirect coverage changes](https://codecov.io/gh/clouditor/clouditor/pull/1062/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)


Patch:
diff --git a/service/orchestrator/orchestrator.go b/service/orchestrator/orchestrator.go
index 88de3b5a..474f0f8f 100644
--- a/service/orchestrator/orchestrator.go
+++ b/service/orchestrator/orchestrator.go
@@ -143,6 +143,12 @@ func WithAuthorizationStrategyJWT(key string, allowAllKey string) ServiceOption
 	}
 }
 
+func WithAuthorizationStrategy(authz service.AuthorizationStrategy) ServiceOption {
+	return func(s *Service) {
+		s.authz = authz
+	}
+}
+
 // NewService creates a new Orchestrator service
 func NewService(opts ...ServiceOption) *Service {
 	var err error


Test patch:
diff --git a/api/authorizer_test.go b/api/authorizer_test.go
index 6b10f2ee..b25fab9a 100644
--- a/api/authorizer_test.go
+++ b/api/authorizer_test.go
@@ -32,11 +32,12 @@ import (
 	"reflect"
 	"testing"
 
+	"clouditor.io/clouditor/internal/testdata"
+	"clouditor.io/clouditor/internal/testutil"
+
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/oauth2/clientcredentials"
-
-	"clouditor.io/clouditor/internal/testutil"
 )
 
 func Test_oauthAuthorizer_Token(t *testing.T) {
@@ -72,8 +73,8 @@ func Test_oauthAuthorizer_Token(t *testing.T) {
 			fields: fields{
 				TokenSource: oauth2.ReuseTokenSource(nil,
 					(&clientcredentials.Config{
-						ClientID:     testutil.TestAuthClientID,
-						ClientSecret: testutil.TestAuthClientSecret,
+						ClientID:     testdata.MockAuthClientID,
+						ClientSecret: testdata.MockAuthClientSecret,
 						TokenURL:     fmt.Sprintf("http://localhost:%d/v1/auth/token", port),
 					}).TokenSource(context.Background()),
 				),
@@ -109,8 +110,8 @@ func Test_oauthAuthorizer_Token(t *testing.T) {
 
 func TestNewOAuthAuthorizerFromClientCredentials(t *testing.T) {
 	var config = clientcredentials.Config{
-		ClientID:     testutil.TestAuthClientID,
-		ClientSecret: testutil.TestAuthClientSecret,
+		ClientID:     testdata.MockAuthClientID,
+		ClientSecret: testdata.MockAuthClientSecret,
 		TokenURL:     "/v1/auth/token",
 	}
 
diff --git a/cli/commands/resource/resource_test.go b/cli/commands/resource/resource_test.go
index 4c5fd6a5..e8f42108 100644
--- a/cli/commands/resource/resource_test.go
+++ b/cli/commands/resource/resource_test.go
@@ -35,7 +35,6 @@ import (
 	"clouditor.io/clouditor/api/discovery"
 	"clouditor.io/clouditor/cli"
 	"clouditor.io/clouditor/internal/testdata"
-	"clouditor.io/clouditor/internal/testutil"
 	"clouditor.io/clouditor/internal/testutil/clitest"
 	"clouditor.io/clouditor/service"
 	service_discovery "clouditor.io/clouditor/service/discovery"
@@ -140,7 +139,7 @@ func (m mockDiscoverer) List() ([]voc.IsCloudResource, error) {
 }
 
 func (mockDiscoverer) CloudServiceID() string {
-	return testutil.TestCloudService1
+	return testdata.MockCloudServiceID
 }
 
 func wrongFormattedResource() voc.IsCloudResource {
diff --git a/cli/commands/service/discovery/discovery_test.go b/cli/commands/service/discovery/discovery_test.go
index 4ac1d422..3309a941 100644
--- a/cli/commands/service/discovery/discovery_test.go
+++ b/cli/commands/service/discovery/discovery_test.go
@@ -35,7 +35,6 @@ import (
 	"clouditor.io/clouditor/api/discovery"
 	"clouditor.io/clouditor/cli"
 	"clouditor.io/clouditor/internal/testdata"
-	"clouditor.io/clouditor/internal/testutil"
 	"clouditor.io/clouditor/internal/testutil/clitest"
 	"clouditor.io/clouditor/service"
 	service_discovery "clouditor.io/clouditor/service/discovery"
@@ -157,7 +156,7 @@ func (m mockDiscoverer) List() ([]voc.IsCloudResource, error) {
 }
 
 func (mockDiscoverer) CloudServiceID() string {
-	return testutil.TestCloudService1
+	return testdata.MockCloudServiceID
 }
 
 func wrongFormattedResource() voc.IsCloudResource {
diff --git a/internal/testutil/auth.go b/internal/testutil/auth.go
index c03e755a..f09e97fa 100644
--- a/internal/testutil/auth.go
+++ b/internal/testutil/auth.go
@@ -1,93 +1,17 @@
 package testutil
 
 import (
-	"context"
 	"fmt"
 	"net"
 	"net/http"
 
-	"github.com/golang-jwt/jwt/v4"
+	"clouditor.io/clouditor/internal/testdata"
+
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/oxisto/oauth2go/login"
 	"golang.org/x/oauth2/clientcredentials"
-	"google.golang.org/grpc/metadata"
-)
-
-const (
-	TestAuthUser         = "clouditor"
-	TestAuthPassword     = "clouditor"
-	TestCustomClaims     = "cloudserviceid"
-	TestAllowAllClaims   = "cladmin"
-	TestAuthClientID     = "client"
-	TestAuthClientSecret = "secret"
-
-	TestCloudService1     = "11111111-1111-1111-1111-111111111111"
-	TestCloudService2     = "22222222-2222-2222-2222-222222222222"
-	TestCloudServiceName1 = "My Cloud Service 1"
-	TestCloudServiceName2 = "My Cloud Service 2"
-)
-
-var (
-	// TestContextOnlyService1 is an incoming context with a JWT that only allows access to cloud service ID
-	// 11111111-1111-1111-1111-111111111111
-	TestContextOnlyService1 context.Context
-
-	// TestContextOnlyService1 is an incoming context with a JWT that allows access to all cloud services
-	TestContextAllowAll context.Context
-
-	// TestBrokenContext contains an invalid JWT
-	TestBrokenContext = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
-		"authorization": "bearer what",
-	}))
-
-	// TestClaimsOnlyService1 contains claims that authorize the user for the cloud service
-	// 11111111-1111-1111-1111-111111111111.
-	TestClaimsOnlyService1 = jwt.MapClaims{
-		"sub": "me",
-		"cloudserviceid": []string{
-			TestCloudService1,
-		},
-		"other": []int{1, 2},
-	}
-
-	// TestClaimsOnlyService1 contains claims that authorize the user for all cloud services.
-	TestClaimsAllowAll = jwt.MapClaims{
-		"sub":     "me",
-		"cladmin": true,
-	}
 )
 
-func init() {
-	var (
-		err   error
-		token *jwt.Token
-		t     string
-	)
-
-	// Create a new token instead of hard-coding one
-	token = jwt.NewWithClaims(jwt.SigningMethodHS256, &TestClaimsOnlyService1)
-	t, err = token.SignedString([]byte("mykey"))
-	if err != nil {
-		panic(err)
-	}
-
-	// Create a context containing our token
-	TestContextOnlyService1 = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
-		"authorization": "bearer " + t,
-	}))
-
-	token = jwt.NewWithClaims(jwt.SigningMethodHS256, &TestClaimsAllowAll)
-	t, err = token.SignedString([]byte("mykey"))
-	if err != nil {
-		panic(err)
-	}
-
-	// Create a context containing our token
-	TestContextAllowAll = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
-		"authorization": "bearer " + t,
-	}))
-}
-
 // StartAuthenticationServer starts an authentication server on a random port with
 // users and clients specified in the TestAuthUser and TestAuthClientID constants.
 func StartAuthenticationServer() (srv *oauth2.AuthorizationServer, port uint16, err error) {
@@ -103,10 +27,10 @@ func StartAuthenticationServer() (srv *oauth2.AuthorizationServer, port uint16,
 
 	srv = oauth2.NewServer(fmt.Sprintf(":%d", port),
 		oauth2.WithClient("cli", "", "http://localhost:10000/callback"),
-		oauth2.WithClient(TestAuthClientID, TestAuthClientSecret, ""),
+		oauth2.WithClient(testdata.MockAuthClientID, testdata.MockAuthClientSecret, ""),
 		oauth2.WithPublicURL(fmt.Sprintf("http://localhost:%d", port)),
 		login.WithLoginPage(
-			login.WithUser(TestAuthUser, TestAuthPassword),
+			login.WithUser(testdata.MockAuthUser, testdata.MockAuthPassword),
 			login.WithBaseURL("/v1/auth"),
 		),
 	)
@@ -136,8 +60,8 @@ func AuthURL(port uint16) string {
 
 func AuthClientConfig(port uint16) *clientcredentials.Config {
 	return &clientcredentials.Config{
-		ClientID:     TestAuthClientID,
-		ClientSecret: TestAuthClientSecret,
+		ClientID:     testdata.MockAuthClientID,
+		ClientSecret: testdata.MockAuthClientSecret,
 		TokenURL:     TokenURL(port),
 	}
 }
diff --git a/internal/testutil/clitest/cli.go b/internal/testutil/clitest/cli.go
index 487b66a6..952557fe 100644
--- a/internal/testutil/clitest/cli.go
+++ b/internal/testutil/clitest/cli.go
@@ -9,8 +9,10 @@ import (
 
 	"clouditor.io/clouditor/api"
 	"clouditor.io/clouditor/cli"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
 	"clouditor.io/clouditor/service"
+
 	oauth2 "github.com/oxisto/oauth2go"
 	"github.com/spf13/viper"
 	"google.golang.org/grpc"
@@ -37,14 +39,14 @@ func PrepareSession(authPort uint16, authSrv *oauth2.AuthorizationServer, grpcUR
 	viper.Set(cli.SessionFolderFlag, dir)
 
 	// Simulate a login by directly granting a token
-	token, err = authSrv.GenerateToken(testutil.TestAuthClientID, 0, 0)
+	token, err = authSrv.GenerateToken(testdata.MockAuthClientID, 0, 0)
 	if err != nil {
 		return "", err
 	}
 
 	// TODO(oxisto): This is slightly duplicated code from the Login command. Extract it into the session struct
 	session, err = cli.NewSession(grpcURL, &oauth2.Config{
-		ClientID: testutil.TestAuthClientID,
+		ClientID: testdata.MockAuthClientID,
 		Endpoint: oauth2.Endpoint{
 			AuthURL:  testutil.AuthURL(authPort),
 			TokenURL: testutil.TokenURL(authPort),
diff --git a/internal/testutil/servicetest/authz.go b/internal/testutil/servicetest/authz.go
index fca2c873..30fe8a56 100644
--- a/internal/testutil/servicetest/authz.go
+++ b/internal/testutil/servicetest/authz.go
@@ -5,10 +5,14 @@ import (
 
 	"clouditor.io/clouditor/internal/api"
 	"clouditor.io/clouditor/service"
+
 	"golang.org/x/exp/slices"
 )
 
-func NewAuthorizationStrategy(all bool, cloudServiceIDs []string) service.AuthorizationStrategy {
+// NewAuthorizationStrategy contains a mock for a
+// [service.AuthorizationStrategy] that either allows all cloud services or the
+// ones that are specified in the ID list.
+func NewAuthorizationStrategy(all bool, cloudServiceIDs ...string) service.AuthorizationStrategy {
 	return &AuthorizationStrategyMock{
 		all:             all,
 		cloudServiceIDs: cloudServiceIDs,
diff --git a/policies/rego_test.go b/policies/rego_test.go
index 3b2c40aa..d0636b06 100644
--- a/policies/rego_test.go
+++ b/policies/rego_test.go
@@ -31,9 +31,11 @@ import (
 
 	"clouditor.io/clouditor/api/assessment"
 	"clouditor.io/clouditor/api/evidence"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
 	"clouditor.io/clouditor/persistence"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/structpb"
@@ -42,18 +44,15 @@ import (
 
 func Test_regoEval_Eval(t *testing.T) {
 	type fields struct {
-		// TODO(oxisto): move to args
-		resource voc.IsCloudResource
-		// TODO(oxisto): move to args
-		evidenceID string
-
 		qc      *queryCache
 		mrtc    *metricsCache
 		storage persistence.Storage
 		pkg     string
 	}
 	type args struct {
-		src MetricsSource
+		resource   voc.IsCloudResource
+		evidenceID string
+		src        MetricsSource
 	}
 	tests := []struct {
 		name       string
@@ -66,6 +65,12 @@ func Test_regoEval_Eval(t *testing.T) {
 		{
 			name: "ObjectStorage: Compliant Case",
 			fields: fields{
+				qc:      newQueryCache(),
+				mrtc:    &metricsCache{m: make(map[string][]string)},
+				storage: testutil.NewInMemoryStorage(t),
+				pkg:     DefaultRegoPackage,
+			},
+			args: args{
 				resource: voc.ObjectStorage{
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
@@ -84,12 +89,8 @@ func Test_regoEval_Eval(t *testing.T) {
 					},
 				},
 				evidenceID: mockObjStorage1EvidenceID,
-				qc:         newQueryCache(),
-				mrtc:       &metricsCache{m: make(map[string][]string)},
-				storage:    testutil.NewInMemoryStorage(t),
-				pkg:        DefaultRegoPackage,
+				src:        &mockMetricsSource{t: t},
 			},
-			args:       args{src: &mockMetricsSource{t: t}},
 			applicable: true,
 			compliant: map[string]bool{
 				"AtRestEncryptionAlgorithm":         true,
@@ -102,6 +103,12 @@ func Test_regoEval_Eval(t *testing.T) {
 		}, {
 			name: "ObjectStorage: Non-Compliant Case with no Encryption at rest",
 			fields: fields{
+				qc:      newQueryCache(),
+				mrtc:    &metricsCache{m: make(map[string][]string)},
+				storage: testutil.NewInMemoryStorage(t),
+				pkg:     DefaultRegoPackage,
+			},
+			args: args{
 				resource: voc.ObjectStorage{
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
@@ -118,12 +125,8 @@ func Test_regoEval_Eval(t *testing.T) {
 					PublicAccess: true,
 				},
 				evidenceID: mockObjStorage2EvidenceID,
-				qc:         newQueryCache(),
-				mrtc:       &metricsCache{m: make(map[string][]string)},
-				storage:    testutil.NewInMemoryStorage(t),
-				pkg:        DefaultRegoPackage,
+				src:        &mockMetricsSource{t: t},
 			},
-			args:       args{src: &mockMetricsSource{t: t}},
 			applicable: true,
 			compliant: map[string]bool{
 				"AtRestEncryptionAlgorithm":         false,
@@ -137,6 +140,12 @@ func Test_regoEval_Eval(t *testing.T) {
 		{
 			name: "ObjectStorage: Non-Compliant Case 2 with no customer managed key",
 			fields: fields{
+				qc:      newQueryCache(),
+				mrtc:    &metricsCache{m: make(map[string][]string)},
+				storage: testutil.NewInMemoryStorage(t),
+				pkg:     DefaultRegoPackage,
+			},
+			args: args{
 				resource: voc.ObjectStorage{
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
@@ -156,12 +165,8 @@ func Test_regoEval_Eval(t *testing.T) {
 					PublicAccess: true,
 				},
 				evidenceID: mockObjStorage2EvidenceID,
-				qc:         newQueryCache(),
-				mrtc:       &metricsCache{m: make(map[string][]string)},
-				storage:    testutil.NewInMemoryStorage(t),
-				pkg:        DefaultRegoPackage,
+				src:        &mockMetricsSource{t: t},
 			},
-			args:       args{src: &mockMetricsSource{t: t}},
 			applicable: true,
 			compliant: map[string]bool{
 				"AtRestEncryptionAlgorithm":         false,
@@ -175,6 +180,13 @@ func Test_regoEval_Eval(t *testing.T) {
 		{
 			name: "VM: Compliant Case",
 			fields: fields{
+				qc:      newQueryCache(),
+				mrtc:    &metricsCache{m: make(map[string][]string)},
+				storage: testutil.NewInMemoryStorage(t),
+				pkg:     DefaultRegoPackage,
+			},
+			args: args{
+				src: &mockMetricsSource{t: t},
 				resource: voc.VirtualMachine{
 					AutomaticUpdates: &voc.AutomaticUpdates{
 						Enabled:      true,
@@ -215,12 +227,7 @@ func Test_regoEval_Eval(t *testing.T) {
 					},
 				},
 				evidenceID: mockVM1EvidenceID,
-				qc:         newQueryCache(),
-				mrtc:       &metricsCache{m: make(map[string][]string)},
-				storage:    testutil.NewInMemoryStorage(t),
-				pkg:        DefaultRegoPackage,
 			},
-			args:       args{src: &mockMetricsSource{t: t}},
 			applicable: true,
 			compliant: map[string]bool{
 				"AutomaticUpdatesEnabled":      true,
@@ -240,6 +247,12 @@ func Test_regoEval_Eval(t *testing.T) {
 		{
 			name: "VM: Non-Compliant Case",
 			fields: fields{
+				qc:      newQueryCache(),
+				mrtc:    &metricsCache{m: make(map[string][]string)},
+				storage: testutil.NewInMemoryStorage(t),
+				pkg:     DefaultRegoPackage,
+			},
+			args: args{
 				resource: voc.VirtualMachine{
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
@@ -263,12 +276,8 @@ func Test_regoEval_Eval(t *testing.T) {
 					},
 				},
 				evidenceID: mockVM2EvidenceID,
-				qc:         newQueryCache(),
-				mrtc:       &metricsCache{m: make(map[string][]string)},
-				storage:    testutil.NewInMemoryStorage(t),
-				pkg:        DefaultRegoPackage,
+				src:        &mockMetricsSource{t: t},
 			},
-			args:       args{src: &mockMetricsSource{t: t}},
 			applicable: true,
 			compliant: map[string]bool{
 				"AutomaticUpdatesEnabled":      false,
@@ -287,7 +296,7 @@ func Test_regoEval_Eval(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		resource, err := voc.ToStruct(tt.fields.resource)
+		resource, err := voc.ToStruct(tt.args.resource)
 		assert.NoError(t, err)
 		t.Run(tt.name, func(t *testing.T) {
 			pe := regoEval{
@@ -296,7 +305,7 @@ func Test_regoEval_Eval(t *testing.T) {
 				pkg:  tt.fields.pkg,
 			}
 			results, err := pe.Eval(&evidence.Evidence{
-				Id:       tt.fields.evidenceID,
+				Id:       tt.args.evidenceID,
 				Resource: resource,
 			}, tt.args.src)
 
@@ -348,7 +357,7 @@ func Test_regoEval_evalMap(t *testing.T) {
 				pkg:  DefaultRegoPackage,
 			},
 			args: args{
-				serviceID: testutil.TestCloudService1,
+				serviceID: testdata.MockCloudServiceID,
 				metricID:  "AutomaticUpdatesEnabled",
 				baseDir:   ".",
 				m: map[string]interface{}{
@@ -370,7 +379,7 @@ func Test_regoEval_evalMap(t *testing.T) {
 					IsDefault:      true,
 					UpdatedAt:      nil,
 					MetricId:       "AutomaticUpdatesEnabled",
-					CloudServiceId: testutil.TestCloudService1,
+					CloudServiceId: testdata.MockCloudServiceID,
 				},
 			},
 		},
@@ -382,7 +391,7 @@ func Test_regoEval_evalMap(t *testing.T) {
 				pkg:  DefaultRegoPackage,
 			},
 			args: args{
-				serviceID: testutil.TestCloudService1,
+				serviceID: testdata.MockCloudServiceID,
 				metricID:  "AutomaticUpdatesEnabled",
 				baseDir:   ".",
 				m: map[string]interface{}{
@@ -404,7 +413,7 @@ func Test_regoEval_evalMap(t *testing.T) {
 					IsDefault:      false,
 					UpdatedAt:      timestamppb.New(time.Date(2022, 12, 1, 0, 0, 0, 0, time.Local)),
 					MetricId:       "AutomaticUpdatesEnabled",
-					CloudServiceId: testutil.TestCloudService1,
+					CloudServiceId: testdata.MockCloudServiceID,
 				},
 			},
 		},
diff --git a/service/auth_middleware_test.go b/service/auth_middleware_test.go
index 0f1932bc..a5503030 100644
--- a/service/auth_middleware_test.go
+++ b/service/auth_middleware_test.go
@@ -30,6 +30,7 @@ import (
 	"fmt"
 	"testing"
 
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
 
 	oauth2 "github.com/oxisto/oauth2go"
@@ -52,7 +53,7 @@ func ValidClaimAssertion(tt assert.TestingT, i1 interface{}, _ ...interface{}) b
 		return false
 	}
 
-	if claims.Subject != testutil.TestAuthClientID {
+	if claims.Subject != testdata.MockAuthClientID {
 		tt.Errorf("Subject is not correct")
 		return true
 	}
@@ -73,7 +74,7 @@ func TestAuthConfig_AuthFunc(t *testing.T) {
 	defer authSrv.Close()
 
 	// Some pre-work to retrieve a valid token
-	token, err := authSrv.GenerateToken(testutil.TestAuthClientID, 0, 0)
+	token, err := authSrv.GenerateToken(testdata.MockAuthClientID, 0, 0)
 	assert.NoError(t, err)
 	assert.NotNil(t, token)
 
diff --git a/service/authz_test.go b/service/authz_test.go
index 83bff8bb..585c6574 100644
--- a/service/authz_test.go
+++ b/service/authz_test.go
@@ -33,9 +33,77 @@ import (
 	"clouditor.io/clouditor/api"
 	"clouditor.io/clouditor/api/discovery"
 	"clouditor.io/clouditor/api/orchestrator"
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
+	"github.com/golang-jwt/jwt/v4"
+	"google.golang.org/grpc/metadata"
 )
 
+const (
+	TestCustomClaims   = "cloudserviceid"
+	TestAllowAllClaims = "cladmin"
+)
+
+var (
+	// TestContextOnlyService1 is an incoming context with a JWT that only allows access to cloud service ID
+	// 11111111-1111-1111-1111-111111111111
+	TestContextOnlyService1 context.Context
+
+	// TestContextOnlyService1 is an incoming context with a JWT that allows access to all cloud services
+	TestContextAllowAll context.Context
+
+	// TestBrokenContext contains an invalid JWT
+	TestBrokenContext = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
+		"authorization": "bearer what",
+	}))
+
+	// TestClaimsOnlyService1 contains claims that authorize the user for the cloud service
+	// 11111111-1111-1111-1111-111111111111.
+	TestClaimsOnlyService1 = jwt.MapClaims{
+		"sub": "me",
+		"cloudserviceid": []string{
+			testdata.MockCloudServiceID,
+		},
+		"other": []int{1, 2},
+	}
+
+	// TestClaimsOnlyService1 contains claims that authorize the user for all cloud services.
+	TestClaimsAllowAll = jwt.MapClaims{
+		"sub":     "me",
+		"cladmin": true,
+	}
+)
+
+func init() {
+	var (
+		err   error
+		token *jwt.Token
+		t     string
+	)
+
+	// Create a new token instead of hard-coding one
+	token = jwt.NewWithClaims(jwt.SigningMethodHS256, &TestClaimsOnlyService1)
+	t, err = token.SignedString([]byte("mykey"))
+	if err != nil {
+		panic(err)
+	}
+
+	// Create a context containing our token
+	TestContextOnlyService1 = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
+		"authorization": "bearer " + t,
+	}))
+
+	token = jwt.NewWithClaims(jwt.SigningMethodHS256, &TestClaimsAllowAll)
+	t, err = token.SignedString([]byte("mykey"))
+	if err != nil {
+		panic(err)
+	}
+
+	// Create a context containing our token
+	TestContextAllowAll = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
+		"authorization": "bearer " + t,
+	}))
+}
+
 func TestAuthorizationStrategyAllowAll_CheckAccess(t *testing.T) {
 	type args struct {
 		ctx context.Context
@@ -121,24 +189,24 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		{
 			name: "valid context",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: true,
 		},
 		{
 			name: "valid context, allow all",
 			fields: fields{
-				AllowAllKey: testutil.TestAllowAllClaims,
+				AllowAllKey: TestAllowAllClaims,
 			},
 			args: args{
-				ctx: testutil.TestContextAllowAll,
+				ctx: TestContextAllowAll,
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: true,
 		},
@@ -148,9 +216,9 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 				CloudServicesKey: "sub",
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: false,
 		},
@@ -160,33 +228,33 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 				CloudServicesKey: "other",
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: false,
 		},
 		{
 			name: "missing token",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
 				ctx: context.Background(),
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: false,
 		},
 		{
 			name: "broken token",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
-				ctx: testutil.TestBrokenContext,
+				ctx: TestBrokenContext,
 				typ: AccessRead,
-				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			},
 			want: false,
 		},
@@ -223,21 +291,21 @@ func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
 		{
 			name: "valid context",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 			},
 			wantAll:  false,
-			wantList: []string{testutil.TestCloudService1},
+			wantList: []string{testdata.MockCloudServiceID},
 		},
 		{
 			name: "valid context, allow all",
 			fields: fields{
-				AllowAllKey: testutil.TestAllowAllClaims,
+				AllowAllKey: TestAllowAllClaims,
 			},
 			args: args{
-				ctx: testutil.TestContextAllowAll,
+				ctx: TestContextAllowAll,
 			},
 			wantAll:  true,
 			wantList: nil,
@@ -248,7 +316,7 @@ func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
 				CloudServicesKey: "sub",
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 			},
 			wantAll:  false,
 			wantList: nil,
@@ -259,7 +327,7 @@ func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
 				CloudServicesKey: "other",
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: TestContextOnlyService1,
 			},
 			wantAll:  false,
 			wantList: nil,
@@ -267,7 +335,7 @@ func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
 		{
 			name: "missing token",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -278,10 +346,10 @@ func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
 		{
 			name: "broken token",
 			fields: fields{
-				CloudServicesKey: testutil.TestCustomClaims,
+				CloudServicesKey: TestCustomClaims,
 			},
 			args: args{
-				ctx: testutil.TestBrokenContext,
+				ctx: TestBrokenContext,
 			},
 			wantAll:  false,
 			wantList: nil,
diff --git a/service/discovery/aws/compute_test.go b/service/discovery/aws/compute_test.go
index 71ce4337..76fa1256 100644
--- a/service/discovery/aws/compute_test.go
+++ b/service/discovery/aws/compute_test.go
@@ -34,8 +34,9 @@ import (
 	"time"
 
 	"clouditor.io/clouditor/api/discovery"
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
@@ -489,13 +490,13 @@ func TestComputeDiscovery_NewComputeDiscovery(t *testing.T) {
 		want discovery.Discoverer
 	}{
 		{
-			args: args{client: mockClient, csID: testutil.TestCloudService1},
+			args: args{client: mockClient, csID: testdata.MockCloudServiceID},
 			want: &computeDiscovery{
 				virtualMachineAPI: &ec2.Client{},
 				functionAPI:       &lambda.Client{},
 				isDiscovering:     true,
 				awsConfig:         mockClient,
-				csID:              testutil.TestCloudService1,
+				csID:              testdata.MockCloudServiceID,
 			},
 		},
 	}
diff --git a/service/discovery/azure/azure_test.go b/service/discovery/azure/azure_test.go
index 15bce1ee..6289daa3 100644
--- a/service/discovery/azure/azure_test.go
+++ b/service/discovery/azure/azure_test.go
@@ -35,7 +35,8 @@ import (
 	"net/http"
 	"testing"
 
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
+
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
@@ -324,7 +325,7 @@ func NewMockAzureDiscovery(transport policy.Transporter, opts ...DiscoveryOption
 				Transport: transport,
 			},
 		},
-		csID: testutil.TestCloudService1,
+		csID: testdata.MockCloudServiceID,
 	}
 
 	// Apply options
diff --git a/service/discovery/azure/compute_test.go b/service/discovery/azure/compute_test.go
index 07f676c5..8ab26f06 100644
--- a/service/discovery/azure/compute_test.go
+++ b/service/discovery/azure/compute_test.go
@@ -33,15 +33,14 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/appservice/armappservice/v2"
-
 	"clouditor.io/clouditor/api/discovery"
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/util"
 	"clouditor.io/clouditor/voc"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/appservice/armappservice/v2"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v3"
 	"github.com/stretchr/testify/assert"
 )
@@ -333,12 +332,12 @@ func TestNewAzureComputeDiscovery(t *testing.T) {
 		{
 			name: "With cloud service ID",
 			args: args{
-				opts: []DiscoveryOption{WithCloudServiceID(testutil.TestCloudService1)},
+				opts: []DiscoveryOption{WithCloudServiceID(testdata.MockCloudServiceID)},
 			},
 			want: &azureComputeDiscovery{
 				&azureDiscovery{
 					discovererComponent: ComputeComponent,
-					csID:                testutil.TestCloudService1,
+					csID:                testdata.MockCloudServiceID,
 				},
 			},
 		},
@@ -545,7 +544,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/disks/disk1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "disk1",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -567,7 +566,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/disks/disk2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "disk2",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -589,7 +588,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res2/providers/Microsoft.Compute/disks/anotherdisk",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "anotherdisk",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -611,7 +610,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm1",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							Type:         voc.VirtualMachineType,
@@ -649,7 +648,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm2",
 							CreationTime: util.SafeTimestamp(&time.Time{}),
 							Type:         voc.VirtualMachineType,
@@ -687,7 +686,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm3",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm3",
 							Type:         voc.VirtualMachineType,
 							CreationTime: util.SafeTimestamp(&time.Time{}),
@@ -725,7 +724,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Web/sites/function1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "function1",
 							CreationTime: util.SafeTimestamp(&time.Time{}),
 							Type:         voc.FunctionType,
@@ -753,7 +752,7 @@ func Test_azureComputeDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res2/providers/Microsoft.Compute/disks/anotherdisk",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "anotherdisk",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -823,7 +822,7 @@ func Test_azureComputeDiscovery_discoverFunctions(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Web/sites/function1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "function1",
 							CreationTime: util.SafeTimestamp(&time.Time{}),
 							Type:         []string{"Function", "Compute", "Resource"},
@@ -911,7 +910,7 @@ func Test_azureComputeDiscovery_handleFunction(t *testing.T) {
 				Compute: &voc.Compute{
 					Resource: &voc.Resource{
 						ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Web/sites/function1",
-						ServiceID:    testutil.TestCloudService1,
+						ServiceID:    testdata.MockCloudServiceID,
 						Name:         "function1",
 						CreationTime: util.SafeTimestamp(&time.Time{}),
 						Type:         []string{"Function", "Compute", "Resource"},
@@ -974,7 +973,7 @@ func Test_azureComputeDiscovery_discoverVirtualMachines(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm1",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							Type:         []string{"VirtualMachine", "Compute", "Resource"},
@@ -1012,7 +1011,7 @@ func Test_azureComputeDiscovery_discoverVirtualMachines(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm2",
 							CreationTime: util.SafeTimestamp(&time.Time{}),
 							Type:         []string{"VirtualMachine", "Compute", "Resource"},
@@ -1050,7 +1049,7 @@ func Test_azureComputeDiscovery_discoverVirtualMachines(t *testing.T) {
 					Compute: &voc.Compute{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm3",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "vm3",
 							Type:         []string{"VirtualMachine", "Compute", "Resource"},
 							CreationTime: util.SafeTimestamp(&time.Time{}),
@@ -1191,7 +1190,7 @@ func Test_azureComputeDiscovery_handleVirtualMachines(t *testing.T) {
 				Compute: &voc.Compute{
 					Resource: &voc.Resource{
 						ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/virtualMachines/vm1",
-						ServiceID:    testutil.TestCloudService1,
+						ServiceID:    testdata.MockCloudServiceID,
 						Name:         "vm1",
 						CreationTime: util.SafeTimestamp(&creationTime),
 						Type:         []string{"VirtualMachine", "Compute", "Resource"},
@@ -1455,7 +1454,7 @@ func Test_azureComputeDiscovery_discoverBlockStorage(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/disks/disk1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "disk1",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -1477,7 +1476,7 @@ func Test_azureComputeDiscovery_discoverBlockStorage(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Compute/disks/disk2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "disk2",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -1499,7 +1498,7 @@ func Test_azureComputeDiscovery_discoverBlockStorage(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res2/providers/Microsoft.Compute/disks/anotherdisk",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "anotherdisk",
 							CreationTime: util.SafeTimestamp(&creationTime),
 							GeoLocation: voc.GeoLocation{
@@ -1626,7 +1625,7 @@ func Test_azureComputeDiscovery_handleBlockStorage(t *testing.T) {
 				Storage: &voc.Storage{
 					Resource: &voc.Resource{
 						ID:           voc.ResourceID(diskID),
-						ServiceID:    testutil.TestCloudService1,
+						ServiceID:    testdata.MockCloudServiceID,
 						Name:         "disk1",
 						CreationTime: util.SafeTimestamp(&creationTime),
 						Type:         []string{"BlockStorage", "Storage", "Resource"},
diff --git a/service/discovery/azure/network_test.go b/service/discovery/azure/network_test.go
index bdc63743..42b895df 100644
--- a/service/discovery/azure/network_test.go
+++ b/service/discovery/azure/network_test.go
@@ -29,15 +29,14 @@ import (
 	"net/http"
 	"testing"
 
+	"clouditor.io/clouditor/api/discovery"
+	"clouditor.io/clouditor/internal/testdata"
+	"clouditor.io/clouditor/voc"
+
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork"
-
 	"github.com/stretchr/testify/assert"
-
-	"clouditor.io/clouditor/api/discovery"
-	"clouditor.io/clouditor/internal/testutil"
-	"clouditor.io/clouditor/voc"
 )
 
 type mockNetworkSender struct {
@@ -253,7 +252,7 @@ func Test_azureNetworkDiscovery_List(t *testing.T) {
 					Networking: &voc.Networking{
 						Resource: &voc.Resource{
 							ID:        "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Network/networkInterfaces/iface1",
-							ServiceID: testutil.TestCloudService1,
+							ServiceID: testdata.MockCloudServiceID,
 							Name:      "iface1",
 							GeoLocation: voc.GeoLocation{
 								Region: "eastus",
@@ -269,7 +268,7 @@ func Test_azureNetworkDiscovery_List(t *testing.T) {
 						Networking: &voc.Networking{
 							Resource: &voc.Resource{
 								ID:        "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Network/loadBalancers/lb1",
-								ServiceID: testutil.TestCloudService1,
+								ServiceID: testdata.MockCloudServiceID,
 								Name:      "lb1",
 								GeoLocation: voc.GeoLocation{
 									Region: "eastus",
@@ -289,7 +288,7 @@ func Test_azureNetworkDiscovery_List(t *testing.T) {
 						Networking: &voc.Networking{
 							Resource: &voc.Resource{
 								ID:        "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Network/loadBalancers/lb2",
-								ServiceID: testutil.TestCloudService1,
+								ServiceID: testdata.MockCloudServiceID,
 								Name:      "lb2",
 								GeoLocation: voc.GeoLocation{
 									Region: "eastus",
@@ -309,7 +308,7 @@ func Test_azureNetworkDiscovery_List(t *testing.T) {
 						Networking: &voc.Networking{
 							Resource: &voc.Resource{
 								ID:        "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Network/loadBalancers/lb3",
-								ServiceID: testutil.TestCloudService1,
+								ServiceID: testdata.MockCloudServiceID,
 								Name:      "lb3",
 								GeoLocation: voc.GeoLocation{
 									Region: "eastus",
diff --git a/service/discovery/azure/storage_test.go b/service/discovery/azure/storage_test.go
index b4c1ab40..00543a89 100644
--- a/service/discovery/azure/storage_test.go
+++ b/service/discovery/azure/storage_test.go
@@ -33,9 +33,10 @@ import (
 	"time"
 
 	"clouditor.io/clouditor/api/discovery"
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/util"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage"
@@ -357,7 +358,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/blobServices/default/containers/container1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container1",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -380,7 +381,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/blobServices/default/containers/container2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container2",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -403,7 +404,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/fileServices/default/shares/fileshare1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "fileshare1",
 							Type:         voc.FileStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -424,7 +425,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/fileServices/default/shares/fileshare2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "fileshare2",
 							Type:         voc.FileStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -453,7 +454,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 							Networking: &voc.Networking{
 								Resource: &voc.Resource{
 									ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1",
-									ServiceID:    testutil.TestCloudService1,
+									ServiceID:    testdata.MockCloudServiceID,
 									Name:         "account1",
 									Type:         voc.ObjectStorageServiceType,
 									CreationTime: util.SafeTimestamp(&creationTime),
@@ -485,7 +486,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account2/blobServices/default/containers/container3",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container3",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -509,7 +510,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account2/blobServices/default/containers/container4",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container4",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -539,7 +540,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 							Networking: &voc.Networking{
 								Resource: &voc.Resource{
 									ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account2",
-									ServiceID:    testutil.TestCloudService1,
+									ServiceID:    testdata.MockCloudServiceID,
 									Name:         "account2",
 									Type:         voc.ObjectStorageServiceType,
 									CreationTime: util.SafeTimestamp(&creationTime),
@@ -587,7 +588,7 @@ func Test_azureStorageDiscovery_List(t *testing.T) {
 }
 
 func TestStorageHandleMethodsWhenInputIsInvalid(t *testing.T) {
-	d := azureStorageDiscovery{&azureDiscovery{csID: testutil.TestCloudService1}}
+	d := azureStorageDiscovery{&azureDiscovery{csID: testdata.MockCloudServiceID}}
 
 	// Get mocked armstorage.Account
 	reqURL := "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Storage/storageAccounts/account3"
@@ -912,7 +913,7 @@ func Test_handleFileStorage(t *testing.T) {
 				Storage: &voc.Storage{
 					Resource: &voc.Resource{
 						ID:           voc.ResourceID(fileShareID),
-						ServiceID:    testutil.TestCloudService1,
+						ServiceID:    testdata.MockCloudServiceID,
 						Name:         fileShareName,
 						CreationTime: util.SafeTimestamp(&creationTime),
 						GeoLocation: voc.GeoLocation{
@@ -1035,7 +1036,7 @@ func Test_azureStorageDiscovery_handleStorageAccount(t *testing.T) {
 						Networking: &voc.Networking{
 							Resource: &voc.Resource{
 								ID:           voc.ResourceID(accountID),
-								ServiceID:    testutil.TestCloudService1,
+								ServiceID:    testdata.MockCloudServiceID,
 								Name:         accountName,
 								CreationTime: util.SafeTimestamp(&creationTime),
 								Type:         voc.ObjectStorageServiceType,
@@ -1166,7 +1167,7 @@ func Test_handleObjectStorage(t *testing.T) {
 				Storage: &voc.Storage{
 					Resource: &voc.Resource{
 						ID:           voc.ResourceID(containerID),
-						ServiceID:    testutil.TestCloudService1,
+						ServiceID:    testdata.MockCloudServiceID,
 						Name:         containerName,
 						CreationTime: util.SafeTimestamp(&creationTime),
 						GeoLocation: voc.GeoLocation{
@@ -1263,7 +1264,7 @@ func Test_azureStorageDiscovery_discoverFileStorages(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/fileServices/default/shares/fileshare1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "fileshare1",
 							Type:         voc.FileStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -1284,7 +1285,7 @@ func Test_azureStorageDiscovery_discoverFileStorages(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/fileServices/default/shares/fileshare2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "fileshare2",
 							Type:         voc.FileStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -1382,7 +1383,7 @@ func Test_azureStorageDiscovery_discoverObjectStorages(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/blobServices/default/containers/container1",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container1",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
@@ -1405,7 +1406,7 @@ func Test_azureStorageDiscovery_discoverObjectStorages(t *testing.T) {
 					Storage: &voc.Storage{
 						Resource: &voc.Resource{
 							ID:           "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/res1/providers/Microsoft.Storage/storageAccounts/account1/blobServices/default/containers/container2",
-							ServiceID:    testutil.TestCloudService1,
+							ServiceID:    testdata.MockCloudServiceID,
 							Name:         "container2",
 							Type:         voc.ObjectStorageType,
 							CreationTime: util.SafeTimestamp(&creationTime),
diff --git a/service/discovery/discovery_test.go b/service/discovery/discovery_test.go
index b7a2badb..c6b59e5f 100644
--- a/service/discovery/discovery_test.go
+++ b/service/discovery/discovery_test.go
@@ -39,7 +39,7 @@ import (
 	"clouditor.io/clouditor/api/assessment"
 	"clouditor.io/clouditor/api/discovery"
 	"clouditor.io/clouditor/api/evidence"
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil/clitest"
 	"clouditor.io/clouditor/internal/util"
 	"clouditor.io/clouditor/voc"
@@ -87,13 +87,13 @@ func TestNewService(t *testing.T) {
 			name: "Create service with option 'WithDefaultCloudServiceID'",
 			args: args{
 				opts: []ServiceOption{
-					WithCloudServiceID(testutil.TestCloudService1),
+					WithCloudServiceID(testdata.MockCloudServiceID),
 				},
 			},
 			want: &Service{
 				assessmentAddress: grpcTarget{target: DefaultAssessmentAddress},
 				configurations:    make(map[discovery.Discoverer]*Configuration),
-				csID:              testutil.TestCloudService1,
+				csID:              testdata.MockCloudServiceID,
 			},
 		},
 	}
@@ -168,7 +168,7 @@ func TestService_StartDiscovery(t *testing.T) {
 			name: "No err with custom cloud service ID",
 			fields: fields{
 				discoverer: mockDiscoverer{testCase: 2},
-				csID:       testutil.TestCloudService1,
+				csID:       testdata.MockCloudServiceID,
 			},
 			checkEvidence: true,
 		},
@@ -453,7 +453,7 @@ func (m mockDiscoverer) List() ([]voc.IsCloudResource, error) {
 }
 
 func (mockDiscoverer) CloudServiceID() string {
-	return testutil.TestCloudService1
+	return testdata.MockCloudServiceID
 }
 
 func wrongFormattedResource() voc.IsCloudResource {
diff --git a/service/discovery/k8s/compute_test.go b/service/discovery/k8s/compute_test.go
index a67aa709..9063c2c5 100644
--- a/service/discovery/k8s/compute_test.go
+++ b/service/discovery/k8s/compute_test.go
@@ -29,8 +29,9 @@ import (
 	"context"
 	"testing"
 
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/stretchr/testify/assert"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -75,7 +76,7 @@ func TestListPods(t *testing.T) {
 		t.Fatalf("error injecting pod add: %v", err)
 	}
 
-	d := NewKubernetesComputeDiscovery(client, testutil.TestCloudService1)
+	d := NewKubernetesComputeDiscovery(client, testdata.MockCloudServiceID)
 
 	list, err := d.List()
 
@@ -90,7 +91,7 @@ func TestListPods(t *testing.T) {
 		Compute: &voc.Compute{
 			Resource: &voc.Resource{
 				ID:           voc.ResourceID(podID),
-				ServiceID:    testutil.TestCloudService1,
+				ServiceID:    testdata.MockCloudServiceID,
 				Name:         podName,
 				CreationTime: podCreationTime.Unix(),
 				Type:         []string{"Container", "Compute", "Resource"},
@@ -112,7 +113,7 @@ func TestListPods(t *testing.T) {
 		Storage: &voc.Storage{
 			Resource: &voc.Resource{
 				ID:           voc.ResourceID(volumeName),
-				ServiceID:    testutil.TestCloudService1,
+				ServiceID:    testdata.MockCloudServiceID,
 				Name:         volumeName,
 				CreationTime: 0,
 				Type:         []string{"BlockStorage", "Storage", "Resource"},
diff --git a/service/discovery/k8s/network_test.go b/service/discovery/k8s/network_test.go
index dbef3cf1..912b578f 100644
--- a/service/discovery/k8s/network_test.go
+++ b/service/discovery/k8s/network_test.go
@@ -29,8 +29,9 @@ import (
 	"context"
 	"testing"
 
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
@@ -87,7 +88,7 @@ func TestListIngresses(t *testing.T) {
 		t.Fatalf("error injecting service add: %v", err)
 	}
 
-	d := NewKubernetesNetworkDiscovery(client, testutil.TestCloudService1)
+	d := NewKubernetesNetworkDiscovery(client, testdata.MockCloudServiceID)
 
 	list, err := d.List()
 
diff --git a/service/discovery/k8s/storage_test.go b/service/discovery/k8s/storage_test.go
index 9ffb7cd5..5a097b32 100644
--- a/service/discovery/k8s/storage_test.go
+++ b/service/discovery/k8s/storage_test.go
@@ -29,8 +29,9 @@ import (
 	"context"
 	"testing"
 
-	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/voc"
+
 	"github.com/stretchr/testify/assert"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -72,7 +73,7 @@ func Test_k8sStorageDiscovery_List(t *testing.T) {
 		t.Fatalf("error injecting volume add: %v", err)
 	}
 
-	d := NewKubernetesStorageDiscovery(client, testutil.TestCloudService1)
+	d := NewKubernetesStorageDiscovery(client, testdata.MockCloudServiceID)
 
 	list, err := d.List()
 	assert.NoError(t, err)
@@ -86,7 +87,7 @@ func Test_k8sStorageDiscovery_List(t *testing.T) {
 		Storage: &voc.Storage{
 			Resource: &voc.Resource{
 				ID:           voc.ResourceID(volumeUID),
-				ServiceID:    testutil.TestCloudService1,
+				ServiceID:    testdata.MockCloudServiceID,
 				Name:         volumeName,
 				CreationTime: volume.CreationTime,
 				Type:         []string{"BlockStorage", "Storage", "Resource"},
diff --git a/service/evidence/evidence_store_test.go b/service/evidence/evidence_store_test.go
index b546683c..dcd1ac2c 100644
--- a/service/evidence/evidence_store_test.go
+++ b/service/evidence/evidence_store_test.go
@@ -316,7 +316,7 @@ func TestService_ListEvidences(t *testing.T) {
 		{
 			name: "Successful Filter Of Evidences (with allowed cloud service)",
 			fields: fields{
-				authz: servicetest.NewAuthorizationStrategy(false, []string{evidencetest.MockEvidence1.CloudServiceId}),
+				authz: servicetest.NewAuthorizationStrategy(false, evidencetest.MockEvidence1.CloudServiceId),
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence1))
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence2))
@@ -342,7 +342,7 @@ func TestService_ListEvidences(t *testing.T) {
 		{
 			name: "Only Cloud_Service_Id filter applied, when Tool_Id filter off",
 			fields: fields{
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence1))
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence2))
@@ -378,7 +378,7 @@ func TestService_ListEvidences(t *testing.T) {
 		{
 			name: "Only Tool_Id filter applied, when Cloud_Service_Id filter off",
 			fields: fields{
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence1))
 					assert.NoError(t, s.Create(&evidencetest.MockEvidence2))
@@ -415,7 +415,7 @@ func TestService_ListEvidences(t *testing.T) {
 		{
 			name: "Permission denied (cloud service id not allowed)",
 			fields: fields{
-				authz: servicetest.NewAuthorizationStrategy(false, []string{testdata.MockCloudServiceID}), // allow only MockCloudServiceID
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID), // allow only MockCloudServiceID
 			},
 			args: args{
 				in0: context.TODO(),
@@ -484,7 +484,7 @@ func TestService_ListEvidences(t *testing.T) {
 		{
 			name: "DB (pagination) error",
 			fields: fields{
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 				}),
@@ -815,10 +815,10 @@ func TestService_GetEvidence(t *testing.T) {
 						Timestamp:      timestamppb.Now(),
 					}))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &evidence.GetEvidenceRequest{
 					EvidenceId: testdata.MockEvidenceID,
 				},
@@ -841,7 +841,7 @@ func TestService_GetEvidence(t *testing.T) {
 						Timestamp:      timestamppb.Now(),
 					}))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &evidence.GetEvidenceRequest{
@@ -858,7 +858,7 @@ func TestService_GetEvidence(t *testing.T) {
 			name: "invalid UUID",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &evidence.GetEvidenceRequest{
@@ -875,7 +875,7 @@ func TestService_GetEvidence(t *testing.T) {
 			name: "evidence not found",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &evidence.GetEvidenceRequest{
diff --git a/service/orchestrator/assessment_results_test.go b/service/orchestrator/assessment_results_test.go
index 15162d58..144e8090 100644
--- a/service/orchestrator/assessment_results_test.go
+++ b/service/orchestrator/assessment_results_test.go
@@ -89,11 +89,11 @@ func TestService_GetAssessmentResult(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult3))
 				}),
-				authz: servicetest.NewAuthorizationStrategy(false, []string{orchestratortest.MockAssessmentResult1.CloudServiceId}),
+				authz: servicetest.NewAuthorizationStrategy(false, orchestratortest.MockAssessmentResult1.CloudServiceId),
 			},
 			args: args{
 				req: orchestratortest.MockAssessmentResultRequest2,
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 			},
 			res: nil,
 			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
@@ -107,10 +107,10 @@ func TestService_GetAssessmentResult(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult3))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: orchestratortest.MockAssessmentResultRequest1,
 			},
 			res: nil,
@@ -123,7 +123,7 @@ func TestService_GetAssessmentResult(t *testing.T) {
 			name: "database error handling",
 			fields: fields{
 				storage: &testutil.StorageWithError{GetErr: ErrSomeError},
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: orchestratortest.MockAssessmentResultRequest1},
 			res:  nil,
@@ -140,7 +140,7 @@ func TestService_GetAssessmentResult(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult3))
 				}),
-				authz: servicetest.NewAuthorizationStrategy(true, nil),
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: orchestratortest.MockAssessmentResultRequest1,
@@ -156,7 +156,7 @@ func TestService_GetAssessmentResult(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult3))
 				}),
-				authz: servicetest.NewAuthorizationStrategy(false, []string{orchestratortest.MockAssessmentResult1.CloudServiceId}),
+				authz: servicetest.NewAuthorizationStrategy(false, orchestratortest.MockAssessmentResult1.CloudServiceId),
 			},
 			args: args{
 				req: orchestratortest.MockAssessmentResultRequest1,
@@ -205,7 +205,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 			name: "request is missing",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args:    args{},
 			wantRes: nil,
@@ -217,7 +217,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 			name: "request is empty",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.ListAssessmentResultsRequest{},
@@ -234,7 +234,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.ListAssessmentResultsRequest{}},
 			wantRes: &orchestrator.ListAssessmentResultsResponse{
@@ -252,10 +252,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{},
 			},
 			wantRes: &orchestrator.ListAssessmentResultsResponse{
@@ -272,10 +272,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockAnotherCloudServiceID),
@@ -294,10 +294,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockCloudServiceID),
@@ -317,10 +317,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockCloudServiceID),
@@ -341,10 +341,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockCloudServiceID),
@@ -365,10 +365,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						Compliant: util.Ref(true),
@@ -390,10 +390,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						Compliant: util.Ref(false),
@@ -414,10 +414,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockCloudServiceID),
@@ -439,10 +439,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref(testdata.MockCloudServiceID),
@@ -464,10 +464,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						MetricIds: []string{testdata.MockMetricID},
@@ -488,10 +488,10 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListAssessmentResultsRequest{
 					Filter: &orchestrator.Filter{
 						CloudServiceId: util.Ref("No Valid UUID"),
@@ -509,7 +509,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.ListAssessmentResultsRequest{
@@ -531,7 +531,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.ListAssessmentResultsRequest{
diff --git a/service/orchestrator/cloud_service_test.go b/service/orchestrator/cloud_service_test.go
index 220ba787..80a9a5b6 100644
--- a/service/orchestrator/cloud_service_test.go
+++ b/service/orchestrator/cloud_service_test.go
@@ -34,6 +34,7 @@ import (
 	"clouditor.io/clouditor/api/orchestrator"
 	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testutil/servicetest"
 	"clouditor.io/clouditor/persistence"
 	"clouditor.io/clouditor/service"
 	"github.com/stretchr/testify/assert"
@@ -159,8 +160,8 @@ func TestService_GetCloudService(t *testing.T) {
 		},
 		{
 			name: "permission denied",
-			svc:  NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims)),
-			ctx:  testutil.TestContextOnlyService1,
+			svc:  NewService(WithAuthorizationStrategy(servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID))),
+			ctx:  context.TODO(),
 			req:  &orchestrator.GetCloudServiceRequest{CloudServiceId: DefaultTargetCloudServiceId},
 			res:  nil,
 			wantErr: func(tt assert.TestingT, err error, i ...interface{}) bool {
@@ -170,16 +171,16 @@ func TestService_GetCloudService(t *testing.T) {
 		},
 		{
 			name: "permission granted",
-			svc: NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims), WithStorage(testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
+			svc: NewService(WithAuthorizationStrategy(servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID)), WithStorage(testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 				_ = s.Create(&orchestrator.CloudService{
-					Id:   testutil.TestCloudService1,
+					Id:   testdata.MockCloudServiceID,
 					Name: "service1",
 				})
 			}))),
-			ctx: testutil.TestContextOnlyService1,
-			req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+			ctx: context.TODO(),
+			req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testdata.MockCloudServiceID},
 			res: &orchestrator.CloudService{
-				Id:   testutil.TestCloudService1,
+				Id:   testdata.MockCloudServiceID,
 				Name: "service1",
 			},
 			wantErr: assert.NoError,
@@ -210,22 +211,22 @@ func TestService_UpdateCloudService(t *testing.T) {
 		cloudService *orchestrator.CloudService
 		err          error
 	)
-	orchestratorService := NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims))
+	orchestratorService := NewService(WithAuthorizationStrategy(servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID)))
 
 	// 1st case: Service is nil
-	_, err = orchestratorService.UpdateCloudService(testutil.TestContextOnlyService1, &orchestrator.UpdateCloudServiceRequest{})
+	_, err = orchestratorService.UpdateCloudService(context.TODO(), &orchestrator.UpdateCloudServiceRequest{})
 	assert.Equal(t, codes.InvalidArgument, status.Code(err))
 
 	// 2nd case: Service ID is nil
-	_, err = orchestratorService.UpdateCloudService(testutil.TestContextOnlyService1, &orchestrator.UpdateCloudServiceRequest{
+	_, err = orchestratorService.UpdateCloudService(context.TODO(), &orchestrator.UpdateCloudServiceRequest{
 		CloudService: &orchestrator.CloudService{},
 	})
 	assert.Equal(t, codes.InvalidArgument, status.Code(err))
 
 	// 3rd case: Service not found since there are no services yet
-	_, err = orchestratorService.UpdateCloudService(testutil.TestContextOnlyService1, &orchestrator.UpdateCloudServiceRequest{
+	_, err = orchestratorService.UpdateCloudService(context.TODO(), &orchestrator.UpdateCloudServiceRequest{
 		CloudService: &orchestrator.CloudService{
-			Id:          testutil.TestCloudService1,
+			Id:          testdata.MockCloudServiceID,
 			Name:        DefaultTargetCloudServiceName,
 			Description: DefaultTargetCloudServiceDescription,
 		},
@@ -234,7 +235,7 @@ func TestService_UpdateCloudService(t *testing.T) {
 
 	// 4th case: Service updated successfully
 	err = orchestratorService.storage.Create(&orchestrator.CloudService{
-		Id:          testutil.TestCloudService1,
+		Id:          testdata.MockCloudServiceID,
 		Name:        DefaultTargetCloudServiceName,
 		Description: DefaultTargetCloudServiceDescription,
 	})
@@ -242,9 +243,9 @@ func TestService_UpdateCloudService(t *testing.T) {
 	if err != nil {
 		return
 	}
-	cloudService, err = orchestratorService.UpdateCloudService(testutil.TestContextOnlyService1, &orchestrator.UpdateCloudServiceRequest{
+	cloudService, err = orchestratorService.UpdateCloudService(context.TODO(), &orchestrator.UpdateCloudServiceRequest{
 		CloudService: &orchestrator.CloudService{
-			Id:          testutil.TestCloudService1,
+			Id:          testdata.MockCloudServiceID,
 			Name:        "NewName",
 			Description: "",
 		},
@@ -349,7 +350,7 @@ func TestService_ListCloudServices(t *testing.T) {
 			args: args{req: &orchestrator.ListCloudServicesRequest{}},
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			wantRes: &orchestrator.ListCloudServicesResponse{},
 			wantErr: assert.NoError,
@@ -367,7 +368,7 @@ func TestService_ListCloudServices(t *testing.T) {
 
 					_ = s.Create(service)
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			wantRes: &orchestrator.ListCloudServicesResponse{
 				Services: []*orchestrator.CloudService{
@@ -394,10 +395,10 @@ func TestService_ListCloudServices(t *testing.T) {
 						Name: testdata.MockCloudServiceName,
 					})
 				}),
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
+				ctx: context.TODO(),
 				req: &orchestrator.ListCloudServicesRequest{},
 			},
 			wantRes: &orchestrator.ListCloudServicesResponse{
diff --git a/service/orchestrator/metrics_test.go b/service/orchestrator/metrics_test.go
index 1366b239..868d51ce 100644
--- a/service/orchestrator/metrics_test.go
+++ b/service/orchestrator/metrics_test.go
@@ -43,6 +43,7 @@ import (
 	"clouditor.io/clouditor/api/orchestrator"
 	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testutil/servicetest"
 	"clouditor.io/clouditor/persistence"
 	"clouditor.io/clouditor/persistence/gorm"
 	"clouditor.io/clouditor/service"
@@ -768,7 +769,7 @@ func TestService_GetMetricConfiguration(t *testing.T) {
 						TargetValue:    &structpb.Value{Kind: &structpb.Value_StringValue{StringValue: "1111"}},
 					})
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.GetMetricConfigurationRequest{
@@ -804,7 +805,7 @@ func TestService_GetMetricConfiguration(t *testing.T) {
 			name: "metric not found",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.GetMetricConfigurationRequest{
@@ -867,7 +868,7 @@ func TestService_ListMetricConfigurations(t *testing.T) {
 			name: "error",
 			fields: fields{
 				storage: &testutil.StorageWithError{ListErr: ErrSomeError},
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.ListMetricConfigurationRequest{},
@@ -888,7 +889,7 @@ func TestService_ListMetricConfigurations(t *testing.T) {
 						Operator:       "==",
 					})
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.ListMetricConfigurationRequest{
@@ -959,7 +960,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "metricId is missing in request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -981,7 +982,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "cloudServiceID is missing in request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1003,7 +1004,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "cloudServiceID is invalid in request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1026,7 +1027,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "configuration is missing in request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1043,7 +1044,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "metricId is missing in configuration",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1065,7 +1066,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "cloudServiceId is missing in configuration",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1087,7 +1088,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "cloudServiceId is invalid in configuration",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1110,7 +1111,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 			name: "metric does not exist in storage",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1135,7 +1136,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					_ = s.Create(&assessment.Metric{Id: testdata.MockMetricID})
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1161,7 +1162,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 					_ = s.Create(&assessment.Metric{Id: testdata.MockMetricID})
 					_ = s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID})
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
@@ -1202,7 +1203,7 @@ func TestService_UpdateMetricConfiguration(t *testing.T) {
 						Operator:       ">",
 					})
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				req: &orchestrator.UpdateMetricConfigurationRequest{
diff --git a/service/orchestrator/orchestrator_test.go b/service/orchestrator/orchestrator_test.go
index a928c86e..3e9886de 100644
--- a/service/orchestrator/orchestrator_test.go
+++ b/service/orchestrator/orchestrator_test.go
@@ -44,6 +44,7 @@ import (
 	"clouditor.io/clouditor/internal/testutil/servicetest/orchestratortest"
 	"clouditor.io/clouditor/persistence"
 	"clouditor.io/clouditor/persistence/inmemory"
+	"clouditor.io/clouditor/service"
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -94,12 +95,12 @@ func TestNewService(t *testing.T) {
 				opts: []ServiceOption{WithStorage(myStorage)},
 			},
 			want: func(tt assert.TestingT, i1 interface{}, i2 ...interface{}) bool {
-				service, ok := i1.(*Service)
+				s, ok := i1.(*Service)
 				if !assert.True(tt, ok) {
 					return false
 				}
 
-				return assert.Equal(tt, myStorage, service.storage)
+				return assert.Equal(tt, myStorage, s.storage)
 			},
 		},
 		{
@@ -108,12 +109,12 @@ func TestNewService(t *testing.T) {
 				opts: []ServiceOption{WithCatalogsFile("catalogsfile.json")},
 			},
 			want: func(tt assert.TestingT, i1 interface{}, i2 ...interface{}) bool {
-				service, ok := i1.(*Service)
+				s, ok := i1.(*Service)
 				if !assert.True(tt, ok) {
 					return false
 				}
 
-				return assert.Equal(tt, "catalogsfile.json", service.catalogsFile)
+				return assert.Equal(tt, "catalogsfile.json", s.catalogsFile)
 			},
 		},
 		{
@@ -122,12 +123,26 @@ func TestNewService(t *testing.T) {
 				opts: []ServiceOption{WithMetricsFile("metricsfile.json")},
 			},
 			want: func(tt assert.TestingT, i1 interface{}, i2 ...interface{}) bool {
-				service, ok := i1.(*Service)
+				s, ok := i1.(*Service)
 				if !assert.True(tt, ok) {
 					return false
 				}
 
-				return assert.Equal(tt, "metricsfile.json", service.metricsFile)
+				return assert.Equal(tt, "metricsfile.json", s.metricsFile)
+			},
+		},
+		{
+			name: "New service with authorization strategy",
+			args: args{
+				opts: []ServiceOption{WithAuthorizationStrategy(&service.AuthorizationStrategyAllowAll{})},
+			},
+			want: func(tt assert.TestingT, i1 interface{}, i2 ...interface{}) bool {
+				s, ok := i1.(*Service)
+				if !assert.True(tt, ok) {
+					return false
+				}
+
+				return assert.Equal(tt, &service.AuthorizationStrategyAllowAll{}, s.authz)
 			},
 		},
 	}
diff --git a/service/orchestrator/toe_test.go b/service/orchestrator/toe_test.go
index 6d0364a1..5a33e47c 100644
--- a/service/orchestrator/toe_test.go
+++ b/service/orchestrator/toe_test.go
@@ -37,6 +37,7 @@ import (
 	"clouditor.io/clouditor/api/orchestrator"
 	"clouditor.io/clouditor/internal/testdata"
 	"clouditor.io/clouditor/internal/testutil"
+	"clouditor.io/clouditor/internal/testutil/servicetest"
 	"clouditor.io/clouditor/internal/testutil/servicetest/orchestratortest"
 	"clouditor.io/clouditor/persistence"
 	"clouditor.io/clouditor/persistence/gorm"
@@ -90,7 +91,7 @@ func TestService_CreateTargetOfEvaluation(t *testing.T) {
 			name: "Error getting catalog",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {}),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.CreateTargetOfEvaluationRequest{
 				TargetOfEvaluation: orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic),
@@ -111,7 +112,7 @@ func TestService_CreateTargetOfEvaluation(t *testing.T) {
 					err = s.Create(catalogWithoutAssuranceLevelList)
 					assert.NoError(t, err)
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.CreateTargetOfEvaluationRequest{
 				TargetOfEvaluation: orchestratortest.NewTargetOfEvaluation(""),
@@ -150,7 +151,7 @@ func TestService_CreateTargetOfEvaluation(t *testing.T) {
 					err = s.Create(orchestratortest.NewCatalog())
 					assert.NoError(t, err)
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.CreateTargetOfEvaluationRequest{
 				TargetOfEvaluation: orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic),
@@ -226,7 +227,7 @@ func TestService_GetTargetOfEvaluation(t *testing.T) {
 			name: "empty request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args:         args{req: nil},
 			wantResponse: assert.Nil,
@@ -239,7 +240,7 @@ func TestService_GetTargetOfEvaluation(t *testing.T) {
 			name: "invalid request",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.GetTargetOfEvaluationRequest{
 				CloudServiceId: "",
@@ -263,10 +264,10 @@ func TestService_GetTargetOfEvaluation(t *testing.T) {
 					err = s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic))
 					assert.NoError(t, err)
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.GetTargetOfEvaluationRequest{
-				CloudServiceId: testutil.TestCloudService2,
+				CloudServiceId: testdata.MockAnotherCloudServiceID,
 				CatalogId:      testdata.MockCatalogID,
 			}},
 			wantResponse: assert.Nil,
@@ -288,7 +289,7 @@ func TestService_GetTargetOfEvaluation(t *testing.T) {
 					err = s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic))
 					assert.NoError(t, err)
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{req: &orchestrator.GetTargetOfEvaluationRequest{
 				CloudServiceId: testdata.MockCloudServiceID,
@@ -607,7 +608,7 @@ func TestService_ListControlsInScope(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID}))
 					assert.NoError(t, s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic)))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				ctx: context.TODO(),
@@ -660,7 +661,7 @@ func TestService_ListControlsInScope(t *testing.T) {
 						TargetOfEvaluationCatalogId:      testdata.MockCatalogID,
 					}))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				ctx: context.TODO(),
@@ -694,12 +695,11 @@ func TestService_ListControlsInScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				ctx: testutil.TestContextOnlyService1,
 				req: &orchestrator.ListControlsInScopeRequest{
-					CloudServiceId: testutil.TestCloudService2,
+					CloudServiceId: testdata.MockAnotherCloudServiceID,
 					CatalogId:      testdata.MockCatalogID,
 				},
 			},
@@ -759,7 +759,7 @@ func TestService_AddControlToScope(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID}))
 					assert.NoError(t, s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic)))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -782,7 +782,7 @@ func TestService_AddControlToScope(t *testing.T) {
 			name: "ToE not found",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -809,7 +809,7 @@ func TestService_AddControlToScope(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID}))
 					assert.NoError(t, s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic)))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -837,13 +837,13 @@ func TestService_AddControlToScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				in0: testutil.TestContextOnlyService1,
+				in0: context.TODO(),
 				req: &orchestrator.AddControlToScopeRequest{
 					Scope: &orchestrator.ControlInScope{
-						TargetOfEvaluationCloudServiceId: testutil.TestCloudService2,
+						TargetOfEvaluationCloudServiceId: testdata.MockAnotherCloudServiceID,
 						ControlId:                        testdata.MockControlID1,
 						ControlCategoryName:              testdata.MockCategoryName,
 						ControlCategoryCatalogId:         testdata.MockCatalogID,
@@ -907,7 +907,7 @@ func TestService_UpdateControlInScope(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID}))
 					assert.NoError(t, s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic)))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -936,7 +936,7 @@ func TestService_UpdateControlInScope(t *testing.T) {
 			name: "ToE not found",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -958,13 +958,13 @@ func TestService_UpdateControlInScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				in0: testutil.TestContextOnlyService1,
+				in0: context.TODO(),
 				req: &orchestrator.UpdateControlInScopeRequest{
 					Scope: &orchestrator.ControlInScope{
-						TargetOfEvaluationCloudServiceId: testutil.TestCloudService2,
+						TargetOfEvaluationCloudServiceId: testdata.MockAnotherCloudServiceID,
 						ControlId:                        testdata.MockControlID1,
 						ControlCategoryName:              testdata.MockCategoryName,
 						ControlCategoryCatalogId:         testdata.MockCatalogID,
@@ -1027,7 +1027,7 @@ func TestService_RemoveControlFromScope(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestrator.CloudService{Id: testdata.MockCloudServiceID}))
 					assert.NoError(t, s.Create(orchestratortest.NewTargetOfEvaluation(testdata.AssuranceLevelBasic)))
 				}),
-				authz: &service.AuthorizationStrategyAllowAll{},
+				authz: servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -1044,7 +1044,7 @@ func TestService_RemoveControlFromScope(t *testing.T) {
 			name: "ToE not found",
 			fields: fields{
 				storage: testutil.NewInMemoryStorage(t),
-				authz:   &service.AuthorizationStrategyAllowAll{},
+				authz:   servicetest.NewAuthorizationStrategy(true),
 			},
 			args: args{
 				in0: context.TODO(),
@@ -1062,12 +1062,12 @@ func TestService_RemoveControlFromScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
+				authz: servicetest.NewAuthorizationStrategy(false, testdata.MockCloudServiceID),
 			},
 			args: args{
-				in0: testutil.TestContextOnlyService1,
+				in0: context.TODO(),
 				req: &orchestrator.RemoveControlFromScopeRequest{
-					CloudServiceId:      testutil.TestCloudService2,
+					CloudServiceId:      testdata.MockAnotherCloudServiceID,
 					ControlId:           testdata.MockControlID1,
 					ControlCategoryName: testdata.MockCategoryName,
 					CatalogId:           testdata.MockCatalogID,