cmonson_2ndwatch_awspec 0.85.3

data/lib/awspec/generator/spec/route53_hosted_zone.rb

@@ -0,0 +1,52 @@
+module Awspec::Generator
+  module Spec
+    class Route53HostedZone
+      include Awspec::Helper::Finder
+      def generate_by_domain_name(id)
+        hosted_zone = find_hosted_zone(id)
+        raise 'Not Found Route53 Hosted Zone' unless hosted_zone
+        id = hosted_zone[:id]
+        res = @route53_client.list_resource_record_sets({
+                                                          hosted_zone_id: id
+                                                        })
+        resource_record_sets = res.resource_record_sets.map do |record_set|
+          generate_linespec(record_set)
+        end
+
+        content = ERB.new(route53_hosted_zone_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+      end
+
+      def generate_linespec(record_set)
+        name = record_set.name.gsub(/\\052/, '*') # wildcard support
+        if !record_set.resource_records.empty?
+          template = <<-'EOF'
+it { should have_record_set('<%= name %>').<%= type %>('<%= v %>').ttl(<%= record_set.ttl %>) }
+EOF
+          v = record_set.resource_records.map { |r| r.value }.join("\n")
+          type = record_set.type.downcase
+        else
+          # ALIAS
+          dns_name = record_set.alias_target.dns_name
+          hosted_zone_id = record_set.alias_target.hosted_zone_id
+          template = <<-'EOF'
+it { should have_record_set('<%= name %>').alias('<%= dns_name %>', '<%= hosted_zone_id %>') }
+EOF
+        end
+        ERB.new(template, nil, '-').result(binding)
+      end
+
+      def route53_hosted_zone_spec_template
+        template = <<-'EOF'
+describe route53_hosted_zone('<%= hosted_zone.name %>') do
+  it { should exist }
+  its(:resource_record_set_count) { should eq <%= hosted_zone.resource_record_set_count %> }
+<% resource_record_sets.each do |line| %>
+  <%= line %>
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/route_table.rb

@@ -0,0 +1,128 @@
+module Awspec::Generator
+  module Spec
+    class RouteTable
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        route_tables = select_route_table_by_vpc_id(@vpc_id)
+        specs = route_tables.map do |route_table|
+          linespecs = generate_route_linespecs(route_table)
+          subnet_linespecs = generate_subnet_linespecs(route_table)
+          route_table_id = route_table[:route_table_id]
+          route_table_tag_name = route_table.tag_name
+          content = ERB.new(route_table_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def generate_route_linespecs(route_table)
+        linespecs = []
+        route_table.routes.each do |route|
+          if route.gateway_id
+            destination = route.destination_cidr_block
+            destination ||= route.destination_prefix_list_id
+            linespecs.push(ERB.new(route_table_spec_gateway_linetemplate, nil, '-').result(binding))
+          end
+          if route.instance_id
+            instance = find_ec2(route.instance_id)
+            linespecs.push(ERB.new(route_table_spec_instance_linetemplate, nil, '-').result(binding)) if instance
+          end
+          if route.vpc_peering_connection_id
+            connection = find_vpc_peering_connection(route.vpc_peering_connection_id)
+            linespecs.push(ERB.new(route_table_spec_connection_linetemplate, nil, '-').result(binding)) if connection
+          end
+          if route.nat_gateway_id
+            linespecs.push(ERB.new(route_table_spec_nat_linetemplate, nil, '-').result(binding))
+          end
+        end
+        linespecs
+      end
+
+      def generate_subnet_linespecs(route_table)
+        linespecs = []
+        route_table.associations.each do |a|
+          next if a.subnet_id.nil?
+          subnet = find_subnet(a.subnet_id)
+          linespecs.push(ERB.new(route_table_spec_subnet_linetemplate, nil, '-').result(binding)) if subnet
+        end
+        linespecs
+      end
+
+      def route_table_spec_gateway_linetemplate
+        template = <<-'EOF'
+it { should have_route('<%= destination %>').target(gateway: '<%= route.gateway_id %>') }
+EOF
+        template
+      end
+
+      def route_table_spec_instance_linetemplate
+        template = <<-'EOF'
+<%- if instance.tag_name -%>
+it { should have_route('<%= route.destination_cidr_block %>').target(instance: '<%= instance.tag_name %>') }
+<%- else -%>
+it { should have_route('<%= route.destination_cidr_block %>').target(instance: '<%= route.instance_id %>') }
+<%- end -%>
+EOF
+        template
+      end
+
+      def route_table_spec_connection_linetemplate
+        template = <<-'EOF'
+<%- if connection.tag_name -%>
+it { should have_route('<%= route.destination_cidr_block %>').target(vpc_peering_connection: '<%= connection.tag_name %>') }
+<%- else -%>
+it { should have_route('<%= route.destination_cidr_block %>').target(vpc_peering_connection: '<%= route.vpc_peering_connection_id %>') }
+<%- end -%>
+EOF
+        template
+      end
+
+      def route_table_spec_nat_linetemplate
+        template = <<-'EOF'
+it { should have_route('<%= route.destination_cidr_block %>').target(nat: '<%= route.nat_gateway_id %>') }
+EOF
+        template
+      end
+
+      def route_table_spec_subnet_linetemplate
+        template = <<-'EOF'
+<%- if subnet.tag_name -%>
+it { should have_subnet('<%= subnet.tag_name %>') }
+<%- else -%>
+it { should have_subnet('<%= subnet.subnet_id %>') }
+<%- end -%>
+EOF
+        template
+      end
+
+      def route_table_spec_template
+        template = <<-'EOF'
+<%- if route_table_tag_name -%>
+describe route_table('<%= route_table_tag_name %>') do
+<%- else -%>
+describe route_table('<%= route_table_id %>') do
+<%- end -%>
+  it { should exist }
+<%- if @vpc_tag_name -%>
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<%- else -%>
+  it { should belong_to_vpc('<%= @vpc_id %>') }
+<%- end -%>
+<% linespecs.each do |line| %>
+  <%= line %>
+<% end %>
+<% subnet_linespecs.each do |line| %>
+  <%= line %>
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/s3_bucket.rb

@@ -0,0 +1,70 @@
+module Awspec::Generator
+  module Spec
+    class S3Bucket
+      include Awspec::Helper::Finder
+      def generate_all
+        buckets = select_all_buckets
+        raise 'Not Found Bucket' if buckets.empty?
+        specs = buckets.map do |bucket|
+          content(bucket)
+        end
+        specs.join("\n")
+      end
+
+      def generate(bucket_name)
+        bucket = find_bucket(bucket_name)
+        content(bucket)
+      end
+
+      def generate_grant_specs(acl)
+        return [] unless acl
+        linespecs = []
+        acl.grants.each do |grant|
+          linespecs.push(ERB.new(grant_linetemplate, nil, '-').result(binding))
+        end
+        linespecs
+      end
+
+      def grant_linetemplate
+        grantee = 'grant.grantee.display_name || grant.grantee.uri || grant.grantee.id'
+        template = <<-EOF
+it { should have_acl_grant(grantee: '<%= #{grantee} %>', permission: '<%= grant.permission %>') }
+        EOF
+        template
+      end
+
+      def bucket_spec_template
+        template = <<-'EOF'
+describe s3_bucket('<%= bucket.name %>') do
+  it { should exist }
+<%- if acl -%>
+  its(:acl_owner) { should eq '<%= acl.owner.display_name %>' }
+  its(:acl_grants_count) { should eq <%= acl.grants.count %> }
+<%- end -%>
+<% grant_specs.each do |line| %>
+  <%= line %>
+<% end %>
+<%- if bucket_policy -%>
+  it { should have_policy('<%= bucket_policy %>') }
+<%- end -%>
+<%- if tag -%>
+  it { should have_tag('env').value('dev') }
+<%- end -%>
+end
+EOF
+        template
+      end
+
+      private
+
+      def content(bucket)
+        acl = find_bucket_acl(bucket.name)
+        grant_specs = generate_grant_specs(acl)
+        tag = find_bucket_tag(bucket.name, 'env')
+        policy = find_bucket_policy(bucket.name)
+        bucket_policy = policy.policy.read if policy
+        ERB.new(bucket_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/security_group.rb

@@ -0,0 +1,95 @@
+module Awspec::Generator
+  module Spec
+    class SecurityGroup
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          group_id group_name
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        sgs = select_security_group_by_vpc_id(@vpc_id)
+
+        specs = sgs.map do |sg|
+          linespecs = generate_linespecs(sg)
+          inbound_rule_count = sg[:ip_permissions].reduce(0) do |sum, permission|
+            sum += permission.ip_ranges.count + permission.user_id_group_pairs.count
+          end
+          outbound_rule_count = sg[:ip_permissions_egress].reduce(0) do |sum, permission|
+            sum += permission.ip_ranges.count + permission.user_id_group_pairs.count
+          end
+          content = ERB.new(security_group_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def generate_linespecs(sg)
+        linespecs = []
+        permissions = { 'inbound' => sg.ip_permissions, 'outbound' => sg.ip_permissions_egress }
+        %w(inbound outbound).each do |inout|
+          permissions[inout].each do |permission|
+            port = if permission.from_port.nil?
+                     nil
+                   elsif permission.from_port == permission.to_port
+                     permission.from_port
+                   else
+                     "'" + permission.from_port.to_s + '-' + permission.to_port.to_s + "'"
+                   end
+
+            protocol = if permission.ip_protocol.to_i < 0
+                         'all'
+                       else
+                         permission.ip_protocol
+                       end
+
+            permission.ip_ranges.each do |ip_range|
+              target = ip_range.cidr_ip
+              linespecs.push(ERB.new(security_group_spec_linetemplate, nil, '-').result(binding))
+            end
+            permission.user_id_group_pairs.each do |group|
+              target = group.group_name
+              target = group.group_id unless group.group_name
+              linespecs.push(ERB.new(security_group_spec_linetemplate, nil, '-').result(binding))
+            end
+          end
+        end
+        linespecs
+      end
+
+      def security_group_spec_linetemplate
+        template = <<-'EOF'
+its(:<%= inout %>) { should be_opened<%- unless port.nil? -%>(<%= port %>)<%- end -%>.protocol('<%= protocol %>').for('<%= target %>') }
+EOF
+        template
+      end
+
+      def security_group_spec_template
+        template = <<-'EOF'
+describe security_group('<%= sg.group_name %>') do
+  it { should exist }
+<% describes.each do |describe| %>
+<%- if sg.key?(describe) -%>
+  its(:<%= describe %>) { should eq '<%= sg[describe] %>' }
+<%- end -%>
+<% end %>
+<% linespecs.each do |line| %>
+  <%= line %>
+<% end %>
+  its(:inbound_rule_count) { should eq <%= inbound_rule_count %> }
+  its(:outbound_rule_count) { should eq <%= outbound_rule_count %> }
+  its(:inbound_permissions_count) { should eq <%= sg.ip_permissions.count %> }
+  its(:outbound_permissions_count) { should eq <%= sg.ip_permissions_egress.count %> }
+<%- if @vpc_tag_name -%>
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<%- else -%>
+  it { should belong_to_vpc('<%= @vpc_id %>') }
+<%- end -%>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/subnet.rb

@@ -0,0 +1,47 @@
+module Awspec::Generator
+  module Spec
+    class Subnet
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          subnet_id cidr_block
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        subnets = select_subnet_by_vpc_id(@vpc_id)
+        specs = subnets.map do |subnet|
+          subnet_id = subnet[:subnet_id]
+          subnet_tag_name = subnet.tag_name
+          content = ERB.new(subnet_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def subnet_spec_template
+        template = <<-'EOF'
+<%- if subnet_tag_name -%>
+describe subnet('<%= subnet_tag_name %>') do
+<%- else -%>
+describe subnet('<%= subnet_id %>') do
+<%- end -%>
+  it { should exist }
+  it { should be_<%= subnet.state %> }
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<% describes.each do |describe| %>
+<%- if subnet.members.include?(describe.to_sym) && !subnet[describe.to_sym].nil? -%>
+<%- if subnet[describe].is_a?(String) -%>
+  its(:<%= describe %>) { should eq '<%= subnet[describe] %>' }
+<%- else -%>
+  its(:<%= describe %>) { should eq <%= subnet[describe] %> }
+<%- end -%>
+<%- end -%>
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/vpc.rb

@@ -0,0 +1,57 @@
+module Awspec::Generator
+  module Spec
+    class Vpc
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          vpc_id cidr_block
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        route_tables = select_route_table_by_vpc_id(@vpc_id)
+        network_acls = select_network_acl_by_vpc_id(@vpc_id)
+        spec = ERB.new(vpc_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+      end
+
+      # rubocop:disable all
+      def vpc_spec_template
+        template = <<-'EOF'
+<%- if @vpc_tag_name -%>
+describe vpc('<%= @vpc_tag_name %>') do
+<%- else -%>
+describe vpc('<%= @vpc_id %>') do
+<%- end -%>
+  it { should exist }
+  it { should be_<%= vpc.state %> }
+<% describes.each do |describe| %>
+<%- if vpc.key?(describe) -%>
+<%- if vpc[describe].is_a?(String) -%>
+  its(:<%= describe %>) { should eq '<%= vpc[describe] %>' }
+<%- else -%>
+  its(:<%= describe %>) { should eq <%= vpc[describe] %> }
+<%- end -%>
+<%- end -%>
+<% end %>
+<% route_tables.each do |route_table| %>
+<%- if route_table.tag_name -%>
+  it { should have_route_table('<%= route_table.tag_name %>') }
+<%- else -%>
+  it { should have_route_table('<%= route_table.route_table_id %>') }
+<%- end -%>
+<% end %>
+<% network_acls.each do |network_acl| %>
+<%- if network_acl.tag_name -%>
+  it { should have_network_acl('<%= network_acl.tag_name %>') }
+<%- else -%>
+  it { should have_network_acl('<%= network_acl.network_acl_id %>') }
+<%- end -%>
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end