cmonson_2ndwatch_awspec 0.85.3

data/lib/awspec/helper/finder/ses.rb

@@ -0,0 +1,13 @@
+module Awspec::Helper
+  module Finder
+    module Ses
+      def find_ses_identity(id)
+        res = ses_client.list_identities
+        ret = res.identities.select do |identity|
+          identity == id
+        end
+        ret.single_resource(id)
+      end
+    end
+  end
+end

data/lib/awspec/helper/finder/sqs.rb

@@ -0,0 +1,12 @@
+module Awspec::Helper
+  module Finder
+    module Sqs
+      def find_queue(queue_name)
+        res = sqs_client.list_queues(queue_name_prefix: queue_name).queue_urls.select do |url|
+          url.split('/').last == queue_name
+        end
+        res.single_resource(queue_name)
+      end
+    end
+  end
+end

data/lib/awspec/helper/finder/subnet.rb

@@ -0,0 +1,29 @@
+module Awspec::Helper
+  module Finder
+    module Subnet
+      def find_subnet(subnet_id)
+        res = ec2_client.describe_subnets({
+                                            filters: [{ name: 'subnet-id', values: [subnet_id] }]
+                                          })
+        resource = res.subnets.single_resource(subnet_id)
+        return resource if resource
+        res = ec2_client.describe_subnets({
+                                            filters: [{ name: 'tag:Name', values: [subnet_id] }]
+                                          })
+        resource = res.subnets.single_resource(subnet_id)
+        return resource if resource
+        res = ec2_client.describe_subnets({
+                                            filters: [{ name: 'cidrBlock', values: [subnet_id] }]
+                                          })
+        res.subnets.single_resource(subnet_id)
+      end
+
+      def select_subnet_by_vpc_id(vpc_id)
+        res = ec2_client.describe_subnets({
+                                            filters: [{ name: 'vpc-id', values: [vpc_id] }]
+                                          })
+        res.subnets
+      end
+    end
+  end
+end

data/lib/awspec/helper/finder/vpc.rb

@@ -0,0 +1,77 @@
+module Awspec::Helper
+  module Finder
+    module Vpc
+      def find_vpc(id)
+        res = ec2_client.describe_vpcs({
+                                         filters: [{ name: 'vpc-id', values: [id] }]
+                                       })
+        resource = res.vpcs.single_resource(id)
+        return resource if resource
+        res = ec2_client.describe_vpcs({
+                                         filters: [{ name: 'tag:Name', values: [id] }]
+                                       })
+        res.vpcs.single_resource(id)
+      end
+
+      def find_route_table(route_table_id)
+        res = ec2_client.describe_route_tables({
+                                                 filters: [{ name: 'route-table-id', values: [route_table_id] }]
+                                               })
+        resource = res.route_tables.single_resource(route_table_id)
+        return resource if resource
+        res = ec2_client.describe_route_tables({
+                                                 filters: [{ name: 'tag:Name', values: [route_table_id] }]
+                                               })
+        res.route_tables.single_resource(route_table_id)
+      end
+
+      def find_network_acl(id)
+        res = ec2_client.describe_network_acls({
+                                                 filters: [{ name: 'network-acl-id', values: [id] }]
+                                               })
+        resource = res.network_acls.single_resource(id)
+        return resource if resource
+        res = ec2_client.describe_network_acls({
+                                                 filters: [{ name: 'tag:Name', values: [id] }]
+                                               })
+        res.network_acls.single_resource(id)
+      end
+
+      def select_route_table_by_vpc_id(vpc_id)
+        res = ec2_client.describe_route_tables({
+                                                 filters: [{ name: 'vpc-id', values: [vpc_id] }]
+                                               })
+        res.route_tables
+      end
+
+      def select_network_acl_by_vpc_id(vpc_id)
+        res = ec2_client.describe_network_acls({
+                                                 filters: [{ name: 'vpc-id', values: [vpc_id] }]
+                                               })
+        res.network_acls
+      end
+
+      def find_vpc_peering_connection(vpc_peering_connection_id)
+        res = ec2_client.describe_vpc_peering_connections({
+                                                            filters: [
+                                                              {
+                                                                name: 'vpc-peering-connection-id',
+                                                                values: [vpc_peering_connection_id]
+                                                              }
+                                                            ]
+                                                          })
+        resource = res.vpc_peering_connections.single_resource(vpc_peering_connection_id)
+        return resource if resource
+        res = ec2_client.describe_vpc_peering_connections({
+                                                            filters: [
+                                                              {
+                                                                name: 'tag:Name',
+                                                                values: [vpc_peering_connection_id]
+                                                              }
+                                                            ]
+                                                          })
+        res.vpc_peering_connections.single_resource(vpc_peering_connection_id)
+      end
+    end
+  end
+end

data/lib/awspec/helper/finder/waf.rb

@@ -0,0 +1,53 @@
+module Awspec::Helper
+  module Finder
+    module Waf
+      def find_waf_web_acl(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_web_acls(next_marker: next_marker, limit: 100)
+          finded = res.web_acls.find do |acl|
+            acl.web_acl_id == id || acl.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_web_acl(web_acl_id: finded.web_acl_id).web_acl
+      end
+
+      def find_waf_rule(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_rules(next_marker: next_marker, limit: 1)
+          finded = res.rules.find do |rule|
+            rule.rule_id == id || rule.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_rule(rule_id: finded.rule_id).rule
+      end
+
+      def find_waf_ip_set(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_ip_sets(next_marker: next_marker, limit: 1)
+          finded = res.ip_sets.find do |set|
+            set.ip_set_id == id || set.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_ip_set(ip_set_id: finded.ip_set_id).ip_set
+      end
+    end
+  end
+end

data/lib/awspec/helper/type.rb

@@ -0,0 +1,67 @@
+module Awspec
+  module Helper
+    module Type
+      require 'awspec/type/base'
+      require 'awspec/type/resource_base'
+      require 'awspec/type/account_attribute_base'
+      require 'awspec/type/account'
+      require 'awspec/type/account_attribute'
+
+      TYPES = %w(
+        alb ami autoscaling_group cloudtrail cloudwatch_alarm cloudwatch_event directconnect_virtual_interface
+        ebs ec2 ecr_repository ecs_cluster ecs_container_instance ecs_service ecs_task_definition
+        efs elasticache elasticache_cache_parameter_group elasticsearch elb iam_group
+        iam_policy iam_role iam_user kms lambda launch_configuration nat_gateway
+        network_acl network_interface rds rds_db_cluster_parameter_group rds_db_parameter_group route53_hosted_zone
+        route_table s3_bucket security_group ses_identity subnet vpc cloudfront_distribution
+        elastictranscoder_pipeline waf_web_acl customer_gateway vpn_gateway vpn_connection internet_gateway acm
+        cloudwatch_logs dynamodb_table eip sqs alb_listener alb_target_group cloudformation_stack
+      )
+
+      ACCOUNT_ATTRIBUTES = %w(
+        ec2_account_attributes rds_account_attributes lambda_account_settings ses_send_quota
+      )
+
+      TYPES.each do |type|
+        require "awspec/type/#{type}"
+        define_method type do |*args|
+          unless Object.const_get("Awspec::Type::#{type.camelize}").superclass.to_s == 'Awspec::Type::ResourceBase'
+            raise "Awspec::Type::#{type.camelize} should extend Awspec::Type::ResourceBase"
+          end
+          name = args.first
+          eval "Awspec::Type::#{type.camelize}.new(name)"
+        end
+      end
+
+      ACCOUNT_ATTRIBUTES.each do |type|
+        require "awspec/type/#{type}"
+        define_method type do
+          unless Object.const_get("Awspec::Type::#{type.camelize}").superclass.to_s \
+                 == 'Awspec::Type::AccountAttributeBase'
+            raise "Awspec::Type::#{type.camelize} should extend Awspec::Type::AccountAttributeBase"
+          end
+          eval "Awspec::Type::#{type.camelize}.new"
+        end
+      end
+
+      def account
+        Awspec::Type::Account.new
+      end
+
+      def account_attribute(key)
+        Awspec::Type::AccountAttribute.new(key)
+      end
+
+      def self.deprecate_resource_type(old_type, new_type)
+        define_method(old_type) do |*args, &block|
+          puts ''
+          warn Color.on_red(Color.white("!!! `#{old_type}` type is deprecated. use `#{new_type}` !!!"))
+          send(new_type, *args, &block)
+        end
+      end
+
+      deprecate_resource_type :auto_scaling_group, :autoscaling_group
+      deprecate_resource_type :s3, :s3_bucket
+    end
+  end
+end

data/lib/awspec/matcher.rb

@@ -0,0 +1,62 @@
+# EC2
+require 'awspec/matcher/belong_to_vpc'
+require 'awspec/matcher/belong_to_subnet'
+require 'awspec/matcher/have_tag'
+require 'awspec/matcher/have_network_interface'
+
+# RDS
+require 'awspec/matcher/belong_to_db_subnet_group'
+
+# SecurityGroup
+require 'awspec/matcher/be_opened'
+require 'awspec/matcher/be_opened_only'
+
+# Route53
+require 'awspec/matcher/have_record_set'
+
+# RouteTable
+require 'awspec/matcher/have_route'
+
+# IAM User
+require 'awspec/matcher/belong_to_iam_group'
+require 'awspec/matcher/have_inline_policy'
+
+# IAM User/Group/Role
+require 'awspec/matcher/be_allowed_action'
+
+# ElastiCache
+require 'awspec/matcher/belong_to_replication_group'
+require 'awspec/matcher/belong_to_cache_subnet_group'
+
+# CloudWatch
+require 'awspec/matcher/belong_to_metric'
+
+# NetworkAcl
+require 'awspec/matcher/be_allowed'
+require 'awspec/matcher/be_denied'
+
+# NetworkInterface
+require 'awspec/matcher/be_attached_to'
+require 'awspec/matcher/have_private_ip_address'
+
+# CloudFront
+require 'awspec/matcher/have_origin'
+
+# Kms
+require 'awspec/matcher/have_key_policy'
+
+# WafWebAcl / AlbListener
+require 'awspec/matcher/have_rule'
+
+# CloudWatch Logs
+require 'awspec/matcher/have_subscription_filter'
+
+# DynamoDB
+require 'awspec/matcher/have_attribute_definition'
+require 'awspec/matcher/have_key_schema'
+
+# EIP
+require 'awspec/matcher/belong_to_domain'
+
+# Alb Target Group
+require 'awspec/matcher/belong_to_alb'

data/lib/awspec/matcher/be_allowed.rb

@@ -0,0 +1,25 @@
+RSpec::Matchers.define :be_allowed do |port|
+  match do |type|
+    type.allowed?(port, @protocol, @cidr, @rule_number)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+
+  chain :source do |cidr|
+    @cidr = cidr
+  end
+
+  chain :rule_number do |rule_number|
+    @rule_number = rule_number
+  end
+end

data/lib/awspec/matcher/be_allowed_action.rb

@@ -0,0 +1,19 @@
+RSpec::Matchers.define :be_allowed_action do |action_name|
+  match do |type|
+    results = type.select_policy_evaluation_results(type.resource_via_client[:arn],
+                                                    action_name,
+                                                    @resource_arn,
+                                                    @context_entries)
+    results.find do |result|
+      result.eval_decision == 'allowed'
+    end
+  end
+
+  chain :resource_arn do |arn|
+    @resource_arn = arn
+  end
+
+  chain :context_entries do |context|
+    @context_entries = context
+  end
+end

data/lib/awspec/matcher/be_attached_to.rb

@@ -0,0 +1,19 @@
+RSpec::Matchers.define :be_attached_to do |instance_id|
+  match do |type|
+    # NetworkInterface
+    if type.instance_of?(Awspec::Type::NetworkInterface)
+      return type.attached_to?(instance_id, @device_index)
+    end
+    type.attached_to?(instance_id)
+  end
+
+  chain :device_index do |device_index|
+    @device_index = device_index
+  end
+
+  (0..10).each do |idx|
+    chain "as_eth#{idx}".to_sym do
+      @device_index = idx
+    end
+  end
+end

data/lib/awspec/matcher/be_denied.rb

@@ -0,0 +1,25 @@
+RSpec::Matchers.define :be_denied do |port|
+  match do |type|
+    type.denied?(port, @protocol, @cidr, @rule_number)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+
+  chain :source do |cidr|
+    @cidr = cidr
+  end
+
+  chain :rule_number do |rule_number|
+    @rule_number = rule_number
+  end
+end

data/lib/awspec/matcher/be_opened.rb

@@ -0,0 +1,17 @@
+RSpec::Matchers.define :be_opened do |port|
+  match do |sg|
+    sg.opened?(port, @protocol, @cidr)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+end

data/lib/awspec/matcher/be_opened_only.rb

@@ -0,0 +1,17 @@
+RSpec::Matchers.define :be_opened_only do |port|
+  match do |sg|
+    sg.opened_only?(port, @protocol, @cidr)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+end