cmonson_2ndwatch_awspec 0.85.3

data/doc/_resource_types/iam_group.md

@@ -0,0 +1,86 @@
+### exist
+
+```ruby
+describe iam_group('my-iam-group') do
+  it { should exist }
+end
+```
+
+### be_allowed_action
+
+```ruby
+describe iam_group('my-iam-group') do
+  it { should be_allowed_action('ec2:DescribeInstances') }
+  it { should be_allowed_action('s3:Put*').resource_arn('arn:aws:s3:::my-bucket-name/*') }
+end
+```
+
+### have_iam_policy
+
+```ruby
+describe iam_group('my-iam-group') do
+  it { should have_iam_policy('ReadOnlyAccess') }
+end
+```
+
+### have_iam_user
+
+```ruby
+describe iam_group('my-iam-group') do
+  it { should have_iam_user('my-iam-user') }
+end
+```
+
+### have_inline_group
+
+```ruby
+describe iam_group('my-iam-group') do
+  it { should have_inline_policy('InlineEC2FullAccess') }
+  it do
+    should have_inline_policy('InlineEC2FullAccess').policy_document(<<-'DOC')
+{
+  "Statement": [
+    {
+      "Action": "ec2:*",
+      "Effect": "Allow",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "elasticloadbalancing:*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "cloudwatch:*",
+      "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "autoscaling:*",
+      "Resource": "*"
+    }
+  ]
+}
+DOC
+  end
+end
+```
+
+### advanced
+
+`iam_group` can use `Aws::IAM::Group` resource (see http://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Group.html).
+
+```ruby
+describe iam_group('my-iam-group') do
+  its('users.count) { should eq 5 }
+end
+```
+
+or
+
+```ruby
+describe iam_group('my-iam-group') do
+  its('resource.users.count') { should eq 5 }
+end
+```

data/doc/_resource_types/iam_policy.md

@@ -0,0 +1,39 @@
+### exist
+
+```ruby
+describe iam_policy('my-iam-policy') do
+  it { should exist }
+end
+```
+
+### be_attachable
+
+```ruby
+describe iam_policy('my-iam-policy') do
+  it { should be_attachable }
+end
+```
+
+### be_attached_to_group
+
+```ruby
+describe iam_policy('my-iam-policy') do
+  it { should be_attached_to_group('my-iam-group') }
+end
+```
+
+### be_attached_to_role
+
+```ruby
+describe iam_policy('my-iam-policy') do
+  it { should be_attached_to_role('HelloIAmGodRole') }
+end
+```
+
+### be_attached_to_user
+
+```ruby
+describe iam_policy('my-iam-user') do
+  it { should be_attached_to_user('my-iam-user') }
+end
+```

data/doc/_resource_types/iam_role.md

@@ -0,0 +1,70 @@
+### exist
+
+```ruby
+describe iam_role('my-iam-role') do
+  it { should exist }
+end
+```
+
+### be_allowed_action
+
+```ruby
+describe iam_role('my-iam-role') do
+  it { should be_allowed_action('ec2:DescribeInstances') }
+  it { should be_allowed_action('s3:Put*').resource_arn('arn:aws:s3:::my-bucket-name/*') }
+end
+```
+
+### have_iam_policy
+
+```ruby
+describe iam_role('my-iam-role') do
+  it { should have_iam_policy('ReadOnlyAccess') }
+end
+```
+
+### have_inline_policy
+
+```ruby
+describe iam_role('my-iam-role') do
+  it { should have_inline_policy('AllowS3BucketAccess') }
+  it do
+    should have_inline_policy('AllowS3BucketAccess').policy_document(<<-'DOC')
+{
+"Statement": [
+    {
+     "Action": [
+        "s3:ListAllMyBuckets"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:s3:::*"
+    },
+    {
+      "Action": "s3:*",
+      "Effect": "Allow",
+      "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
+    }
+  ]
+}
+DOC
+  end
+end
+```
+
+### advanced
+
+`iam_role` can use `Aws::IAM::Role` resource (see http://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Role.html).
+
+```ruby
+describe iam_role('my-iam-role') do
+  its('attached_policies.count') { should eq 5 }
+end
+```
+
+or
+
+```ruby
+describe iam_role('my-iam-role') do
+  its('resource.attached_policies.count') { should eq 5 }
+end
+```

data/doc/_resource_types/iam_user.md

@@ -0,0 +1,78 @@
+### exist
+
+```ruby
+describe iam_user('my-iam-user') do
+  it { should exist }
+end
+```
+
+### be_allowed_action
+
+```ruby
+describe iam_user('my-iam-user') do
+  it { should be_allowed_action('ec2:DescribeInstances') }
+  it { should be_allowed_action('s3:Put*').resource_arn('arn:aws:s3:::my-bucket-name/*') }
+end
+```
+
+### have_iam_policy
+
+```ruby
+describe iam_user('my-iam-user') do
+  it { should have_iam_policy('ReadOnlyAccess') }
+end
+```
+
+### have_inline_policy
+
+```ruby
+describe iam_user('my-iam-user') do
+  it { should have_inline_policy('AllowS3BucketAccess') }
+  it do
+    should have_inline_policy('AllowS3BucketAccess').policy_document(<<-'DOC')
+{
+"Statement": [
+    {
+     "Action": [
+        "s3:ListAllMyBuckets"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:s3:::*"
+    },
+    {
+      "Action": "s3:*",
+      "Effect": "Allow",
+      "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
+    }
+  ]
+}
+DOC
+  end
+end
+```
+
+### belong_to_iam_group
+
+```ruby
+describe iam_user('my-iam-user') do
+  it { should belong_to_iam_group('my-iam-group') }
+end
+```
+
+### advanced
+
+`iam_user` can use `Aws::IAM::User` resource (see http://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/User.html).
+
+```ruby
+describe iam_user('my-iam-user') do
+  its('login_profile.password_reset_required') { should eq false }
+end
+```
+
+or
+
+```ruby
+describe iam_user('my-iam-user') do
+  its('resource.login_profile.password_reset_required') { should eq false }
+end
+```

data/doc/_resource_types/internet_gateway.md

@@ -0,0 +1,31 @@
+### exist
+
+```ruby
+describe internet_gateway('igw-1ab2cd3e') do
+  it { should exist }
+end
+
+describe internet_gateway('my-internet-gateway') do
+  it { should exist }
+end
+```
+
+### be_attached_to
+
+```ruby
+describe internet_gateway('igw-1ab2cd3e') do
+  it { should be_attached_to('vpc-ab123cde') }
+end
+
+describe internet_gateway('igw-1ab2cd3e') do
+  it { should be_attached_to('my-vpc') }
+end
+```
+
+### have_tag
+
+```ruby
+describe internet_gateway('igw-1ab2cd3e') do
+  it { should have_tag('Name').value('my-internet-gateway') }
+end
+```

data/doc/_resource_types/kms.md

@@ -0,0 +1,70 @@
+### exist
+
+```ruby
+describe kms('my-kms-key') do
+  it { should exist }
+end
+```
+
+### be_enabled
+
+```ruby
+describe kms('my-kms-key') do
+  it { should be_enabled }
+end
+```
+
+### have_key_policy
+
+```ruby
+describe kms('my-kms-key') do
+  it { should exist }
+  it { should be_enabled }
+  it do
+    should have_key_policy('default').policy_document(<<-'DOC')
+{
+  "Version" : "2012-10-17",
+  "Id" : "key-consolepolicy-2",
+  "Statement" : [ {
+    "Sid" : "Enable IAM User Permissions",
+    "Effect" : "Allow",
+    "Principal" : {
+      "AWS" : "arn:aws:iam::1234567890:root"
+    },
+    "Action" : "kms:*",
+    "Resource" : "*"
+  }, {
+    "Sid" : "Allow access for Key Administrators",
+    "Effect" : "Allow",
+    "Principal" : {
+      "AWS" : "arn:aws:iam::1234567890:user/test-user"
+    },
+    "Action" : [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ],
+    "Resource" : "*"
+  }, {
+    "Sid" : "Allow use of the key",
+    "Effect" : "Allow",
+    "Principal" : {
+      "AWS" : [ "arn:aws:iam::1234567890:user/test-user", "arn:aws:iam::1234567890:role/test-role" ]
+    },
+    "Action" : [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ],
+    "Resource" : "*"
+  }, {
+    "Sid" : "Allow attachment of persistent resources",
+    "Effect" : "Allow",
+    "Principal" : {
+      "AWS" : [ "arn:aws:iam::1234567890:user/test-user", "arn:aws:iam::1234567890:role/test-role" ]
+    },
+    "Action" : [ "kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant" ],
+    "Resource" : "*",
+    "Condition" : {
+      "Bool" : {
+        "kms:GrantIsForAWSResource" : "true"
+      }
+    }
+  } ]
+}
+DOC
+  end
+end
+```

data/doc/_resource_types/lambda.md

@@ -0,0 +1,11 @@
+### exist
+
+```ruby
+describe lambda('my-lambda-function-name') do
+  it { should exist }
+end
+```
+
+### have_event_source
+
+This matcher does not support Amazon S3 event sources. ( [See SDK doc](http://docs.aws.amazon.com/sdkforruby/api/Aws/Lambda/Client.html#list_event_source_mappings-instance_method) )

data/doc/_resource_types/lambda_account_settings.md

@@ -0,0 +1,10 @@
+### first
+
+```ruby
+describe lambda_account_settings do
+  its('total_code_size.limit') { should eq 80_530_636_800 }
+  its('total_code_size.usage') { should eq 2_034_651_562 }
+  its('function_count.usage') { should eq 8 }
+end
+```
+

data/doc/_resource_types/launch_configuration.md

@@ -0,0 +1,15 @@
+### exist
+
+```ruby
+describe launch_configuration('my-lc') do
+  it { should exist }
+end
+```
+
+### have_security_group
+
+```ruby
+describe launch_configuration('my-lc') do
+  it { should have_security_group('my-security-group-name') }
+end
+```

data/doc/_resource_types/nat_gateway.md

@@ -0,0 +1,31 @@
+### exist
+
+```ruby
+describe nat_gateway('nat-7ff7777f') do
+  it { should exist }
+end
+```
+
+### be_pending, be_failed, be_available, be_deleting, be_deleted
+
+```ruby
+describe nat_gateway('nat-7ff7777f') do
+  it { should be_available }
+end
+```
+
+### have_eip
+
+```ruby
+describe nat_gateway('nat-7ff7777f') do
+  it { should have_eip('123.0.456.789') }
+end
+```
+
+### belong_to_vpc
+
+```ruby
+describe nat_gateway('nat-7ff7777f') do
+  it { should belong_to_vpc('my-vpc') }
+end
+```