cthiesfork-awspec 1.0.0

data/lib/awspec/generator/spec/kms.rb

@@ -0,0 +1,34 @@
+module Awspec::Generator
+  module Spec
+    class Kms
+      include Awspec::Helper::Finder
+      def generate_all
+        aliases = select_all_kms_aliases.select { |kms_alias| customer_managed_key?(kms_alias) }
+        raise 'Not Found alias' if aliases.empty?
+        ERB.new(keys_spec_template, nil, '-').result(binding).chomp
+      end
+
+      def keys_spec_template
+        template = <<-'EOF'
+<% aliases.each do |kms_alias| %>
+describe kms('<%= kms_alias.alias_name.split('/').last %>') do
+  it { should exist }
+<% if find_kms_key(kms_alias.target_key_id).enabled -%>
+  it { should be_enabled }
+<% end -%>
+end
+<% end %>
+EOF
+        template
+      end
+
+      private
+
+      def customer_managed_key?(kms_alias)
+        # An aliase that has no target key id field is predefined by AWS.
+        # see: https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/KMS/Client.html#list_aliases-instance_method
+        !kms_alias.target_key_id.nil?
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/lambda.rb

@@ -0,0 +1,29 @@
+module Awspec::Generator
+  module Spec
+    class Lambda
+      include Awspec::Helper::Finder
+      def generate_all
+        lambda_functions = select_all_lambda_functions
+        raise 'Not Found lambda' if lambda_functions.empty?
+        ERB.new(lambda_spec_template, nil, '-').result(binding).chomp
+      end
+
+      def lambda_spec_template
+        template = <<-'EOF'
+<% lambda_functions.each do |function| %>
+describe lambda('<%= function.function_name %>') do
+  it { should exist }
+  its(:description) { should eq '<%= function.description %>' }
+  its(:runtime) { should eq '<%= function.runtime %>' }
+  its(:handler) { should eq '<%= function.handler %>' }
+  its(:code_size) { should eq <%= function.code_size %> }
+  its(:timeout) { should eq <%= function.timeout %> }
+  its(:memory_size) { should eq <%= function.memory_size %> }
+end
+<% end %>
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/nat_gateway.rb

@@ -0,0 +1,39 @@
+module Awspec::Generator
+  module Spec
+    class NatGateway
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        nat_gateways = select_nat_gateway_by_vpc_id(@vpc_id)
+        specs = nat_gateways.map do |nat_gateway|
+          nat_gateway_id = nat_gateway[:nat_gateway_id]
+          content = ERB.new(nat_gateway_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def nat_gateway_spec_template
+        template = <<-'EOF'
+describe nat_gateway('<%= nat_gateway_id %>') do
+  it { should exist }
+  it { should be_<%= nat_gateway.state %> }
+<%- if @vpc_tag_name -%>
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<%- else -%>
+  it { should belong_to_vpc('<%= @vpc_id %>') }
+<%- end -%>
+<% nat_gateway.nat_gateway_addresses.each do |address| %>
+  it { should have_eip('<%= address.public_ip %>') }
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/network_acl.rb

@@ -0,0 +1,96 @@
+module Awspec::Generator
+  module Spec
+    class NetworkAcl
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        network_acls = select_network_acl_by_vpc_id(@vpc_id)
+        specs = network_acls.map do |acl|
+          linespecs = generate_linespecs(acl)
+          subnet_specs = generate_subnet_specs(acl)
+          network_acl_id = acl[:network_acl_id]
+          network_acl_tag_name = acl.tag_name
+          inbound_entries_count = acl.entries.count do |entry|
+            entry.egress == false
+          end
+          outbound_entries_count = acl.entries.count do |entry|
+            entry.egress == true
+          end
+          content = ERB.new(network_acl_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def generate_subnet_specs(acl)
+        specs = []
+        acl.associations.each do |a|
+          subnet = find_subnet(a.subnet_id)
+          spec = if subnet.tag_name
+                   "it { should have_subnet('" + subnet.tag_name + "') }"
+                 else
+                   "it { should have_subnet('" + subnet.subnet_id + "') }"
+                 end
+          specs.push(spec)
+        end
+        specs
+      end
+
+      def generate_linespecs(acl)
+        linespecs = []
+        protocols = Awspec::Type::NetworkAcl::PROTOCOLS.invert
+        acl.entries.each do |entry|
+          line = ''
+          inout = 'inbound'
+          inout = 'outbound' if entry.egress
+          line += 'its(:' + inout + ') { should'
+          actions = { allow: 'be_allowed', deny: 'be_denied' }
+          line += ' ' + actions[entry.rule_action.to_sym]
+          port_range = entry.port_range
+          unless port_range.nil?
+            port = if port_range.from == port_range.to
+                     port_range.from.to_s
+                   else
+                     "'" + port_range.from.to_s + '-' + port_range.to.to_s + "'"
+                   end
+            line += '(' + port + ')'
+          end
+          line += ".protocol('" + protocols[entry.protocol.to_i] + "')"
+          line += ".source('" + entry.cidr_block + "')"
+          rule_number = entry.rule_number.to_i
+          rule_number = "'*'" if rule_number == 32_767
+          line += '.rule_number(' + rule_number.to_s + ')'
+          line += ' }'
+          linespecs.push(line)
+        end
+        linespecs
+      end
+
+      def network_acl_spec_template
+        template = <<-'EOF'
+<%- if network_acl_tag_name -%>
+describe network_acl('<%= network_acl_tag_name %>') do
+<%- else -%>
+describe network_acl('<%= network_acl_id %>') do
+<%- end -%>
+  it { should exist }
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<% subnet_specs.each do |spec| %>
+  <%= spec %>
+<% end %>
+<% linespecs.each do |line| %>
+  <%= line %>
+<% end %>
+  its(:inbound_entries_count) { should eq <%= inbound_entries_count %> }
+  its(:outbound_entries_count) { should eq <%= inbound_entries_count %> }
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/network_interface.rb

@@ -0,0 +1,80 @@
+module Awspec::Generator
+  module Spec
+    class NetworkInterface
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        network_interfaces = select_network_interface_by_vpc_id(@vpc_id)
+        specs = network_interfaces.map do |interface|
+          instance_spec = generate_instance_spec(interface)
+          subnet_spec = generate_subnet_spec(interface)
+          network_interface_id = interface[:network_interface_id]
+          linespecs = generate_linespecs(interface)
+          private_ip_addresses_count = interface.private_ip_addresses.count
+          content = ERB.new(network_interface_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def generate_instance_spec(interface)
+        return unless interface.attachment.instance_id
+        instance = find_ec2(interface.attachment.instance_id)
+        instance_spec = if instance.tag_name
+                          "it { should be_attached_to('#{instance.tag_name}')"
+                        else
+                          "it { should be_attached_to('#{instance.instance_id}')"
+                        end
+        instance_spec += ".as_eth#{interface.attachment.device_index} }"
+        instance_spec
+      end
+
+      def generate_subnet_spec(interface)
+        return unless interface.subnet_id
+        subnet = find_subnet(interface.subnet_id)
+        subnet_spec = if subnet.tag_name
+                        "it { should belong_to_subnet('#{subnet.tag_name}') }"
+                      else
+                        "it { should belong_to_subnet('#{subnet.subnet_id}') }"
+                      end
+        subnet_spec
+      end
+
+      def generate_linespecs(interface)
+        linespecs = []
+        interface.private_ip_addresses.each do |ip_address|
+          line = "it { should have_private_ip_address('#{ip_address.private_ip_address}')"
+          line += '.primary' if ip_address.primary
+          line += ' }'
+          linespecs.push(line)
+        end
+        linespecs
+      end
+
+      def network_interface_spec_template
+        template = <<-'EOF'
+describe network_interface('<%= network_interface_id %>') do
+  it { should exist }
+  it { should be_<%= interface.status.tr('-', '_') %> }
+<%- if instance_spec -%>
+  <%= instance_spec %>
+<%- end -%>
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<%- if subnet_spec -%>
+  <%= subnet_spec %>
+<%- end -%>
+<% linespecs.each do |line| %>
+  <%= line %>
+<% end %>
+  its(:private_ip_addresses_count) { should eq <%= interface.private_ip_addresses.count %> }
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/nlb.rb

@@ -0,0 +1,38 @@
+module Awspec::Generator
+  module Spec
+    class Nlb
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          load_balancer_name
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        nlbs = select_nlb_by_vpc_id(@vpc_id)
+
+        specs = nlbs.map do |nlb|
+          content = ERB.new(nlb_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      def nlb_spec_template
+        template = <<-'EOF'
+describe nlb('<%= nlb.load_balancer_name %>') do
+  it { should exist }
+  its(:load_balancer_arn) { should eq '<%= nlb.load_balancer_arn %>' }
+  its(:dns_name) { should eq '<%= nlb.dns_name %>' }
+  its(:load_balancer_name) { should eq '<%= nlb.load_balancer_name %>' }
+  its(:scheme) { should eq '<%= nlb.scheme %>' }
+  its(:vpc_id) { should eq '<%= nlb.vpc_id %>' }
+  its(:type) { should eq '<%= nlb.type %>' }
+  its(:ip_address_type) { should eq '<%= nlb.ip_address_type %>' }
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/nlb_listener.rb

@@ -0,0 +1,110 @@
+module Awspec::Generator
+  module Spec
+    class NlbListener
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          load_balancer_arn port protocol ssl_policy
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        nlbs = select_nlb_by_vpc_id(@vpc_id)
+
+        specs = nlbs.map do |nlb|
+          nlb_listeners = select_nlb_listener_by_nlb_arn(nlb.load_balancer_arn)
+          nlb_listeners.map do |listener|
+            rules = select_rule_by_nlb_listener_id(listener.listener_arn).map(&:to_h)
+            rules.map do |rule|
+              content = ERB.new(nlb_listener_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+            end
+          end
+        end
+        specs.join("\n")
+      end
+
+      def generate_rule_conditions_specs(conditions)
+        conditions_lines = []
+        conditions.each do |condition|
+          conditions_lines.push("{field: '#{condition[:field]}', values: #{condition[:values]}}")
+        end
+        conditions_lines.join(', ')
+      end
+
+      def generate_action_configs_specs(config)
+        action_config = []
+        config.each do |key, value|
+          if value.is_a?(String)
+            action_config.push("#{key}: '#{value}'")
+          elsif value.is_a?(Hash)
+            value.each do |vkey, vvalue|
+              if vvalue.is_a?(String)
+                action_config.push("#{key}: {#{vkey}: '#{vvalue}'}")
+              else
+                action_config.push("#{key}: {#{vkey}: #{vvalue}}")
+              end
+            end
+          else
+            action_config.push("#{key}: #{value}")
+          end
+        end
+        action_config
+      end
+
+      def generate_rule_actions_specs(actions)
+        actions_line = []
+        actions.each do |action|
+          action_line = []
+          action_line.push("type: '#{action[:type]}'")
+          action_line.push("order: #{action[:order]}") unless action[:order].nil?
+          action_line.push("target_group_arn: '#{action[:target_group_arn]}'") unless action[:target_group_arn].nil?
+          unless action[:redirect_config].nil?
+            redirect_config = generate_action_configs_specs(action[:redirect_config])
+            action_line.push("redirect_config: {#{redirect_config.join(', ')}}")
+          end
+          unless action[:fixed_response_config].nil?
+            fixed_response_config = generate_action_configs_specs(action[:fixed_response_config])
+            action_line.push("fixed_response_config: {#{fixed_response_config.join(', ')}}")
+          end
+          unless action[:authenticate_oidc_config].nil?
+            authenticate_oidc_config = generate_action_configs_specs(action[:authenticate_oidc_config])
+            action_line.push("authenticate_oidc_config: {#{authenticate_oidc_config.join(', ')}}")
+          end
+          actions_line.push("{#{action_line.join(', ')}}")
+        end
+        actions_line.join(', ')
+      end
+
+      def nlb_listener_spec_template
+        template = <<-'EOF'
+describe nlb_listener('<%= listener.listener_arn %>') do
+  it { should exist }
+  <%- describes.each do |describe| -%>
+  <%- if listener.key?(describe) -%>
+  <%- if listener[describe].is_a?(String) -%>
+  its(:<%= describe %>) { should eq '<%= listener[describe] %>' }
+  <%- else -%>
+  its(:<%= describe %>) { should eq <%= listener[describe] %> }
+  <%- end -%>
+  <%- end -%>
+  <%- end -%>
+  <%- rules.each do |rule| -%>
+  it { should have_rule('<%= rule[:rule_arn] %>') }
+  it do
+    should have_rule.priority('<%= rule[:priority] %>')
+    <%- unless rule[:conditions].empty? -%>
+      .conditions([<%= generate_rule_conditions_specs(rule[:conditions]) %>])
+    <%- end -%>
+  <%- unless rule[:actions].empty? -%>
+      .actions([<%= generate_rule_actions_specs(rule[:actions]) %>])
+  <%- end -%>
+  end
+  <%- end -%>
+end
+EOF
+        template
+      end
+    end
+  end
+end

data/lib/awspec/generator/spec/rds.rb

@@ -0,0 +1,62 @@
+module Awspec::Generator
+  module Spec
+    class Rds
+      include Awspec::Helper::Finder
+      def generate_by_vpc_id(vpc_id)
+        describes = %w(
+          db_instance_identifier db_instance_class multi_az availability_zone
+        )
+        vpc = find_vpc(vpc_id)
+        raise 'Not Found VPC' unless vpc
+        @vpc_id = vpc[:vpc_id]
+        @vpc_tag_name = vpc.tag_name
+        db_instances = select_rds_by_vpc_id(@vpc_id)
+        specs = db_instances.map do |db_instance|
+          instance_id = db_instance[:db_instance_identifier]
+          sg_group_names = db_instance[:vpc_security_groups].map do |sg|
+            sg_id = sg.vpc_security_group_id
+            ret = find_security_group(sg_id)
+            ret[:group_name]
+          end
+          content = ERB.new(rds_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
+        end
+        specs.join("\n")
+      end
+
+      # rubocop:disable all
+      def rds_spec_template
+        template = <<-'EOF'
+describe rds('<%= instance_id %>') do
+  it { should exist }
+  it { should be_<%= db_instance.db_instance_status %> }
+<% describes.each do |describe| %>
+<%- if db_instance.members.include?(describe.to_sym) && !db_instance[describe.to_sym].nil? -%>
+<%- if db_instance[describe].is_a?(String) -%>
+  its(:<%= describe %>) { should eq '<%= db_instance[describe] %>' }
+<%- else -%>
+  its(:<%= describe %>) { should eq <%= db_instance[describe] %> }
+<%- end -%>
+<%- end -%>
+<% end %>
+<% sg_group_names.each do |sg_group_name| %>
+  it { should have_security_group('<%= sg_group_name %>') }
+<% end %>
+<%- if @vpc_tag_name -%>
+  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
+<%- else -%>
+  it { should belong_to_vpc('<%= @vpc_id %>') }
+<%- end -%>
+  it { should belong_to_db_subnet_group('<%= db_instance.db_subnet_group.db_subnet_group_name %>') }
+<% db_instance.db_parameter_groups.each do |pg| %>
+  it { should have_db_parameter_group('<%= pg.db_parameter_group_name %>').parameter_apply_status('<%= pg.parameter_apply_status %>') }
+<% end %>
+<% db_instance.option_group_memberships.each do |og| %>
+  it { should have_option_group('<%= og.option_group_name %>').status('<%= og.status %>') }
+<% end %>
+end
+EOF
+        template
+      end
+    end
+  end
+end