cthiesfork-awspec 1.0.0

data/lib/awspec/helper/finder/waf.rb

@@ -0,0 +1,53 @@
+module Awspec::Helper
+  module Finder
+    module Waf
+      def find_waf_web_acl(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_web_acls(next_marker: next_marker, limit: 100)
+          finded = res.web_acls.find do |acl|
+            acl.web_acl_id == id || acl.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_web_acl(web_acl_id: finded.web_acl_id).web_acl
+      end
+
+      def find_waf_rule(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_rules(next_marker: next_marker, limit: 1)
+          finded = res.rules.find do |rule|
+            rule.rule_id == id || rule.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_rule(rule_id: finded.rule_id).rule
+      end
+
+      def find_waf_ip_set(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = waf_client.list_ip_sets(next_marker: next_marker, limit: 1)
+          finded = res.ip_sets.find do |set|
+            set.ip_set_id == id || set.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        waf_client.get_ip_set(ip_set_id: finded.ip_set_id).ip_set
+      end
+    end
+  end
+end

data/lib/awspec/helper/finder/wafregional.rb

@@ -0,0 +1,53 @@
+module Awspec::Helper
+  module Finder
+    module WafRegional
+      def find_wafregional_web_acl(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = wafregional_client.list_web_acls(next_marker: next_marker, limit: 100)
+          finded = res.web_acls.find do |acl|
+            acl.web_acl_id == id || acl.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        wafregional_client.get_web_acl(web_acl_id: finded.web_acl_id).web_acl
+      end
+
+      def find_wafregional_rule(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = wafregional_client.list_rules(next_marker: next_marker, limit: 1)
+          finded = res.rules.find do |rule|
+            rule.rule_id == id || rule.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        wafregional_client.get_rule(rule_id: finded.rule_id).rule
+      end
+
+      def find_wafregional_ip_set(id)
+        finded = nil
+        next_marker = nil
+
+        loop do
+          res = wafregional_client.list_ip_sets(next_marker: next_marker, limit: 1)
+          finded = res.ip_sets.find do |set|
+            set.ip_set_id == id || set.name == id
+          end
+          (finded.nil? && next_marker = res.next_marker) || break
+        end
+
+        return nil unless finded
+        wafregional_client.get_ip_set(ip_set_id: finded.ip_set_id).ip_set
+      end
+    end
+  end
+end

data/lib/awspec/helper/type.rb

@@ -0,0 +1,72 @@
+module Awspec
+  module Helper
+    module Type
+      require 'awspec/type/base'
+      require 'awspec/type/resource_base'
+      require 'awspec/type/account_attribute_base'
+      require 'awspec/type/account'
+      require 'awspec/type/account_attribute'
+
+      TYPES = %w(
+        alb alb_listener alb_target_group ami apigateway autoscaling_group
+        batch_compute_environment batch_job_definition batch_job_queue cloudtrail
+        cloudwatch_alarm cloudwatch_event directconnect_virtual_interface
+        ebs ec2 ecr_repository ecs_cluster ecs_container_instance ecs_service ecs_task_definition
+        efs eks elasticache elasticache_cache_parameter_group elasticsearch elb emr firehose iam_group
+        iam_policy iam_role iam_user kinesis kms lambda launch_configuration launch_template mq nat_gateway
+        network_acl network_interface nlb nlb_listener nlb_target_group
+        rds rds_db_cluster_parameter_group rds_db_parameter_group route53_hosted_zone
+        route_table s3_bucket security_group ses_identity subnet vpc cloudfront_distribution
+        elastictranscoder_pipeline waf_web_acl wafregional_web_acl customer_gateway vpn_gateway vpn_connection
+        internet_gateway acm cloudwatch_logs dynamodb_table eip sqs ssm_parameter cloudformation_stack
+        codebuild sns_topic redshift redshift_cluster_parameter_group codedeploy codedeploy_deployment_group
+        secretsmanager
+      )
+
+      ACCOUNT_ATTRIBUTES = %w(
+        ec2_account_attributes rds_account_attributes lambda_account_settings ses_send_quota
+      )
+
+      TYPES.each do |type|
+        require "awspec/type/#{type}"
+        define_method type do |*args|
+          unless Object.const_get("Awspec::Type::#{type.camelize}").superclass.to_s == 'Awspec::Type::ResourceBase'
+            raise "Awspec::Type::#{type.camelize} should extend Awspec::Type::ResourceBase"
+          end
+          name = args.first
+          eval "Awspec::Type::#{type.camelize}.new(name)"
+        end
+      end
+
+      ACCOUNT_ATTRIBUTES.each do |type|
+        require "awspec/type/#{type}"
+        define_method type do
+          unless Object.const_get("Awspec::Type::#{type.camelize}").superclass.to_s \
+                 == 'Awspec::Type::AccountAttributeBase'
+            raise "Awspec::Type::#{type.camelize} should extend Awspec::Type::AccountAttributeBase"
+          end
+          eval "Awspec::Type::#{type.camelize}.new"
+        end
+      end
+
+      def account
+        Awspec::Type::Account.new
+      end
+
+      def account_attribute(key)
+        Awspec::Type::AccountAttribute.new(key)
+      end
+
+      def self.deprecate_resource_type(old_type, new_type)
+        define_method(old_type) do |*args, &block|
+          puts ''
+          warn Color.on_red(Color.white("!!! `#{old_type}` type is deprecated. use `#{new_type}` !!!"))
+          send(new_type, *args, &block)
+        end
+      end
+
+      deprecate_resource_type :auto_scaling_group, :autoscaling_group
+      deprecate_resource_type :s3, :s3_bucket
+    end
+  end
+end

data/lib/awspec/matcher.rb

@@ -0,0 +1,85 @@
+# EC2
+require 'awspec/matcher/belong_to_vpc'
+require 'awspec/matcher/belong_to_subnet'
+require 'awspec/matcher/have_tag'
+require 'awspec/matcher/have_network_interface'
+
+# RDS
+require 'awspec/matcher/belong_to_db_subnet_group'
+require 'awspec/matcher/have_db_parameter_group'
+require 'awspec/matcher/have_option_group'
+
+# SecurityGroup
+require 'awspec/matcher/be_opened'
+require 'awspec/matcher/be_opened_only'
+
+# Route53
+require 'awspec/matcher/have_record_set'
+
+# RouteTable
+require 'awspec/matcher/have_route'
+
+# IAM User
+require 'awspec/matcher/belong_to_iam_group'
+require 'awspec/matcher/have_inline_policy'
+
+# IAM User/Group/Role
+require 'awspec/matcher/be_allowed_action'
+
+# ElastiCache
+require 'awspec/matcher/belong_to_replication_group'
+require 'awspec/matcher/belong_to_cache_subnet_group'
+
+# CloudWatch
+require 'awspec/matcher/belong_to_metric'
+
+# NetworkAcl
+require 'awspec/matcher/be_allowed'
+require 'awspec/matcher/be_denied'
+
+# NetworkInterface
+require 'awspec/matcher/be_attached_to'
+require 'awspec/matcher/have_private_ip_address'
+
+# CloudFront
+require 'awspec/matcher/have_origin'
+require 'awspec/matcher/have_custom_response_error_code'
+
+# Kms
+require 'awspec/matcher/have_key_policy'
+
+# WafWebAcl / AlbListener
+require 'awspec/matcher/have_rule'
+
+# CloudWatch Logs
+require 'awspec/matcher/have_subscription_filter'
+
+# DynamoDB
+require 'awspec/matcher/have_attribute_definition'
+require 'awspec/matcher/have_key_schema'
+
+# EIP
+require 'awspec/matcher/belong_to_domain'
+
+# Alb Target Group
+require 'awspec/matcher/belong_to_alb'
+
+# Nlb Target Group
+require 'awspec/matcher/belong_to_nlb'
+
+# VPC
+require 'awspec/matcher/be_connected_to_vpc'
+require 'awspec/matcher/have_vpc_peering_connection'
+
+# SNSTopic
+require 'awspec/matcher/include_subscribed'
+require 'awspec/matcher/have_subscription_attributes'
+
+# Redshift
+require 'awspec/matcher/belong_to_cluster_subnet_group'
+require 'awspec/matcher/have_cluster_parameter_group'
+
+# Lambda
+require 'awspec/matcher/have_env_vars'
+require 'awspec/matcher/have_env_var'
+require 'awspec/matcher/have_env_var_value'

data/lib/awspec/matcher/be_allowed.rb

@@ -0,0 +1,25 @@
+RSpec::Matchers.define :be_allowed do |port|
+  match do |type|
+    type.allowed?(port, @protocol, @cidr, @rule_number)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+
+  chain :source do |cidr|
+    @cidr = cidr
+  end
+
+  chain :rule_number do |rule_number|
+    @rule_number = rule_number
+  end
+end

data/lib/awspec/matcher/be_allowed_action.rb

@@ -0,0 +1,19 @@
+RSpec::Matchers.define :be_allowed_action do |action_name|
+  match do |type|
+    results = type.select_policy_evaluation_results(type.resource_via_client[:arn],
+                                                    action_name,
+                                                    @resource_arn,
+                                                    @context_entries)
+    results.find do |result|
+      result.eval_decision == 'allowed'
+    end
+  end
+
+  chain :resource_arn do |arn|
+    @resource_arn = arn
+  end
+
+  chain :context_entries do |context|
+    @context_entries = context
+  end
+end

data/lib/awspec/matcher/be_attached_to.rb

@@ -0,0 +1,19 @@
+RSpec::Matchers.define :be_attached_to do |instance_id|
+  match do |type|
+    # NetworkInterface
+    if type.instance_of?(Awspec::Type::NetworkInterface)
+      return type.attached_to?(instance_id, @device_index)
+    end
+    type.attached_to?(instance_id)
+  end
+
+  chain :device_index do |device_index|
+    @device_index = device_index
+  end
+
+  (0..10).each do |idx|
+    chain "as_eth#{idx}".to_sym do
+      @device_index = idx
+    end
+  end
+end

data/lib/awspec/matcher/be_connected_to_vpc.rb

@@ -0,0 +1,13 @@
+RSpec::Matchers.define :be_connected_to_vpc do |vpc_id|
+  match do |vpc|
+    vpc.connected_to_vpc?(vpc_id, @accepter_or_requester)
+  end
+
+  chain :as_accepter do
+    @accepter_or_requester = 'accepter'
+  end
+
+  chain :as_requester do
+    @accepter_or_requester = 'requester'
+  end
+end

data/lib/awspec/matcher/be_denied.rb

@@ -0,0 +1,25 @@
+RSpec::Matchers.define :be_denied do |port|
+  match do |type|
+    type.denied?(port, @protocol, @cidr, @rule_number)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+
+  chain :source do |cidr|
+    @cidr = cidr
+  end
+
+  chain :rule_number do |rule_number|
+    @rule_number = rule_number
+  end
+end

data/lib/awspec/matcher/be_opened.rb

@@ -0,0 +1,17 @@
+RSpec::Matchers.define :be_opened do |port|
+  match do |sg|
+    sg.opened?(port, @protocol, @cidr)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+end

data/lib/awspec/matcher/be_opened_only.rb

@@ -0,0 +1,17 @@
+RSpec::Matchers.define :be_opened_only do |port|
+  match do |sg|
+    sg.opened_only?(port, @protocol, @cidr)
+  end
+
+  chain :protocol do |protocol|
+    @protocol = protocol
+  end
+
+  chain :for do |cidr|
+    @cidr = cidr
+  end
+
+  chain :target do |cidr|
+    @cidr = cidr
+  end
+end

data/lib/awspec/matcher/belong_to_alb.rb

@@ -0,0 +1,8 @@
+RSpec::Matchers.define :belong_to_alb do |alb_arn|
+  match do |type|
+    return true if type.load_balancer_arns.include?(alb_arn)
+    ret = type.find_alb(alb_arn)
+    return false unless ret
+    type.load_balancer_arns.include?(ret.load_balancer_arn)
+  end
+end

data/lib/awspec/matcher/belong_to_cache_subnet_group.rb

@@ -0,0 +1,5 @@
+RSpec::Matchers.define :belong_to_cache_subnet_group do |cache_subnet_group_name|
+  match do |type|
+    return true if type.resource_via_client[:cache_subnet_group_name] == cache_subnet_group_name
+  end
+end

data/lib/awspec/matcher/belong_to_cluster_subnet_group.rb

@@ -0,0 +1,5 @@
+RSpec::Matchers.define :belong_to_cluster_subnet_group do |cluster_subnet_group_name|
+  match do |type|
+    return true if type.resource_via_client[:cluster_subnet_group_name] == cluster_subnet_group_name
+  end
+end

data/lib/awspec/matcher/belong_to_db_subnet_group.rb

@@ -0,0 +1,5 @@
+RSpec::Matchers.define :belong_to_db_subnet_group do |db_subnet_group_name|
+  match do |type|
+    return true if type.resource_via_client[:db_subnet_group][:db_subnet_group_name] == db_subnet_group_name
+  end
+end

data/lib/awspec/matcher/belong_to_domain.rb

@@ -0,0 +1,5 @@
+RSpec::Matchers.define :belong_to_domain do |domain|
+  match do |type|
+    return true if type.resource_via_client.last[:domain] == domain
+  end
+end