inspec-iggy 0.2.0 → 0.4.0

data/lib/inspec-iggy/version.rb

@@ -4,8 +4,8 @@
 #
 # Copyright:: 2018, Chef Software, Inc <legal@chef.io>
 #
-
-# Iggy version
-module Iggy
-  VERSION = "0.2.0".freeze
+module InspecPlugins
+  module Iggy
+    VERSION = '0.4.0'.freeze
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-iggy
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Matt Ray
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-22 00:00:00.000000000 Z
+date: 2018-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inspec
@@ -16,20 +16,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.3'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 4.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.3'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 4.0.0
 description: Generate InSpec compliance profiles from Terraform by tagging instances
   and mapping Terraform to InSpec.
 email:
@@ -42,17 +42,14 @@ files:
 - README.md
 - inspec-iggy.gemspec
 - lib/inspec-iggy.rb
-- lib/inspec-iggy/cli.rb
-- lib/inspec-iggy/cloudformation.rb
+- lib/inspec-iggy/cloudformation/cli_command.rb
+- lib/inspec-iggy/cloudformation/parser.rb
 - lib/inspec-iggy/inspec_helper.rb
-- lib/inspec-iggy/terraform.rb
+- lib/inspec-iggy/plugin.rb
+- lib/inspec-iggy/profile.rb
+- lib/inspec-iggy/terraform/cli_command.rb
+- lib/inspec-iggy/terraform/parser.rb
 - lib/inspec-iggy/version.rb
-- test/bad.json
-- test/bjc-demo-aws-4.5.4.json
-- test/main.tf
-- test/outputs.tf
-- test/terraform.tfstate
-- test/variables.tf
 homepage: https://github.com/inspec/inspec-iggy
 licenses:
 - Apache-2.0
@@ -73,7 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.14.1
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: InSpec plugin to generate InSpec compliance profiles from Terraform.

data/lib/inspec-iggy/cli.rb

@@ -1,53 +0,0 @@
-# encoding: utf-8
-#
-# Author:: Matt Ray (<matt@chef.io>)
-#
-# Copyright:: 2018, Chef Software, Inc <legal@chef.io>
-#
-
-require "inspec/plugins"
-require "thor"
-
-require "inspec-iggy/terraform"
-
-module Iggy
-  class CLI < Thor
-    namespace "terraform"
-
-    map %w{-v --version} => "version"
-
-    desc "version", "Display version information", hide: true
-    def version
-      say("Iggy v#{Iggy::VERSION}")
-    end
-
-    class_option :tfstate,
-      :aliases => "-t",
-      :desc    => "Specify path to the input terraform.tfstate",
-      :default => "terraform.tfstate"
-
-    class_option :debug,
-      :desc    => "Verbose debugging messages",
-      :type    => :boolean,
-      :default => false
-
-    desc "generate [options]", "Generate InSpec compliance controls from terraform.tfstate"
-    def generate
-      Inspec::Log.level = :debug if options[:debug]
-      generated_controls = Iggy::Terraform.parse_generate(options[:tfstate])
-      # let's just generate a control file with a set of controls for now
-      Iggy::InspecHelper.print_controls(options[:tfstate], generated_controls)
-      exit 0
-    end
-
-    desc "extract [options]", "Extract tagged InSpec profiles from terraform.tfstate"
-    def extract
-      Inspec::Log.level = :debug if options[:debug]
-      extracted_profiles = Iggy::Terraform.parse_extract(options[:tfstate])
-      Iggy::InspecHelper.print_commands(extracted_profiles)
-      exit 0
-    end
-  end
-
-  Inspec::Plugins::CLI.add_subcommand(CLI, "terraform", "terraform SUBCOMMAND ...", "Extract or generate InSpec from Terraform", {})
-end

data/lib/inspec-iggy/cloudformation.rb

@@ -1,104 +0,0 @@
-#
-# Author:: Matt Ray (<matt@chef.io>)
-#
-# Copyright:: 2018, Chef Software, Inc <legal@chef.io>
-#
-
-require "iggy"
-
-require "json"
-require "thor"
-
-module Iggy
-  class CloudFormation < Thor
-    option :template,
-      :aliases => "-t",
-      :desc    => "Specify path to the input CloudFormation template"
-
-    option :debug,
-      :desc    => "Verbose debugging messages",
-      :type    => :boolean,
-      :default => false
-
-    desc "generate [options]", "Generate InSpec compliance controls from CloudFormation template"
-    long_desc <<-LONGDESC
-Reads in a CloudFormation JSON file and generates matching InSpec compliance controls.
-    LONGDESC
-    def generate
-      Iggy::Log.level = :debug if options[:debug]
-      Iggy::Log.debug "CloudFormation.generate file = #{options[:template]}"
-      # hash of generated controls
-      generated_controls = parse_generate(options[:template])
-      Iggy::Log.debug "CloudFormation.generate generated_controls = #{generated_controls}"
-      # let's just generate a control file with a set of controls for now
-      Iggy::Inspec.print_controls(options[:template], generated_controls)
-      exit 0
-    end
-
-    private
-
-    def parse_generate(file)
-      Iggy::Log.debug "CloudFormation.parse_generate file = #{file}"
-      begin
-        unless File.file?(file)
-          STDERR.puts "ERROR: #{file} is an invalid file, please check your path."
-          exit(-1)
-        end
-        template = JSON.parse(File.read(file))
-      rescue JSON::ParserError => e
-        STDERR.puts e.message
-        STDERR.puts "ERROR: Parsing error in #{file}."
-        exit(-1)
-      end
-      basename = File.basename(file)
-      absolutename = File.absolute_path(file)
-
-      # InSpec controls generated
-      generated_controls = {}
-
-      # iterate over the resources
-      cfn_resources = template["Resources"]
-      # iterate over the Resources, use these as IDs?
-      cfn_resources.keys.each do |cfn_res|
-        # split out the last ::, these are all AWS
-        cfn_res_type = "aws_" + cfn_resources[cfn_res]["Type"].split("::").last.downcase
-
-        # does this match an InSpec resource?
-        if Inspec::RESOURCES.include?(cfn_res_type)
-          Iggy::Log.debug "CloudFormation.parse_generate cfn_res_type = #{cfn_res_type} MATCH"
-          # insert new control based off the resource's ID
-          generated_controls[cfn_res] = {}
-          generated_controls[cfn_res]["name"] = "#{cfn_res_type}::#{cfn_res}"
-          generated_controls[cfn_res]["title"] = "Iggy #{basename} #{cfn_res_type}::#{cfn_res}"
-          generated_controls[cfn_res]["desc"] = "#{cfn_res_type}::#{cfn_res} from the source file #{absolutename}\nGenerated by Iggy v#{Iggy::VERSION}"
-          generated_controls[cfn_res]["impact"] = "1.0"
-          generated_controls[cfn_res]["resource"] = cfn_res_type
-          generated_controls[cfn_res]["parameter"] = cfn_res
-          generated_controls[cfn_res]["tests"] = []
-          generated_controls[cfn_res]["tests"][0] = "it { should exist }"
-
-          # if there's a match, see if there are matching InSpec properties
-          inspec_properties = Iggy::Inspec.resource_properties(cfn_res_type)
-
-          cfn_resources[cfn_res]["Properties"].keys.each do |attr|
-            # insert '_' on the CamelCase to get camel_case
-            attr_split = attr.split /(?=[A-Z])/
-            property = attr_split.join("_").downcase
-            if inspec_properties.member?(property)
-              Iggy::Log.debug "CloudFormation.parse_generate #{cfn_res_type} inspec_property = #{property} MATCH"
-              value = cfn_resources[cfn_res]["Properties"][attr]
-              # skip the {"Ref"=>"VPC"} for now
-              generated_controls[cfn_res]["tests"].push("its('#{property}') { should cmp '#{value}' }") unless value.is_a? Hash
-            else
-              Iggy::Log.debug "CloudFormation.parse_generate #{cfn_res_type} inspec_property = #{property} SKIP"
-            end
-          end
-        else
-          Iggy::Log.debug "CloudFormation.parse_generate cfn_res_type = #{cfn_res_type} SKIP"
-        end
-      end
-      generated_controls
-    end
-
-  end
-end

data/lib/inspec-iggy/terraform.rb

@@ -1,146 +0,0 @@
-#
-# Author:: Matt Ray (<matt@chef.io>)
-#
-# Copyright:: 2018, Chef Software, Inc <legal@chef.io>
-#
-
-require "inspec/objects/control"
-require "inspec/objects/ruby_helper"
-require "inspec/objects/describe"
-
-require "inspec-iggy/inspec_helper"
-
-module Iggy
-  class Terraform
-
-    # makes it easier to change out later
-    TAG_NAME = "iggy_name_"
-    TAG_URL = "iggy_url_"
-
-    # boilerplate tfstate parsing
-    def self.parse_tfstate(file)
-      Inspec::Log.debug "Iggy::Terraform.parse_tfstate file = #{file}"
-      begin
-        unless File.file?(file)
-          STDERR.puts "ERROR: #{file} is an invalid file, please check your path."
-          exit(-1)
-        end
-        tfstate = JSON.parse(File.read(file))
-      rescue JSON::ParserError => e
-        STDERR.puts e.message
-        STDERR.puts "ERROR: Parsing error in #{file}."
-        exit(-1)
-      end
-    end
-
-    # parse through the JSON for the tagged Resources
-    def self.parse_extract(file)
-      tfstate = parse_tfstate(file)
-      # InSpec profiles extracted
-      extracted_profiles = {}
-
-      # iterate over the resources
-      tf_resources = tfstate["modules"][0]["resources"]
-      tf_resources.keys.each do |tf_res|
-        tf_res_id = tf_resources[tf_res]["primary"]["id"]
-
-        # get the attributes, see if any of them have a tagged profile attached
-        tf_resources[tf_res]["primary"]["attributes"].keys.each do |attr|
-          next unless attr.start_with?("tags." + TAG_NAME)
-          Inspec::Log.debug "Iggy::Terraform.parse_extract tf_res = #{tf_res} attr = #{attr} MATCHED TAG"
-          # get the URL and the name of the profiles
-          name = attr.split(TAG_NAME)[1]
-          url = tf_resources[tf_res]["primary"]["attributes"]["tags.#{TAG_URL}#{name}"]
-          if tf_res.start_with?("aws_vpc") # should this be VPC or subnet?
-            # if it's a VPC, store it as the VPC id + name
-            key = tf_res_id + ":" + name
-            Inspec::Log.debug "Iggy::Terraform.parse_extract aws_vpc tagged with InSpec #{key}"
-            extracted_profiles[key] = {
-              "type" => "aws_vpc",
-              "az" => "us-west-2",
-              "url" => url,
-            }
-          elsif tf_res.start_with?("aws_instance")
-            # if it's a node, get information about the IP and SSH/WinRM
-            key = tf_res_id + ":" + name
-            Inspec::Log.debug "Iggy::Terraform.parse_extract aws_instance tagged with InSpec #{key}"
-            extracted_profiles[key] = {
-              "type" => "aws_instance",
-              "public_ip" => tf_resources[tf_res]["primary"]["attributes"]["public_ip"],
-              "key_name" => tf_resources[tf_res]["primary"]["attributes"]["key_name"],
-              "url" => url,
-            }
-          else
-            # should generic AWS just be the default except for instances?
-            STDERR.puts "ERROR: #{file} #{tf_res_id} has an InSpec-tagged resource but #{tf_res} is currently unsupported."
-            exit(-1)
-          end
-        end
-      end
-      Inspec::Log.debug "Iggy::Terraform.parse_extract extracted_profiles = #{extracted_profiles}"
-      extracted_profiles
-    end
-
-    # parse through the JSON and generate InSpec controls
-    def self.parse_generate(file)
-      tfstate = parse_tfstate(file)
-      basename = File.basename(file)
-      absolutename = File.absolute_path(file)
-
-      # InSpec controls generated
-      generated_controls = []
-
-      # iterate over the resources
-      tf_resources = tfstate["modules"][0]["resources"]
-      tf_resources.keys.each do |tf_res|
-        tf_res_type = tf_resources[tf_res]["type"]
-
-        # add translation layer
-        if InspecHelper::TERRAFORM_RESOURCES.keys.include?(tf_res_type)
-          Inspec::Log.debug "Iggy::Terraform.parse_generate tf_res_type = #{tf_res_type} #{InspecHelper::TERRAFORM_RESOURCES[tf_res_type]} TRANSLATED"
-          tf_res_type = InspecHelper::TERRAFORM_RESOURCES[tf_res_type]
-        end
-
-        # does this match an InSpec resource?
-        if InspecHelper::RESOURCES.include?(tf_res_type)
-          Inspec::Log.debug "Iggy::Terraform.parse_generate tf_res_type = #{tf_res_type} MATCH"
-          tf_res_id = tf_resources[tf_res]["primary"]["id"]
-
-          # insert new control based off the resource's ID
-          ctrl = Inspec::Control.new
-          ctrl.id = "#{tf_res_type}::#{tf_res_id}"
-          ctrl.title = "Iggy #{basename} #{tf_res_type}::#{tf_res_id}"
-          ctrl.desc = "#{tf_res_type}::#{tf_res_id} from the source file #{absolutename}\nGenerated by Iggy v#{Iggy::VERSION}"
-          ctrl.impact = "1.0"
-
-          describe = Inspec::Describe.new
-          # describes the resourde with the id as argument
-          describe.qualifier.push([tf_res_type, tf_res_id])
-
-          # ensure the resource exists
-          describe.add_test(nil, "exist", nil)
-
-          # if there's a match, see if there are matching InSpec properties
-          inspec_properties = Iggy::InspecHelper.resource_properties(tf_res_type)
-          tf_resources[tf_res]["primary"]["attributes"].keys.each do |attr|
-            if inspec_properties.member?(attr)
-              Inspec::Log.debug "Iggy::Terraform.parse_generate #{tf_res_type} inspec_property = #{attr} MATCH"
-              value = tf_resources[tf_res]["primary"]["attributes"][attr]
-              describe.add_test(attr, "cmp", value)
-            else
-              Inspec::Log.debug "Iggy::Terraform.parse_generate #{tf_res_type} inspec_property = #{attr} SKIP"
-            end
-          end
-
-          ctrl.add_test(describe)
-          generated_controls.push(ctrl)
-        else
-          Inspec::Log.debug "Iggy::Terraform.parse_generate tf_res_type = #{tf_res_type} SKIP"
-        end
-      end
-      Inspec::Log.debug "Iggy::Terraform.parse_generate generated_controls = #{generated_controls}"
-      generated_controls
-    end
-
-  end
-end

data/test/bad.json

@@ -1,6 +0,0 @@
-{
-    this
-    file
-    is
-    junk
-}

data/test/bjc-demo-aws-4.5.4.json

@@ -1,851 +0,0 @@
-
-{
-  "AWSTemplateFormatVersion": "2010-09-09",
-  "Description": "BJC Chef Demo (4.5.4)",
-  "Parameters": {
-    "AvailabilityZone": {
-      "Description": "Availability Zone",
-      "Type": "String",
-      "Default": "us-west-2c"
-    },
-    "DemoName": {
-      "Description": "Name of the customer or organization",
-      "Type": "String",
-      "Default": "bjc-demo"
-    },
-    "Version": {
-      "Description": "Version",
-      "Type": "String",
-      "Default": "4.5.4"
-    },
-    "KeyName": {
-      "Description": "Name of an existing ec2 KeyPair to enable SSH access",
-      "Type": "AWS::EC2::KeyPair::KeyName",
-      "ConstraintDescription": "must be the name of an existing EC2 KeyPair."
-    },
-    "SSHLocation": {
-      "Description": "The IP address range that can be used to SSH to the EC2 instances",
-      "Type": "String",
-      "MinLength": "9",
-      "MaxLength": "18",
-      "Default": "0.0.0.0/0",
-      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
-      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
-    },
-    "TTL": {
-      "Description": "Time in hours for the demo to stay active. Default is 4, maximum is 720 hours (30 days).",
-      "Type": "Number",
-      "Default": 8,
-      "MinValue": 0,
-      "MaxValue": 720
-    },
-    "ChefServerAMI": {
-      "Type": "String",
-      "Default": "ami-3e6f1a46",
-      "Description": "AMI ID for the Chef Server"
-    },
-    "BuildNode1AMI": {
-      "Type": "String",
-      "Default": "ami-cb6f1ab3",
-      "Description": "AMI ID for Build Node 1"
-    },
-    "BuildNode2AMI": {
-      "Type": "String",
-      "Default": "ami-3c6d1844",
-      "Description": "AMI ID for Build Node 2"
-    },
-    "BuildNode3AMI": {
-      "Type": "String",
-      "Default": "ami-4b6f1a33",
-      "Description": "AMI ID for Build Node 3"
-    },
-    "deliveredAMI": {
-      "Type": "String",
-      "Default": "ami-676f1a1f",
-      "Description": "AMI ID for delivered"
-    },
-    "ecomacceptanceAMI": {
-      "Type": "String",
-      "Default": "ami-de6c19a6",
-      "Description": "AMI ID for ecomacceptance"
-    },
-    "rehearsalAMI": {
-      "Type": "String",
-      "Default": "ami-846c19fc",
-      "Description": "AMI ID for rehearsal"
-    },
-    "unionAMI": {
-      "Type": "String",
-      "Default": "ami-1f621767",
-      "Description": "AMI ID for union"
-    },
-    "WindowsWorkstation1AMI": {
-      "Type": "String",
-      "Default": "ami-ba6e1bc2",
-      "Description": "AMI ID for the Windows Workstation"
-    },
-    "AutomateAMI": {
-      "Type": "String",
-      "Default": "ami-7d6c1905",
-      "Description": "AMI ID for the Automate Server"
-    }
-  },
-  "Resources": {
-    "InstanceProfile" : {
-      "Type" : "AWS::IAM::InstanceProfile",
-      "Properties" : {
-        "Path" : "/",
-        "Roles" : ["chefDemo"]
-      }
-    },
-    "VPC": {
-      "Type": "AWS::EC2::VPC",
-      "Properties": {
-        "CidrBlock": "172.31.0.0/16",
-        "EnableDnsSupport": "true",
-        "EnableDnsHostnames": "true",
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "VPC" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "SubnetAutomate": {
-      "Type": "AWS::EC2::Subnet",
-      "Properties": {
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "CidrBlock": "172.31.54.0/24",
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Automate Subnet" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "SubnetProd": {
-      "Type": "AWS::EC2::Subnet",
-      "Properties": {
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "CidrBlock": "172.31.62.0/24",
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Prod Subnet" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "SubnetWorkstations": {
-      "Type": "AWS::EC2::Subnet",
-      "Properties": {
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "CidrBlock": "172.31.10.0/24",
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Workstations Subnet" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "InternetGateway": {
-      "Type": "AWS::EC2::InternetGateway",
-      "Properties": {
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, " IG" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "AttachGateway": {
-      "Type": "AWS::EC2::VPCGatewayAttachment",
-      "Properties": {
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "InternetGatewayId": {
-          "Ref": "InternetGateway"
-        }
-      }
-    },
-    "RouteTable": {
-      "Type": "AWS::EC2::RouteTable",
-      "Properties": {
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Demo RouteTable" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "Route": {
-      "Type": "AWS::EC2::Route",
-      "DependsOn": "AttachGateway",
-      "Properties": {
-        "RouteTableId": {
-          "Ref": "RouteTable"
-        },
-        "DestinationCidrBlock": "0.0.0.0/0",
-        "GatewayId": {
-          "Ref": "InternetGateway"
-        }
-      }
-    },
-    "SubnetRouteTableAssociationAutomate": {
-      "Type": "AWS::EC2::SubnetRouteTableAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetAutomate"
-        },
-        "RouteTableId": {
-          "Ref": "RouteTable"
-        }
-      }
-    },
-    "SubnetRouteTableAssociationProd": {
-      "Type": "AWS::EC2::SubnetRouteTableAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetProd"
-        },
-        "RouteTableId": {
-          "Ref": "RouteTable"
-        }
-      }
-    },
-    "SubnetRouteTableAssociationWorkstations": {
-      "Type": "AWS::EC2::SubnetRouteTableAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetWorkstations"
-        },
-        "RouteTableId": {
-          "Ref": "RouteTable"
-        }
-      }
-    },
-    "NetworkAcl": {
-      "Type": "AWS::EC2::NetworkAcl",
-      "Properties": {
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "Tags": [
-          {
-            "Key": "Application",
-            "Value": {
-              "Ref": "AWS::StackId"
-            },
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "NetworkAcl" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "InboundNetworkAclEntry": {
-      "Type": "AWS::EC2::NetworkAclEntry",
-      "Properties": {
-        "NetworkAclId": {
-          "Ref": "NetworkAcl"
-        },
-        "RuleNumber": "100",
-        "Protocol": "-1",
-        "RuleAction": "allow",
-        "Egress": "false",
-        "CidrBlock": "0.0.0.0/0"
-      }
-    },
-    "OutBoundNetworkAclEntry": {
-      "Type": "AWS::EC2::NetworkAclEntry",
-      "Properties": {
-        "NetworkAclId": {
-          "Ref": "NetworkAcl"
-        },
-        "RuleNumber": "100",
-        "Protocol": "-1",
-        "RuleAction": "allow",
-        "Egress": "true",
-        "CidrBlock": "0.0.0.0/0"
-      }
-    },
-    "SubnetNetworkAclAssociationAutomate": {
-      "Type": "AWS::EC2::SubnetNetworkAclAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetAutomate"
-        },
-        "NetworkAclId": {
-          "Ref": "NetworkAcl"
-        }
-      }
-    },
-    "SubnetNetworkAclAssociationProd": {
-      "Type": "AWS::EC2::SubnetNetworkAclAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetProd"
-        },
-        "NetworkAclId": {
-          "Ref": "NetworkAcl"
-        }
-      }
-    },
-    "SubnetNetworkAclAssociationPOCWorkstations": {
-      "Type": "AWS::EC2::SubnetNetworkAclAssociation",
-      "Properties": {
-        "SubnetId": {
-          "Ref": "SubnetWorkstations"
-        },
-        "NetworkAclId": {
-          "Ref": "NetworkAcl"
-        }
-      }
-    },
-    "WindowsWorkstation1": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "c4.large",
-        "EbsOptimized" : "true",
-        "IamInstanceProfile" : {"Ref" : "InstanceProfile"},
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.201",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": {
-          "Ref": "KeyName"
-        },
-        "UserData" : {
-          "Fn::Base64" : {
-            "Fn::Join" : [
-              "",
-                ["<powershell>\n",
-                  "set-executionpolicy -executionpolicy unrestricted -force -scope LocalMachine",
-                 "</powershell>"
-               ]
-            ]
-          }
-        },
-        "ImageId": {
-              "Ref": "WindowsWorkstation1AMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Workstation" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "BuildNode1": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.51",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname build-node-1\n",
-             "sleep 90\n",
-             "sudo chef-client\n"]]}
-        },
-        "ImageId": {
-              "Ref": "BuildNode1AMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Build Node 1" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "BuildNode2": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.52",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname build-node-2\n",
-             "sleep 90\n",
-             "sudo chef-client\n"]]}
-        },
-        "ImageId": {
-              "Ref": "BuildNode2AMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Build Node 2" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "BuildNode3": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.53",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname build-node-3\n",
-             "sleep 90\n",
-             "sudo chef-client\n"]]}
-        },
-        "ImageId": {
-              "Ref": "BuildNode3AMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Build Node 3" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "delivered": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.101",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname delivered\n",
-             "sleep 90\n",
-             "sudo chef-client\n"
-             ]]}
-        },
-        "ImageId": {
-              "Ref": "deliveredAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "delivered" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "ecomacceptance": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.102",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname ecomacceptance\n",
-             "sleep 90\n",
-             "sudo chef-client\n"
-             ]]}
-        },
-        "ImageId": {
-              "Ref": "ecomacceptanceAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "ecomacceptance" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "rehearsal": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.103",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname rehearsal\n",
-             "sleep 90\n",
-             "sudo chef-client\n"
-             ]]}
-        },
-        "ImageId": {
-              "Ref": "rehearsalAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "rehearsal" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "union": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "m4.large",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.104",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname union\n",
-             "sleep 90\n",
-             "sudo chef-client\n"
-             ]]}
-        },
-        "ImageId": {
-              "Ref": "unionAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "union" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "Chef": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "c4.xlarge",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-      	"BlockDeviceMappings" : [
-         	{
-        	  "DeviceName" : "/dev/sda1",
-        	  "Ebs" : { "VolumeSize" : "50" }
-         	}
-      	],
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.10",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname chef\n",
-             "chef-server-ctl reconfigure\n"]]}
-        },
-        "ImageId": {
-              "Ref": "ChefServerAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Chef Server" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "Automate": {
-      "Type": "AWS::EC2::Instance",
-      "Properties": {
-        "InstanceType": "c4.xlarge",
-        "AvailabilityZone": { "Ref": "AvailabilityZone" },
-      	"BlockDeviceMappings" : [
-         	{
-            	  "DeviceName" : "/dev/sda1",
-            	  "Ebs" : { "VolumeSize" : "50" }
-         	}
-      	] ,
-        "NetworkInterfaces": [
-          {
-            "GroupSet": [
-              {
-                "Ref": "DemoSecurityGroup"
-              }
-            ],
-            "AssociatePublicIpAddress": "true",
-            "PrivateIpAddress": "172.31.54.11",
-            "DeviceIndex": "0",
-            "DeleteOnTermination": "true",
-            "SubnetId": {
-              "Ref": "SubnetAutomate"
-            }
-          }
-        ],
-        "KeyName": { "Ref": "KeyName" },
-        "UserData": { "Fn::Base64" : { "Fn::Join" : ["", [
-             "#!/bin/bash -xe\n",
-             "hostnamectl set-hostname automate\n",
-             "delivery-ctl reconfigure\n"]]}
-        },
-        "ImageId": {
-              "Ref": "AutomateAMI"
-        },
-        "Tags": [
-          {
-            "Key": "Name",
-            "Value": {
-              "Fn::Join" : [ " ", [ { "Ref": "DemoName" }, "Automate Server" ] ]
-            }
-          }
-        ]
-      }
-    },
-    "DemoSecurityGroup": {
-      "Type": "AWS::EC2::SecurityGroup",
-      "Properties": {
-        "VpcId": {
-          "Ref": "VPC"
-        },
-        "GroupDescription": "Enable required ports for Chef Server",
-        "SecurityGroupIngress": [
-          {
-            "IpProtocol": "tcp",
-            "FromPort": "22",
-            "ToPort": "22",
-            "CidrIp": {
-              "Ref": "SSHLocation"
-            }
-          },
-          {
-            "IpProtocol": "tcp",
-            "FromPort": "0",
-            "ToPort": "65535",
-            "CidrIp": "172.31.0.0/16"
-          },
-          {
-            "IpProtocol": "tcp",
-            "FromPort": "3389",
-            "ToPort": "3389",
-            "CidrIp": "0.0.0.0/0"
-          },
-          {
-            "IpProtocol": "tcp",
-            "FromPort": "443",
-            "ToPort": "443",
-            "CidrIp": "0.0.0.0/0"
-          },
-          {
-            "IpProtocol": "icmp",
-            "FromPort": "8",
-            "ToPort": "-1",
-            "CidrIp": "0.0.0.0/0"
-          },
-          {
-            "IpProtocol": "udp",
-            "FromPort": "3389",
-            "ToPort": "3389",
-            "CidrIp": "0.0.0.0/0"
-          },
-          {
-            "IpProtocol": "tcp",
-            "FromPort": "5985",
-            "ToPort": "5985",
-            "CidrIp": "0.0.0.0/0"
-          }
-        ]
-      }
-    }
-  },
-  "Outputs":
-{"WindowsWorkstation1PubDNS":{"Description":"Public IP address of the Windows Workstation","Value":{"Fn::GetAtt":["WindowsWorkstation1","PublicIp"]}}}
-}