inspec 4.22.1

data/lib/plugins/inspec-init/templates/profiles/azure/controls/example.rb

@@ -0,0 +1,14 @@
+# copyright: 2018, The Authors
+
+title "Sample Section"
+
+# you add controls here
+control "azure-virtual-machines-exist-check" do                                # A unique ID for this control.
+  impact 1.0                                                                   # The criticality, if this control fails.
+  title "Check resource groups to see if any VMs exist."                       # A human-readable title
+  azurerm_resource_groups.names.each do |resource_group_name|                  # Plural resources can be leveraged to loop across many resources
+    describe azurerm_virtual_machines(resource_group: resource_group_name) do
+      it { should exist } # The test itself.
+    end
+  end
+end

data/lib/plugins/inspec-init/templates/profiles/azure/inspec.yml

@@ -0,0 +1,14 @@
+name: <%= name %>
+title: Azure InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile For Azure
+version: 0.1.0
+inspec_version: '>= 2.2.7'
+depends:
+- name: inspec-azure
+  url: https://github.com/inspec/inspec-azure/archive/master.tar.gz
+supports:
+- platform: azure

data/lib/plugins/inspec-init/templates/profiles/gcp/README.md

@@ -0,0 +1,66 @@
+# Example InSpec Profile For GCP
+
+This example shows the implementation of an InSpec profile for GCP that depends on the [InSpec GCP Resource Pack](https://github.com/inspec/inspec-gcp).  See the [README](https://github.com/inspec/inspec-gcp) for instructions on setting up appropriate GCP credentials.
+
+##  Create a profile 
+
+```
+$ inspec init profile --platform gcp my-profile
+Create new profile at /Users/spaterson/my-profile
+ * Create directory libraries
+ * Create file README.md
+ * Create directory controls
+ * Create file controls/example.rb
+ * Create file inspec.yml
+ * Create file attributes.yml
+ * Create file libraries/.gitkeep 
+ 
+```
+
+## Update `attributes.yml` to point to your project
+
+```
+gcp_project_id: 'my-gcp-project'
+```
+
+## Run the tests
+
+```
+$ cd gcp-profile/
+$ inspec exec . -t gcp:// --attrs attributes.yml
+
+Profile: GCP InSpec Profile (my-profile)
+Version: 0.1.0
+Target:  gcp://local-service-account@my-gcp-project.iam.gserviceaccount.com
+
+  ✔  gcp-single-region-1.0: Ensure single region has the correct properties.
+     ✔  Region europe-west2 zone_names should include "europe-west2-a"
+  ✔  gcp-regions-loop-1.0: Ensure regions have the correct properties in bulk.
+     ✔  Region asia-east1 should be up
+     ✔  Region asia-northeast1 should be up
+     ✔  Region asia-south1 should be up
+     ✔  Region asia-southeast1 should be up
+     ✔  Region australia-southeast1 should be up
+     ✔  Region europe-north1 should be up
+     ✔  Region europe-west1 should be up
+     ✔  Region europe-west2 should be up
+     ✔  Region europe-west3 should be up
+     ✔  Region europe-west4 should be up
+     ✔  Region northamerica-northeast1 should be up
+     ✔  Region southamerica-east1 should be up
+     ✔  Region us-central1 should be up
+     ✔  Region us-east1 should be up
+     ✔  Region us-east4 should be up
+     ✔  Region us-west1 should be up
+     ✔  Region us-west2 should be up
+
+
+Profile: Google Cloud Platform Resource Pack (inspec-gcp)
+Version: 0.5.0
+Target:  gcp://local-service-account@my-gcp-project.iam.gserviceaccount.com
+
+     No tests executed.
+
+Profile Summary: 2 successful controls, 0 control failures, 0 controls skipped
+Test Summary: 18 successful, 0 failures, 0 skipped
+```

data/lib/plugins/inspec-init/templates/profiles/gcp/attributes.yml

@@ -0,0 +1,2 @@
+# Below is to be uncommented and set with your GCP project ID:
+# gcp_project_id: 'your-gcp-project'

data/lib/plugins/inspec-init/templates/profiles/gcp/controls/example.rb

@@ -0,0 +1,27 @@
+# copyright: 2018, The Authors
+
+title "Sample Section"
+
+gcp_project_id = attribute("gcp_project_id")
+
+# you add controls here
+control "gcp-single-region-1.0" do                                                    # A unique ID for this control
+  impact 1.0                                                                          # The criticality, if this control fails.
+  title "Ensure single region has the correct properties."                            # A human-readable title
+  desc "An optional description..."
+  describe google_compute_region(project: gcp_project_id, name: "europe-west2") do    # The actual test
+    its("zone_names") { should include "europe-west2-a" }
+  end
+end
+
+# plural resources can be leveraged to loop across many resources
+control "gcp-regions-loop-1.0" do                                                     # A unique ID for this control
+  impact 1.0                                                                          # The criticality, if this control fails.
+  title "Ensure regions have the correct properties in bulk."                         # A human-readable title
+  desc "An optional description..."
+  google_compute_regions(project: gcp_project_id).region_names.each do |region_name|  # Loop across all regions by name
+    describe google_compute_region(project: gcp_project_id, name: region_name) do     # The test for a single region
+      it { should be_up }
+    end
+  end
+end

data/lib/plugins/inspec-init/templates/profiles/gcp/inspec.yml

@@ -0,0 +1,19 @@
+name: <%= name %>
+title: GCP InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile For GCP
+version: 0.1.0
+inspec_version: '>= 2.3.5'
+attributes:
+- name: gcp_project_id
+  required: true
+  description: 'The GCP project identifier.'
+  type: string
+depends:
+- name: inspec-gcp
+  url: https://github.com/inspec/inspec-gcp/archive/master.tar.gz
+supports:
+- platform: gcp

data/lib/resource_support/aws.rb

@@ -0,0 +1,76 @@
+# Main AWS loader file.  The intent is for this to be
+# loaded only if AWS resources are needed.
+
+require "aws-sdk-core"
+
+require "aws-sdk-cloudtrail"
+require "aws-sdk-cloudwatch"
+require "aws-sdk-cloudwatchlogs"
+require "aws-sdk-costandusagereportservice"
+require "aws-sdk-configservice"
+require "aws-sdk-ec2"
+require "aws-sdk-ecs"
+require "aws-sdk-eks"
+require "aws-sdk-elasticloadbalancing"
+require "aws-sdk-iam"
+require "aws-sdk-kms"
+require "aws-sdk-rds"
+require "aws-sdk-s3"
+require "aws-sdk-sqs"
+require "aws-sdk-sns"
+
+require "resource_support/aws/aws_backend_factory_mixin"
+require "resource_support/aws/aws_resource_mixin"
+require "resource_support/aws/aws_singular_resource_mixin"
+require "resource_support/aws/aws_plural_resource_mixin"
+require "resource_support/aws/aws_backend_base"
+
+# Load all AWS resources
+# TODO: loop over and load entire directory
+# for f in ls lib/resources/aws/*; do t=$(echo $f | cut -c 5- | cut -f1 -d. ); echo "require '${t}'"; done
+require "resources/aws/aws_billing_report"
+require "resources/aws/aws_billing_reports"
+require "resources/aws/aws_cloudtrail_trail"
+require "resources/aws/aws_cloudtrail_trails"
+require "resources/aws/aws_cloudwatch_alarm"
+require "resources/aws/aws_cloudwatch_log_metric_filter"
+require "resources/aws/aws_config_delivery_channel"
+require "resources/aws/aws_config_recorder"
+require "resources/aws/aws_ec2_instance"
+require "resources/aws/aws_ebs_volume"
+require "resources/aws/aws_ebs_volumes"
+require "resources/aws/aws_flow_log"
+require "resources/aws/aws_ec2_instances"
+require "resources/aws/aws_ecs_cluster"
+require "resources/aws/aws_eks_cluster"
+require "resources/aws/aws_elb"
+require "resources/aws/aws_elbs"
+require "resources/aws/aws_iam_access_key"
+require "resources/aws/aws_iam_access_keys"
+require "resources/aws/aws_iam_group"
+require "resources/aws/aws_iam_groups"
+require "resources/aws/aws_iam_password_policy"
+require "resources/aws/aws_iam_policies"
+require "resources/aws/aws_iam_policy"
+require "resources/aws/aws_iam_role"
+require "resources/aws/aws_iam_root_user"
+require "resources/aws/aws_iam_user"
+require "resources/aws/aws_iam_users"
+require "resources/aws/aws_kms_key"
+require "resources/aws/aws_kms_keys"
+require "resources/aws/aws_rds_instance"
+require "resources/aws/aws_route_table"
+require "resources/aws/aws_route_tables"
+require "resources/aws/aws_s3_bucket"
+require "resources/aws/aws_s3_bucket_object"
+require "resources/aws/aws_s3_buckets"
+require "resources/aws/aws_security_group"
+require "resources/aws/aws_security_groups"
+require "resources/aws/aws_sns_subscription"
+require "resources/aws/aws_sns_topic"
+require "resources/aws/aws_sns_topics"
+require "resources/aws/aws_sqs_queue"
+require "resources/aws/aws_subnet"
+require "resources/aws/aws_subnets"
+require "resources/aws/aws_vpc"
+require "resources/aws/aws_vpcs"

data/lib/resource_support/aws/aws_backend_base.rb

@@ -0,0 +1,12 @@
+class AwsBackendBase
+  attr_reader :aws_transport
+  class << self; attr_accessor :aws_client_class end
+
+  def initialize(inspec = nil)
+    @aws_transport = inspec ? inspec.backend : nil
+  end
+
+  def aws_service_client
+    aws_transport.aws_client(self.class.aws_client_class)
+  end
+end

data/lib/resource_support/aws/aws_backend_factory_mixin.rb

@@ -0,0 +1,12 @@
+# Intended to be pulled in via extend, not include
+module AwsBackendFactoryMixin
+  def create(inspec)
+    @selected_backend.new(inspec)
+  end
+
+  def select(klass)
+    @selected_backend = klass
+  end
+
+  alias set_default_backend select
+end

data/lib/resource_support/aws/aws_plural_resource_mixin.rb

@@ -0,0 +1,24 @@
+require "resource_support/aws/aws_resource_mixin"
+require "resource_support/aws/aws_backend_factory_mixin"
+
+module AwsPluralResourceMixin
+  include AwsResourceMixin
+  attr_reader :table
+
+  # This sets up a class, AwsSomeResource::BackendFactory, that
+  # provides a mechanism to create and use backends without
+  # having to know which is selected.  This is mainly used for
+  # unit testing.
+  # TODO: DRY up.  This code exists in both the Singular and Plural mixins.
+  # We'd like to put it in AwsResourceMixin, but included only sees the
+  # directly-including class - we can't see second-order includers.
+  def self.included(base)
+    # Create a new class, whose body is simply to extend the
+    # backend factory mixin
+    resource_backend_factory_class = Class.new(Object) do
+      extend AwsBackendFactoryMixin
+    end
+    # Name that class
+    base.const_set("BackendFactory", resource_backend_factory_class)
+  end
+end

data/lib/resource_support/aws/aws_resource_mixin.rb

@@ -0,0 +1,69 @@
+module AwsResourceMixin
+  def initialize(resource_params = {})
+    Inspec.deprecate(:aws_resources_in_resource_pack,
+                     "Resource '#{@__resource_name__ ||= self.class.to_s}'")
+    validate_params(resource_params).each do |param, value|
+      instance_variable_set(:"@#{param}", value)
+    end
+    catch_aws_errors do
+      fetch_from_api
+    end
+  rescue ArgumentError => e
+    # continue with ArgumentError if testing
+    raise unless respond_to?(:inspec) && inspec
+
+    raise Inspec::Exceptions::ResourceFailed, e.message
+  end
+
+  # Default implementation of validate params accepts everything.
+  def validate_params(resource_params)
+    resource_params
+  end
+
+  def check_resource_param_names(raw_params: {}, allowed_params: [], allowed_scalar_name: nil, allowed_scalar_type: nil)
+    # Some resources allow passing in a single ID value.  Check and convert to hash if so.
+    if allowed_scalar_name && !raw_params.is_a?(Hash)
+      value_seen = raw_params
+      if value_seen.is_a?(allowed_scalar_type)
+        raw_params = { allowed_scalar_name => value_seen }
+      else
+        raise ArgumentError, "If you pass a single value to the resource, it must " \
+                             "be a #{allowed_scalar_type}, not an #{value_seen.class}."
+      end
+    end
+
+    # Remove all expected params from the raw param hash
+    recognized_params = {}
+    allowed_params.each do |expected_param|
+      recognized_params[expected_param] = raw_params.delete(expected_param) if raw_params.key?(expected_param)
+    end
+
+    # Any leftovers are unwelcome
+    unless raw_params.empty?
+      raise ArgumentError, "Unrecognized resource param '#{raw_params.keys.first}'. Expected parameters: #{allowed_params.join(", ")}"
+    end
+
+    recognized_params
+  end
+
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    inspec if respond_to?(:inspec)
+  end
+
+  # Intercept AWS exceptions
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource("No AWS credentials available")
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+end

data/lib/resource_support/aws/aws_singular_resource_mixin.rb

@@ -0,0 +1,27 @@
+require "resource_support/aws/aws_resource_mixin"
+require "resource_support/aws/aws_backend_factory_mixin"
+
+module AwsSingularResourceMixin
+  include AwsResourceMixin
+
+  def exists?
+    @exists
+  end
+
+  # This sets up a class, AwsSomeResource::BackendFactory, that
+  # provides a mechanism to create and use backends without
+  # having to know which is selected.  This is mainly used for
+  # unit testing.
+  # TODO: DRY up.  This code exists in both the Singular and Plural mixins.
+  # We'd like to put it in AwsResourceMixin, but included only sees the
+  # directly-including class - we can't see second-order includers.
+  def self.included(base)
+    # Create a new class, whose body is simply to extend the
+    # backend factory mixin
+    resource_backend_factory_class = Class.new(Object) do
+      extend AwsBackendFactoryMixin
+    end
+    # Name that class
+    base.const_set("BackendFactory", resource_backend_factory_class)
+  end
+end

data/lib/resources/aws/aws_billing_report.rb

@@ -0,0 +1,107 @@
+require "resource_support/aws/aws_singular_resource_mixin"
+require "resource_support/aws/aws_backend_base"
+
+require "resource_support/aws/aws_singular_resource_mixin"
+require "resource_support/aws/aws_backend_base"
+require "aws-sdk-costandusagereportservice.rb"
+
+class AwsBillingReport < Inspec.resource(1)
+  name "aws_billing_report"
+  supports platform: "aws"
+  desc "Verifies settings for AWS Cost and Billing Reports."
+  example <<~EXAMPLE
+    describe aws_billing_report('inspec1') do
+      its('report_name') { should cmp 'inspec1' }
+      its('time_unit') { should cmp 'hourly' }
+    end
+
+    describe aws_billing_report(report: 'inspec1') do
+      it { should exist }
+    end
+  EXAMPLE
+
+  include AwsSingularResourceMixin
+
+  attr_reader :report_name, :time_unit, :format, :compression, :s3_bucket,
+              :s3_prefix, :s3_region
+
+  def to_s
+    "AWS Billing Report #{report_name}"
+  end
+
+  def hourly?
+    exists? ? time_unit.eql?("hourly") : nil
+  end
+
+  def daily?
+    exists? ? time_unit.eql?("daily") : nil
+  end
+
+  def zip?
+    exists? ? compression.eql?("zip") : nil
+  end
+
+  def gzip?
+    exists? ? compression.eql?("gzip") : nil
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:report_name],
+      allowed_scalar_name: :report_name,
+      allowed_scalar_type: String
+    )
+
+    if validated_params.empty?
+      raise ArgumentError, "You must provide the parameter 'report_name' to aws_billing_report."
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    report = find_report(report_name)
+    @exists = !report.nil?
+    if exists?
+      @time_unit = report.time_unit.downcase
+      @format = report.format.downcase
+      @compression = report.compression.downcase
+      @s3_bucket = report.s3_bucket
+      @s3_prefix = report.s3_prefix
+      @s3_region = report.s3_region
+    end
+  end
+
+  def find_report(report_name)
+    pagination_opts = {}
+    found_report_def = nil
+    while found_report_def.nil?
+      api_result = backend.describe_report_definitions(pagination_opts)
+      next_token = api_result.next_token
+      found_report_def = api_result.report_definitions.find { |report_def| report_def.report_name == report_name }
+      pagination_opts = { next_token: next_token }
+
+      next if found_report_def.nil? && next_token        # Loop again: didn't find it, but there are more results
+      break if found_report_def.nil? && next_token.nil?  # Give up: didn't find it, no more results
+    end
+    found_report_def
+  end
+
+  def backend
+    @backend ||= BackendFactory.create(inspec_runner)
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      AwsBillingReport::BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CostandUsageReportService::Client
+
+      def describe_report_definitions(query = {})
+        aws_service_client.describe_report_definitions(query)
+      end
+    end
+  end
+end