inspec 1.51.25 → 2.0.16

data/docs/resources/zfs_pool.md.erb

@@ -1,5 +1,6 @@
 ---
 title: About the zfs_pool Resource
+platform: linux
 ---
 
 # zfs_pool
@@ -43,4 +44,4 @@ The following examples show how to use this InSpec audit resource.
 
 ## Matchers
 
-This InSpec audit resource dynamically exposes all ZFS pool properties available (see: `man zpool` for the list of supported properties). For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+This InSpec audit resource dynamically exposes all ZFS pool properties available (see: `man zpool` for the list of supported properties). For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).

data/examples/profile-aws/controls/iam_password_policy_expiration.rb

@@ -0,0 +1,8 @@
+control 'iam_password_policy_expiration' do
+  title 'Passwords must be set to expire'
+  impact 1.0
+
+  describe aws_iam_password_policy do
+    it { should expire_passwords }
+  end
+end

data/examples/profile-aws/controls/iam_password_policy_max_age.rb

@@ -0,0 +1,8 @@
+control 'iam_password_policy_max_age' do
+  title 'Passwords older than 90 days are not allowed'
+  impact 1.0
+
+  describe aws_iam_password_policy do
+    its('max_password_age_in_days') { should cmp <=90 }
+  end
+end

data/examples/profile-aws/controls/iam_root_user_mfa.rb

@@ -0,0 +1,8 @@
+control 'iam_root_user_mfa' do
+  title 'MFA should be enabled for the root user'
+  impact 1.0
+
+  describe aws_iam_root_user do
+    it { should have_mfa_enabled }
+  end
+end

data/examples/profile-aws/controls/iam_users_access_key_age.rb

@@ -0,0 +1,8 @@
+control 'iam_users_access_key_age' do
+  title 'No access keys may be older than 90 days'
+  impact 1.0
+
+  describe aws_iam_access_keys.where { created_days_ago > 90 } do
+    its('entries') { should be_empty }
+  end
+end

data/examples/profile-aws/controls/iam_users_console_users_mfa.rb

@@ -0,0 +1,8 @@
+control 'iam_users_console_users_mfa' do
+  title 'Users with console access must have MFA enabled'
+  impact 1.0
+
+  describe aws_iam_users.where { has_console_password and not has_mfa_enabled } do
+    its('entries') { should be_empty }
+  end
+end

data/examples/profile-aws/inspec.yml

@@ -0,0 +1,11 @@
+name: profile-aws
+title: AWS Example Profile
+maintainer: Chef Software, Inc.
+copyright: Chef Software, Inc.
+copyright_email: support@chef.io
+license: Apache-2.0
+summary: Demonstrates the use of an InSpec Compliance Profile on AWS
+version: 1.0.0
+
+supports:
+  - platform: aws

data/examples/profile-azure/controls/azure_resource_group_example.rb

@@ -0,0 +1,24 @@
+control 'azure_resource_group_example' do
+  title 'Check if the Example Resource Group matches expectations'
+  impact 1.0
+
+  describe azure_resource_group(name: 'Inspec-Azure') do
+    # Check if the Resource Group is located in the correct region
+    its('location') { should cmp 'westeurope' }
+
+    # Check if the Resource Group has tags
+    it { should have_tags }
+
+    # Check if the number of VMs in the Resource Group is correct
+    its('vm_count') { should eq 3 }
+
+    # Check if the number of public IPs is correct
+    its('public_ip_count') { should eq 1 }
+
+    # Check if the number of Network Security Groups is correct
+    its('nsg_count') { should eq 1 }
+
+    # Check if the number of Storage Accounts is correct
+    its('sa_count') { should eq 1 }
+  end
+end

data/examples/profile-azure/controls/azure_vm_example.rb

@@ -0,0 +1,29 @@
+control 'azure_vm_example' do
+  title 'Check if the Example VM matches expectations'
+  impact 1.0
+
+  describe azure_generic_resource(group_name: 'Inspec-Azure', name: 'Windows-Example-VM') do
+    # Check if the VM is located in the correct region
+    its('location') { should cmp 'westeurope' }
+
+    # Check if the VM has tags
+    it { should_not have_tags }
+
+    # Check if the VM has the correct image
+    its('properties.storageProfile.imageReference.publisher') { should cmp 'MicrosoftWindowsServer' }
+    its('properties.storageProfile.imageReference.offer') { should cmp 'WindowsServer' }
+    its('properties.storageProfile.imageReference.sku') { should cmp '2016-Datacenter' }
+
+    # Check if the VM has the correct size
+    its('properties.hardwareProfile.vmSize') { should cmp 'Standard_DS2_v2' }
+
+    # Check if the VM has the correct computer name
+    its('properties.osProfile.computerName') { should eq 'SomethingObscure' }
+
+    # Check if the VM has the correct admin username
+    its('properties.osProfile.adminUsername') { should eq 'SomethingSecure' }
+
+    # Check if the VM has automatic updates enabled
+    its('properties.osProfile.windowsConfiguration.enableAutomaticUpdates') { should be true }
+  end
+end

data/examples/profile-azure/inspec.yml

@@ -0,0 +1,11 @@
+name: profile-azure
+title: Azure Example Profile
+maintainer: Chef Software, Inc.
+copyright: Chef Software, Inc.
+copyright_email: support@chef.io
+license: Apache-2.0
+summary: Demonstrates the use of an InSpec Compliance Profile on Azure
+version: 1.0.0
+
+supports:
+  - platform: azure

data/inspec.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = '>= 2.3'
 
-  spec.add_dependency 'train', '~> 0.32'
+  spec.add_dependency 'train', '~> 1.1'
   spec.add_dependency 'thor', '~> 0.19'
   spec.add_dependency 'json', '>= 1.8', '< 3.0'
   spec.add_dependency 'method_source', '~> 0.8'

data/lib/bundles/inspec-compliance/cli.rb

@@ -46,38 +46,6 @@ module Compliance
       Compliance::API.login(options)
     end
 
-    desc "login_automate https://SERVER --insecure --user='USER' --ent='ENTERPRISE' --usertoken='TOKEN'", 'Log in to a Chef Automate SERVER (DEPRECATED: Please use `login`)'
-    long_desc <<-LONGDESC
-      This commmand is deprecated and will be removed, please use `--login`.
-
-      `login_automate` allows you to use InSpec with Chef Automate.
-
-      You need to a token for communication. More information about token retrieval
-      is available at:
-        https://docs.chef.io/api_automate.html#authentication-methods
-        https://docs.chef.io/api_compliance.html#obtaining-an-api-token
-    LONGDESC
-    option :insecure, aliases: :k, type: :boolean,
-      desc: 'Explicitly allows InSpec to perform "insecure" SSL connections and transfers'
-    option :user, type: :string, required: true,
-      desc: 'Username'
-    option :usertoken, type: :string, required: false,
-      desc: 'Access token (DEPRECATED: Please use `--token`)'
-    option :token, type: :string, required: false,
-      desc: 'Access token'
-    option :dctoken, type: :string, required: false,
-      desc: 'Data Collector token'
-    option :ent, type: :string, required: true,
-      desc: 'Enterprise for Chef Automate reporting'
-    def login_automate(server)
-      warn '[DEPRECATION] `inspec compliance login_automate` is deprecated. Please use `inspec compliance login`'
-      options['server'] = server
-
-      options['token'] = options['usertoken'] if options['usertoken']
-
-      Compliance::API.login(options)
-    end
-
     desc 'profiles', 'list all available profiles in Chef Compliance'
     option :owner, type: :string, required: false,
       desc: 'owner whose profiles to list'
@@ -110,11 +78,20 @@ module Compliance
     def exec(*tests)
       config = Compliance::Configuration.new
       return if !loggedin(config)
+      o = opts(:exec).dup
+      diagnose(o)
+      configure_logger(o)
+
       # iterate over tests and add compliance scheme
       tests = tests.map { |t| 'compliance://' + Compliance::API.sanitize_profile_name(t) }
-      # execute profile from inspec exec implementation
-      diagnose
-      run_tests(tests, opts)
+
+      runner = Inspec::Runner.new(o)
+      tests.each { |target| runner.add_target(target) }
+
+      exit runner.run
+    rescue ArgumentError, RuntimeError, Train::UserError => e
+      $stderr.puts e.message
+      exit 1
     end
 
     desc 'download PROFILE', 'downloads a profile from Chef Compliance'

data/lib/bundles/inspec-init/templates/profile/controls/example.rb

@@ -1,5 +1,5 @@
 # encoding: utf-8
-# copyright: 2017, The Authors
+# copyright: 2018, The Authors
 
 title 'sample section'
 

data/lib/bundles/inspec-supermarket/cli.rb

@@ -29,12 +29,20 @@ module Supermarket
     desc 'exec PROFILE', 'execute a Supermarket profile'
     exec_options
     def exec(*tests)
+      o = opts(:exec).dup
+      diagnose(o)
+      configure_logger(o)
+
       # iterate over tests and add compliance scheme
       tests = tests.map { |t| 'supermarket://' + t }
 
-      # execute profile from inspec exec implementation
-      diagnose
-      run_tests(tests, opts)
+      runner = Inspec::Runner.new(o)
+      tests.each { |target| runner.add_target(target) }
+
+      exit runner.run
+    rescue ArgumentError, RuntimeError, Train::UserError => e
+      $stderr.puts e.message
+      exit 1
     end
 
     desc 'info PROFILE', 'display Supermarket profile details'

data/lib/inspec/base_cli.rb

@@ -66,8 +66,6 @@ module Inspec
         desc: 'Use colors in output.'
       option :attrs, type: :array,
         desc: 'Load attributes file (experimental)'
-      option :cache, type: :string,
-        desc: '[DEPRECATED] Please use --vendor-cache - this will be removed in InSpec 2.0'
       option :vendor_cache, type: :string,
         desc: 'Use the given path for caching dependencies. (default: ~/.inspec/cache)'
       option :create_lockfile, type: :boolean,
@@ -97,11 +95,11 @@ module Inspec
       # merge in any legacy formats as reporter
       # this method will only be used for ad-hoc runners
       if !opts['format'].nil? && opts['reporter'].nil?
-        warn '[DEPRECATED] The option --format is being is being deprecated and will be removed in inspec 3.0. Please use --reporter'
+        warn '[DEPRECATED] The option --format is being deprecated and will be removed in inspec 3.0. Please use --reporter'
 
         # see if we are using the legacy output to write to files
         if opts['output']
-          warn '[DEPRECATED] The option \'output\' is being is being deprecated and will be removed in inspec 3.0. Please use --reporter name:path'
+          warn '[DEPRECATED] The option \'output\' is being deprecated and will be removed in inspec 3.0. Please use --reporter name:path'
           opts['format'] = "#{opts['format']}:#{opts['output']}"
           opts.delete('output')
         end