inspec 1.51.25 → 2.0.16

data/lib/resources/apache.rb

@@ -1,11 +1,10 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
 
 module Inspec::Resources
   class Apache < Inspec.resource(1)
     name 'apache'
+    supports platform: 'unix'
     desc 'Use the apache InSpec audit resource to retrieve Apache environment settings.'
     example "
       describe apache do

data/lib/resources/apache_conf.rb

@@ -1,7 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# author: Dominik Richter
-# author: Christoph Hartmann
 
 require 'utils/simpleconfig'
 require 'utils/find_files'
@@ -9,8 +7,8 @@ require 'utils/find_files'
 module Inspec::Resources
   class ApacheConf < Inspec.resource(1)
     name 'apache_conf'
-    supports os_family: 'linux'
-    supports os_family: 'debian'
+    supports platform: 'linux'
+    supports platform: 'debian'
     desc 'Use the apache_conf InSpec audit resource to test the configuration settings for Apache. This file is typically located under /etc/apache2 on the Debian and Ubuntu platforms and under /etc/httpd on the Fedora, CentOS, Red Hat Enterprise Linux, and Arch Linux platforms. The configuration settings may vary significantly from platform to platform.'
     example "
       describe apache_conf do

data/lib/resources/apt.rb

@@ -1,6 +1,4 @@
 # encoding: utf-8
-# author: Christoph Hartmann
-# author: Dominik Richter
 
 # Verifies apt and ppa repositories
 #
@@ -31,6 +29,7 @@ require 'uri'
 module Inspec::Resources
   class AptRepository < Inspec.resource(1)
     name 'apt'
+    supports platform: 'unix'
     desc 'Use the apt InSpec audit resource to verify Apt repositories on the Debian and Ubuntu platforms, and also PPA repositories on the Ubuntu platform.'
     example "
       describe apt('nginx/stable') do

data/lib/resources/audit_policy.rb

@@ -1,7 +1,5 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
 
 # Advanced Auditing:
 # As soon as you start applying Advanced Audit Configuration Policy, legacy policies will be completely ignored.
@@ -26,6 +24,7 @@
 module Inspec::Resources
   class AuditPolicy < Inspec.resource(1)
     name 'audit_policy'
+    supports platform: 'unix'
     desc 'Use the audit_policy InSpec audit resource to test auditing policies on the Microsoft Windows platform. An auditing policy is a category of security-related events to be audited. Auditing is disabled by default and may be enabled for categories like account management, logon events, policy changes, process tracking, privilege use, system events, or object access. For each enabled auditing category property, the auditing level may be set to No Auditing, Not Specified, Success, Success and Failure, or Failure.'
     example "
       describe audit_policy do

data/lib/resources/auditd.rb

@@ -1,7 +1,4 @@
 # encoding: utf-8
-# author: Christoph Hartmann
-# author: Dominik Richter
-# author: Jen Burns
 
 require 'forwardable'
 require 'utils/filter_array'
@@ -15,6 +12,7 @@ module Inspec::Resources
     attr_reader :params
 
     name 'auditd'
+    supports platform: 'unix'
     desc 'Use the auditd InSpec audit resource to test the rules for logging that exist on the system. The audit.rules file is typically located under /etc/audit/ and contains the list of rules that define what is captured in log files. These rules are output using the auditcl -l command.'
     example "
       describe auditd.syscall('chown').where {arch == 'b32'} do

data/lib/resources/auditd_conf.rb

@@ -1,13 +1,12 @@
 # encoding: utf-8
 # copyright: 2015, Vulcano Security GmbH
-# author: Christoph Hartmann
-# author: Dominik Richter
 
 require 'utils/simpleconfig'
 
 module Inspec::Resources
   class AuditDaemonConf < Inspec.resource(1)
     name 'auditd_conf'
+    supports platform: 'unix'
     desc "Use the auditd_conf InSpec audit resource to test the configuration settings for the audit daemon. This file is typically located under /etc/audit/auditd.conf' on UNIX and Linux platforms."
     example "
       describe auditd_conf do

data/lib/resources/aws/aws_cloudtrail_trail.rb

@@ -0,0 +1,77 @@
+class AwsCloudTrailTrail < Inspec.resource(1)
+  name 'aws_cloudtrail_trail'
+  desc 'Verifies settings for an individual AWS CloudTrail Trail'
+  example "
+    describe aws_cloudtrail_trail('trail-name') do
+      it { should exist }
+    end
+  "
+
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :cloud_watch_logs_log_group_arn, :cloud_watch_logs_role_arn, :home_region,
+              :kms_key_id, :s3_bucket_name, :trail_arn
+
+  def to_s
+    "CloudTrail #{@trail_name}"
+  end
+
+  def multi_region_trail?
+    @is_multi_region_trail
+  end
+
+  def log_file_validation_enabled?
+    @log_file_validation_enabled
+  end
+
+  def encrypted?
+    !kms_key_id.nil?
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:trail_name],
+      allowed_scalar_name: :trail_name,
+      allowed_scalar_type: String,
+    )
+
+    if validated_params.empty?
+      raise ArgumentError, "You must provide the parameter 'trail_name' to aws_cloudtrail_trail."
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+
+    query = { trail_name_list: [@trail_name] }
+    resp = backend.describe_trails(query)
+
+    @trail = resp.trail_list[0].to_h
+    @exists = !@trail.empty?
+    @s3_bucket_name = @trail[:s3_bucket_name]
+    @is_multi_region_trail = @trail[:is_multi_region_trail]
+    @trail_arn = @trail[:trail_arn]
+    @log_file_validation_enabled = @trail[:log_file_validation_enabled]
+    @cloud_watch_logs_role_arn = @trail[:cloud_watch_logs_role_arn]
+    @cloud_watch_logs_log_group_arn = @trail[:cloud_watch_logs_log_group_arn]
+    @kms_key_id = @trail[:kms_key_id]
+    @home_region = @trail[:home_region]
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      AwsCloudTrailTrail::BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CloudTrail::Client
+
+      def describe_trails(query)
+        aws_service_client.describe_trails(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_cloudtrail_trails.rb

@@ -0,0 +1,47 @@
+class AwsCloudTrailTrails < Inspec.resource(1)
+  name 'aws_cloudtrail_trails'
+  desc 'Verifies settings for AWS CloudTrail Trails in bulk'
+  example '
+    describe aws_cloudtrail_trails do
+      it { should exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  def validate_params(resource_params)
+    unless resource_params.empty?
+      raise ArgumentError, 'aws_cloudtrail_trails does not accept resource parameters.'
+    end
+    resource_params
+  end
+
+  # Underlying FilterTable implementation.
+  filter = FilterTable.create
+  filter.add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:names, field: :name)
+        .add(:trail_arns, field: :trail_arn)
+  filter.connect(self, :table)
+
+  def to_s
+    'CloudTrail Trails'
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @table = backend.describe_trails({}).to_h[:trail_list]
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      AwsCloudTrailTrails::BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CloudTrail::Client
+
+      def describe_trails(query)
+        aws_service_client.describe_trails(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_cloudwatch_alarm.rb

@@ -0,0 +1,62 @@
+class AwsCloudwatchAlarm < Inspec.resource(1)
+  name 'aws_cloudwatch_alarm'
+  desc <<-EOD
+  # Look for a specific alarm
+  aws_cloudwatch_alarm(
+    metric: 'my-metric-name',
+    metric_namespace: 'my-metric-namespace',
+  ) do
+    it { should exist }
+  end
+  EOD
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :alarm_actions, :alarm_name, :metric_name, :metric_namespace
+
+  private
+
+  def validate_params(raw_params)
+    recognized_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:metric_name, :metric_namespace],
+    )
+    validated_params = {}
+    # Currently you must specify exactly metric_name and metric_namespace
+    [:metric_name, :metric_namespace].each do |param|
+      raise ArgumentError, "Missing resource param #{param}" unless recognized_params.key?(param)
+      validated_params[param] = recognized_params.delete(param)
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    aws_alarms = BackendFactory.create(inspec_runner).describe_alarms_for_metric(
+      metric_name: @metric_name,
+      namespace: @metric_namespace,
+    )
+    if aws_alarms.metric_alarms.empty?
+      @exists = false
+    elsif aws_alarms.metric_alarms.count > 1
+      alarms = aws_alarms.metric_alarms.map(&:alarm_name)
+      raise 'More than one Cloudwatch Alarm was matched. Try using ' \
+        "more specific resource parameters. Alarms matched: #{alarms.join(', ')}"
+    else
+      @alarm_actions = aws_alarms.metric_alarms.first.alarm_actions
+      @alarm_name = aws_alarms.metric_alarms.first.alarm_name
+      @exists = true
+    end
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      AwsCloudwatchAlarm::BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CloudWatch::Client
+
+      def describe_alarms_for_metric(query)
+        aws_service_client.describe_alarms_for_metric(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb

@@ -0,0 +1,100 @@
+class AwsCloudwatchLogMetricFilter < Inspec.resource(1)
+  name 'aws_cloudwatch_log_metric_filter'
+  desc 'Verifies individual Cloudwatch Log Metric Filters'
+  example <<-EOX
+  # Look for a LMF by its filter name and log group name.  This combination
+  # will always either find at most one LMF - no duplicates.
+  describe aws_cloudwatch_log_metric_filter(
+    filter_name: 'my-filter',
+    log_group_name: 'my-log-group'
+  ) do
+    it { should exist }
+  end
+
+  # Search for an LMF by pattern and log group.
+  # This could result in an error if the results are not unique.
+  describe aws_cloudwatch_log_metric_filter(
+    log_group_name:  'my-log-group',
+    pattern: 'my-filter'
+  ) do
+    it { should exist }
+  end
+EOX
+  supports platform: 'aws'
+  include AwsSingularResourceMixin
+  attr_reader :filter_name, :log_group_name, :metric_name, :metric_namespace, :pattern
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:filter_name, :log_group_name, :pattern],
+    )
+    if validated_params.empty?
+      raise ArgumentError, 'You must provide either filter_name, log_group, or pattern to aws_cloudwatch_log_metric_filter.'
+    end
+    validated_params
+  end
+
+  def fetch_from_api
+    # get a backend
+    backend = BackendFactory.create(inspec_runner)
+
+    # Perform query with remote filtering
+    aws_search_criteria = {}
+    aws_search_criteria[:filter_name] = filter_name if filter_name
+    aws_search_criteria[:log_group_name] = log_group_name if log_group_name
+    begin
+      aws_results = backend.describe_metric_filters(aws_search_criteria)
+    rescue Aws::CloudWatchLogs::Errors::ResourceNotFoundException
+      @exists = false
+      return
+    end
+
+    # Then perform local filtering
+    if pattern
+      aws_results.select! { |lmf| lmf.filter_pattern == pattern }
+    end
+
+    # Check result count.  We're a singular resource and can tolerate
+    # 0 or 1 results, not multiple.
+    if aws_results.count > 1
+      raise 'More than one result was returned, but aws_cloudwatch_log_metric_filter '\
+            'can only handle a single AWS resource.  Consider passing more resource '\
+            'parameters to narrow down the search.'
+    elsif aws_results.empty?
+      @exists = false
+    else
+      @exists = true
+      # Unpack the funny-shaped object we got back from AWS into our instance vars
+      lmf = aws_results.first
+      @filter_name = lmf.filter_name
+      @log_group_name = lmf.log_group_name
+      @pattern = lmf.filter_pattern # Note inconsistent name
+      # AWS SDK returns an array of metric transformations
+      # but only allows one (mandatory) entry, let's flatten that
+      @metric_name = lmf.metric_transformations.first.metric_name
+      @metric_namespace = lmf.metric_transformations.first.metric_namespace
+    end
+  end
+
+  class Backend
+    # Uses the cloudwatch API to really talk to AWS
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CloudWatchLogs::Client
+
+      def describe_metric_filters(criteria)
+        query = {}
+        query[:filter_name_prefix] = criteria[:filter_name] if criteria[:filter_name]
+        query[:log_group_name] = criteria[:log_group_name] if criteria[:log_group_name]
+        # 'pattern' is not available as a remote filter,
+        # we filter it after the fact locally
+        # TODO: handle pagination?  Max 50/page.  Maybe you want a plural resource?
+        aws_response = aws_service_client.describe_metric_filters(query)
+        aws_response.metric_filters
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_ec2_instance.rb

@@ -0,0 +1,157 @@
+# author: Christoph Hartmann
+class AwsEc2Instance < Inspec.resource(1)
+  name 'aws_ec2_instance'
+  desc 'Verifies settings for an EC2 instance'
+
+  example <<-EOX
+    describe aws_ec2_instance('i-123456') do
+      it { should be_running }
+      it { should have_roles }
+    end
+
+    describe aws_ec2_instance(name: 'my-instance') do
+      it { should be_running }
+      it { should have_roles }
+    end
+EOX
+  supports platform: 'aws'
+
+  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
+  def initialize(opts, conn = nil)
+    @opts = opts
+    @opts.is_a?(Hash) ? @display_name = @opts[:name] : @display_name = opts
+    @ec2_client = conn ? conn.ec2_client : inspec_runner.backend.aws_client(Aws::EC2::Client)
+    @ec2_resource = conn ? conn.ec2_resource : inspec_runner.backend.aws_resource(Aws::EC2::Resource, {})
+    @iam_resource = conn ? conn.iam_resource : inspec_runner.backend.aws_resource(Aws::IAM::Resource, {})
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_resource_mixin.rb
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource('No AWS credentials available')
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    # TODO: remove after rewrite to include AwsSingularResource
+    inspec if respond_to?(:inspec)
+  end
+
+  def id
+    return @instance_id if defined?(@instance_id)
+    catch_aws_errors do
+      if @opts.is_a?(Hash)
+        first = @ec2_resource.instances(
+          {
+            filters: [{
+              name: 'tag:Name',
+              values: [@opts[:name]],
+            }],
+          },
+        ).first
+        # catch case where the instance is not known
+        @instance_id = first.id unless first.nil?
+      else
+        @instance_id = @opts
+      end
+    end
+  end
+  alias instance_id id
+
+  def exists?
+    return false if instance.nil?
+    instance.exists?
+  end
+
+  # returns the instance state
+  def state
+    catch_aws_errors do
+      instance&.state&.name
+    end
+  end
+
+  # helper methods for each state
+  %w{
+    pending running shutting-down
+    terminated stopping stopped unknown
+  }.each do |state_name|
+    define_method state_name.tr('-', '_') + '?' do
+      state == state_name
+    end
+  end
+
+  # attributes that we want to expose
+  %w{
+    public_ip_address private_ip_address key_name private_dns_name
+    public_dns_name subnet_id architecture root_device_type
+    root_device_name virtualization_type client_token launch_time
+    instance_type image_id vpc_id
+  }.each do |attribute|
+    define_method attribute do
+      catch_aws_errors do
+        instance.send(attribute) if instance
+      end
+    end
+  end
+
+  # Don't document this - it's a bit hard to use.  Our current doctrine
+  # is to use dumb things, like arrays of strings - use security_group_ids instead.
+  def security_groups
+    catch_aws_errors do
+      @security_groups ||= instance.security_groups.map { |sg|
+        { id: sg.group_id, name: sg.group_name }
+      }
+    end
+  end
+
+  def security_group_ids
+    catch_aws_errors do
+      @security_group_ids ||= instance.security_groups.map(&:group_id)
+    end
+  end
+
+  def tags
+    catch_aws_errors do
+      @tags ||= instance.tags.map { |tag| { key: tag.key, value: tag.value } }
+    end
+  end
+
+  def to_s
+    "EC2 Instance #{@display_name}"
+  end
+
+  def has_roles?
+    catch_aws_errors do
+      instance_profile = instance.iam_instance_profile
+
+      if instance_profile
+        roles = @iam_resource.instance_profile(
+          instance_profile.arn.gsub(%r{^.*\/}, ''),
+        ).roles
+      else
+        roles = nil
+      end
+
+      roles && !roles.empty?
+    end
+  end
+
+  private
+
+  def instance
+    catch_aws_errors { @instance ||= @ec2_resource.instance(id) }
+  end
+end