inspec 1.51.25 → 2.0.16

data/lib/resources/aws/aws_subnets.rb

@@ -0,0 +1,53 @@
+class AwsSubnets < Inspec.resource(1)
+  name 'aws_subnets'
+  desc 'Verifies settings for VPC Subnets in bulk'
+  example "
+    # you should be able to test the cidr_block of a subnet
+    describe aws_subnets.where(vpc_id: 'vpc-123456789') do
+      its('subnet_ids') { should eq ['subnet-12345678', 'subnet-87654321'] }
+      its('cidr_blocks') { should eq ['172.31.96.0/20'] }
+      its('states') { should_not include 'pending' }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  def validate_params(resource_params)
+    unless resource_params.empty?
+      raise ArgumentError, 'aws_vpc_subnets does not accept resource parameters.'
+    end
+    resource_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @table = backend.describe_subnets.subnets.map(&:to_h)
+  end
+
+  # Underlying FilterTable implementation.
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:vpc_ids, field: :vpc_id)
+        .add(:subnet_ids, field: :subnet_id)
+        .add(:cidr_blocks, field: :cidr_block)
+        .add(:states, field: :state)
+  filter.connect(self, :table)
+
+  def to_s
+    'EC2 VPC Subnets'
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend self
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_subnets(query = {})
+        aws_service_client.describe_subnets(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_vpc.rb

@@ -0,0 +1,69 @@
+class AwsVpc < Inspec.resource(1)
+  name 'aws_vpc'
+  desc 'Verifies settings for AWS VPC'
+  example "
+    describe aws_vpc do
+      it { should be_default }
+      its('cidr_block') { should cmp '10.0.0.0/16' }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+
+  def to_s
+    "VPC #{vpc_id}"
+  end
+
+  [:cidr_block, :dhcp_options_id, :state, :vpc_id, :instance_tenancy, :is_default].each do |property|
+    define_method(property) do
+      @vpc[property]
+    end
+  end
+
+  alias default? is_default
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:vpc_id],
+      allowed_scalar_name: :vpc_id,
+      allowed_scalar_type: String,
+    )
+
+    if validated_params.key?(:vpc_id) && validated_params[:vpc_id] !~ /^vpc\-[0-9a-f]{8}/
+      raise ArgumentError, 'aws_vpc VPC ID must be in the format "vpc-" followed by 8 hexadecimal characters.'
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+
+    if @vpc_id.nil?
+      filter = { name: 'isDefault', values: ['true'] }
+    else
+      filter = { name: 'vpc-id', values: [@vpc_id] }
+    end
+
+    resp = backend.describe_vpcs({ filters: [filter] })
+
+    @vpc = resp.vpcs[0].to_h
+    @vpc_id = @vpc[:vpc_id]
+    @exists = !@vpc.empty?
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_vpcs(query)
+        aws_service_client.describe_vpcs(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_vpcs.rb

@@ -0,0 +1,45 @@
+class AwsVpcs < Inspec.resource(1)
+  name 'aws_vpcs'
+  desc 'Verifies settings for AWS VPCs in bulk'
+  example '
+    describe aws_vpcs do
+      it { should exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  # Underlying FilterTable implementation.
+  filter = FilterTable.create
+  filter.add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+  filter.connect(self, :table)
+
+  def validate_params(raw_params)
+    # No params yet
+    unless raw_params.empty?
+      raise ArgumentError, 'aws_vpcs does not accept resource parameters'
+    end
+    raw_params
+  end
+
+  def to_s
+    'VPCs'
+  end
+
+  def fetch_from_api
+    @table = BackendFactory.create(inspec_runner).describe_vpcs.to_h[:vpcs]
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_vpcs(query = {})
+        aws_service_client.describe_vpcs(query)
+      end
+    end
+  end
+end

data/lib/resources/azure/azure_backend.rb

@@ -0,0 +1,377 @@
+# Base class for Azure Resources. This allows the generic class to work
+# as well as the specific target resources for Azure Resources
+#
+# @author Russell Seymour
+module Inspec::Resources
+  class AzureResourceBase < Inspec.resource(1)
+    attr_reader :opts, :client, :azure
+
+    # Constructor that retreives the specified resource
+    #
+    # The opts hash should contain the following
+    #   :group_name - name of the resource group in which to look for items
+    #   :type - the type of Azure resource to look for
+    #   :apiversion - API version to use when looking for a specific resource
+    #   :name - name of the resource to find
+    #
+    # @author Russell Seymour
+    #
+    # @param [Hash] opts Hashtable of options as highlighted above
+    # rubocop:disable Metrics/AbcSize
+    def initialize(opts)
+      # declare the hashtable of counts
+      @counts = {}
+      @total = 0
+      @opts = opts
+
+      # Determine if the environment variables for the options have been set
+      option_var_names = {
+        group_name: 'AZURE_RESOURCE_GROUP_NAME',
+        name: 'AZURE_RESOURCE_NAME',
+        type: 'AZURE_RESOURCE_TYPE',
+        apiversion: 'AZURE_RESOURCE_API_VERSION',
+      }
+      option_var_names.each do |option_name, env_var_name|
+        opts[option_name] = ENV[env_var_name] unless ENV[env_var_name].nil?
+      end
+
+      @azure = inspec.backend
+      @client = azure.azure_client
+      @failed_resource = false
+    end
+
+    def failed_resource?
+      @failed_resource
+    end
+
+    def catch_azure_errors
+      yield
+    rescue MsRestAzure::AzureOperationError => e
+      # e.message is actually a massive stringified JSON, which might be useful in the future.
+      # You want error_message here.
+      fail_resource e.error_message
+      @failed_resource = true
+      nil
+    end
+
+    # Return information about the resource group
+    def resource_group
+      catch_azure_errors do
+        resource_group = client.resource_groups.get(opts[:group_name])
+
+        # create the methods for the resource group object
+        dm = AzureResourceDynamicMethods.new
+        dm.create_methods(self, resource_group)
+      end
+    end
+
+    def resources
+      resources = nil
+      catch_azure_errors do
+        resources = client.resources.list_by_resource_group(opts[:group_name])
+      end
+      return if failed_resource?
+
+      # filter the resources based on the type, and the name if they been specified
+      resources = filter_resources(resources, opts)
+
+      # if there is one resource then define methods on this class
+      if resources.count == 1
+        @total = 1
+
+        resource = nil
+        catch_azure_errors do
+          # get the apiversion for the resource, if one has not been specified
+          apiversion = azure.get_api_version(resources[0].type, opts)
+
+          # get the resource by id so it can be interrogated
+          resource = client.resources.get_by_id(resources[0].id, apiversion)
+        end
+        return if failed_resource?
+
+        dm = AzureResourceDynamicMethods.new
+
+        dm.create_methods(self, resource)
+      else
+
+        # As there are many resources, parse each one so that it can be
+        # interrogated by the FilterTable
+        # @probes = parse_resources(resources, azure)
+        @probes = resources.each.map do |item|
+          # update the total
+          @total += 1
+
+          # determine the counts for each type
+          namespace, type_name = item.type.split(/\./)
+          counts.key?(namespace) ? false : counts[namespace] = {}
+          counts[namespace].key?(type_name) ? counts[namespace][type_name] += 1 : counts[namespace][type_name] = 1
+
+          # get the detail about the resource
+          apiversion = azure.get_api_version(item.type, opts)
+          resource = client.resources.get_by_id(item.id, apiversion)
+
+          # parse the resource
+          parse_resource(resource)
+        end.compact
+
+        # Iterate around the counts and create the necessary classes
+        counts.each do |namespace, ns_counts|
+          define_singleton_method namespace do
+            AzureResourceTypeCounts.new(ns_counts)
+          end
+        end
+      end
+    end
+
+    # Does the resource have any tags?
+    #
+    # If it is a Hashtable then it does not, because there was nothing to parse so there is not
+    # a nested object to work with
+    #
+    # @author Russell Seymour
+    def has_tags?
+      tags.is_a?(Hash) ? false : true
+    end
+
+    # Returns how many tags have been set on the resource
+    #
+    # @author Russell Seymour
+    def tag_count
+      tags.count
+    end
+
+    # It is necessary to be able to test the tags of a resource. It is possible to say of the
+    # resource has tags or not, and it is possible to check that the tags include a specific tag
+    # However the value is not accessible, this function creates methods for all the tags that
+    # are available.
+    #
+    # The format of the method name is '<TAG_NAME>_tag' and will return the value of that tag
+    #
+    # Disabling rubopcop check. If this is set as a normal if..then..end statement there is a
+    # violation stating it should use a guard. When using a guard it throws this error
+    #
+    # @author Russell Seymour
+    def create_tag_methods
+      # Iterate around the items of the tags and create the necessary access methods
+      tags.item.each do |name, value|
+        method_name = format('%s_tag', name)
+        define_singleton_method method_name do
+          value
+        end
+      end if defined?(tags.item)
+    end
+
+    private
+
+    # Filter the resources that are returned by the options that have been specified
+    #
+    def filter_resources(resources, opts)
+      if opts[:type] && opts[:name]
+        resources.select { |r| r.type == opts[:type] && r.name == opts[:name] }
+      elsif opts[:type]
+        resources.select { |r| r.type == opts[:type] }
+      elsif opts[:name]
+        resources.select { |r| r.name == opts[:name] }
+      else
+        resources
+      end
+    end
+  end
+end
+
+# Class to create methods on the calling object at run time.
+# Each of the Azure Resources have different attributes and properties, and they all need
+# to be testable. To do this no methods are hardcoded, each on is craeted based on the
+# information returned from Azure.
+#
+# The class is a helper class essentially as it creates the methods on the calling class
+# rather than itself. This means that there is less duplication of code and it can be
+# reused easily.
+#
+# @author Russell Seymour
+# @since 0.2.0
+class AzureResourceDynamicMethods
+  # Given the calling object and its data, create the methods on the object according
+  # to the data that has been retrieved. Various types of data can be returned so the method
+  # checks the type to ensure that the necessary methods are configured correctly
+  #
+  # @param AzureResourceProbe|AzureResource object The object on which the methods should be craeted
+  # @param variant data The data from which the methods should be created
+  def create_methods(object, data)
+    # Check the type of data as this affects the setup of the methods
+    # If it is an Azure Generic Resource then setup methods for each of
+    # the instance variables
+    case data.class.to_s
+    when /^Azure::Resources::Mgmt::.*::Models::GenericResource$/,
+         /^Azure::Resources::Mgmt::.*::Models::ResourceGroup$/
+      # iterate around the instance variables
+      data.instance_variables.each do |var|
+        create_method(object, var.to_s.delete('@'), data.instance_variable_get(var))
+      end
+    # When the data is a Hash object iterate around each of the key value pairs and
+    # craete a method for each one.
+    when 'Hash'
+      data.each do |key, value|
+        create_method(object, key, value)
+      end
+    end
+  end
+
+  private
+
+  # Method that is responsible for creating the method on the calling object. This is
+  # because some nesting maybe required. For example of the value is a Hash then it will
+  # need to have an AzureResourceProbe create for each key, whereas if it is a simple
+  # string then the value just needs to be returned
+  #
+  # @private
+  #
+  # @param AzureResourceProbe|AzureResource object Object on which the methods need to be created
+  # @param string name The name of the method
+  # @param variant value The value that needs to be returned by the method
+  def create_method(object, name, value)
+    # Create the necessary method based on the var that has been passed
+    # Test the value for its type so that the method can be setup correctly
+    case value.class.to_s
+    when 'String', 'Integer', 'TrueClass', 'FalseClass', 'Fixnum'
+      object.define_singleton_method name do
+        value
+      end
+    when 'Hash'
+      value.count.zero? ? return_value = value : return_value = AzureResourceProbe.new(value)
+      object.define_singleton_method name do
+        return_value
+      end
+    when /^Azure::Resources::Mgmt::.*::Models::ResourceGroupProperties$/
+      # This is a special case where the properties of the resource group is not a simple JSON model
+      # This is because the plugin is using the Azure SDK to get this information so it is an SDK object
+      # that has to be interrogated in a different way. This is the only object type that behaves like this
+      value.instance_variables.each do |var|
+        create_method(object, var.to_s.delete('@'), value.instance_variable_get(var))
+      end
+    when 'Array'
+      # Some things are just string or integer arrays
+      # Check this by seeing if the first element is a string / integer / boolean or
+      # a hashtable
+      # This may not be the best methid, but short of testing all elements in the array, this is
+      # the quickest test
+      case value[0].class.to_s
+      when 'String', 'Integer', 'TrueClass', 'FalseClass', 'Fixnum'
+        probes = value
+      else
+        probes = []
+        value.each do |value_item|
+          probes << AzureResourceProbe.new(value_item)
+        end
+      end
+      object.define_singleton_method name do
+        probes
+      end
+    end
+  end
+end
+
+# Class object to maintain a count of the Azure Resource types that are found
+# when a less specific test is carried out. For example if all the resoures of a resource
+# group are called for, there will be variaous types and number of those types.
+#
+# Each type is namespaced, so for example a virtual machine has the type 'Microsoft.Compute/virtualMachines'
+# This is broken down into the 'Microsoft' class with the type 'Compute/virtualMachines'
+# This has been done for two reasons:
+#  1. Enable the dotted notation to work in the test
+#  2. Allow third party resource types ot be catered for if they are ever enabled by Microsoft
+#
+# @author Russell Seymour
+# @since 0.2.0
+class AzureResourceTypeCounts
+  # Constructor to setup a new class for a specific Azure Resource type.
+  # It should be passed a hashtable with information such as:
+  #   {
+  #     "Compute/virtualMachines" => 2,
+  #     "Network/networkInterfaces" => 3
+  #   }
+  # This will result in two methods being created on the class:
+  #  - Compute/virtualNetworks
+  #  - Network/networkInterfaces
+  # Each of which will return the corresponding count value
+  #
+  # @param Hash counts Hash table of types and the count of each one
+  #
+  # @return AzureResourceTypeCounts
+  def initialize(counts)
+    counts.each do |type, count|
+      define_singleton_method type do
+        count
+      end
+    end
+  end
+end
+
+# Class object that is created for each element that is returned by Azure.
+# This is what is interogated by Inspec. If they are nested hashes, then this results
+# in nested AzureResourceProbe objects.
+#
+# For example, if the following was seen in an Azure Resource
+#    properties -> storageProfile -> imageReference
+# Would result in the following nestec classes
+#    AzureResource -> AzureResourceProbe -> AzureResourceProbe
+#
+# The methods for each of the classes are dynamically defined at run time and will
+# match the items that are retrieved from Azure. See the 'test/integration/verify/controls' for
+# examples
+#
+# This class will not be called externally
+#
+# @author Russell Seymour
+# @since 0.2.0
+# @attr_reader string name Name of the Azure resource
+# @attr_reader string type Type of the Azure Resource
+# @attr_reader string location Location in Azure of the resource
+class AzureResourceProbe
+  attr_reader :name, :type, :location, :item, :count
+
+  # Initialize method for the class. Accepts an item, be it a scalar value, hash or Azure object
+  # It will then create the necessary dynamic methods so that they can be called in the tests
+  # This is accomplished by call the AzureResourceDynamicMethods
+  #
+  # @param varaint The item from which the class will be initialized
+  #
+  # @return AzureResourceProbe
+  def initialize(item)
+    dm = AzureResourceDynamicMethods.new
+    dm.create_methods(self, item)
+
+    # Set the item as a property on the class
+    # This is so that it is possible to interrogate what has been added to the class and isolate them from
+    # the standard methods that a Ruby class has.
+    # This used for checking Tags on a resource for example
+    # It also allows direct access if so required
+    @item = item
+
+    # Set how many items have been set
+    @count = item.length
+  end
+
+  # Allows resources to respond to the include test
+  # This means that things like tags can be checked for and then their value tested
+  #
+  # @author Russell Seymour
+  #
+  # @param [String] key Name of the item to look for in the @item property
+  def include?(key)
+    @item.key?(key)
+  end
+
+  # Give a sting like `computer_name` return the camelCase version, e.g.
+  # computerName
+  #
+  # @param string data Data that needs to be converted from snake_case to camelCase
+  #
+  # @return string
+  def camel_case(data)
+    camel_case_data = data.split('_').inject([]) { |buffer, e| buffer.push(buffer.empty? ? e : e.capitalize) }.join
+
+    # Ensure that gb (as in gigabytes) is uppercased
+    camel_case_data.gsub(/[gb]/, &:upcase)
+  end
+end