inspec 2.0.17 → 2.0.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 22e8b8b6038e739efd1bee94339256401b361dfb
-  data.tar.gz: d25764db7b45182a26f250fde82090aed694a10e
+  metadata.gz: 00731d7ba23826e1f9ad7f39c7933d5c9518bf4f
+  data.tar.gz: 92ec9aee2d0a554623e0d10da40f5c2c5340a0c3
 SHA512:
-  metadata.gz: b09a1a6565799240e297f976823a05854542b9c1e4106188d801c4d6bda3a8ed1e4193810a8ba4d06f3c7929973e46178d4dd070b4df5d08854146db541d7fbe
-  data.tar.gz: 981ae101d306467b25a20ecacec715733930c3413db6a18cd3c248184f0e6d40b64ac368c51860d896b03791b04b73140a3e2502ba2a5c35b6edbc837ca72da7
+  metadata.gz: 8c9287685dfbef7033537051a64a7fd55e96191835be97349912abd8a172926a81d0f579443afdb2c8ad1c0e21808369cedfb8ece8e5d832edbed99702c0b44b
+  data.tar.gz: 955962215c0e09d23721d34c13fb72f35399d7a8b33ef61ac04e5e6afedad3b7a6fdd6ee00c71e6ac4643ce8272a722f9ddcd8f35b42814dab674f811c311250

data/CHANGELOG.md

@@ -1,20 +1,42 @@
 # Change Log
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 2.0.17 -->
-## [v2.0.17](https://github.com/chef/inspec/tree/v2.0.17) (2018-02-20)
+<!-- latest_release 2.0.32 -->
+## [v2.0.32](https://github.com/chef/inspec/tree/v2.0.32) (2018-03-01)
 
 #### Merged Pull Requests
-- Update shell detect to work with platforms [#2712](https://github.com/chef/inspec/pull/2712) ([jquick](https://github.com/jquick))
+- mssql_session -  Handling cases where the data is nil [#2752](https://github.com/chef/inspec/pull/2752) ([frezbo](https://github.com/frezbo))
 <!-- latest_release -->
 
-<!-- release_rollup since=2.0.16 -->
-### Changes since 2.0.16 release
+<!-- release_rollup since=2.0.17 -->
+### Changes since 2.0.17 release
+
+#### Bug Fixes
+- package resource: Fix `brew` package detection [#2730](https://github.com/chef/inspec/pull/2730) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.21 -->
 
 #### Merged Pull Requests
-- Update shell detect to work with platforms [#2712](https://github.com/chef/inspec/pull/2712) ([jquick](https://github.com/jquick)) <!-- 2.0.17 -->
+- mssql_session -  Handling cases where the data is nil [#2752](https://github.com/chef/inspec/pull/2752) ([frezbo](https://github.com/frezbo)) <!-- 2.0.32 -->
+- Docs: Clarify Matchers page to speak about Universal matchers [#2754](https://github.com/chef/inspec/pull/2754) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.0.31 -->
+- virtualization_resource: Fix `NoMethodError` on `nil:NilClass` [#2603](https://github.com/chef/inspec/pull/2603) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.30 -->
+- Updated omnibus `postinst` script to symlink to appbundle created binstubs [#2732](https://github.com/chef/inspec/pull/2732) ([miah](https://github.com/miah)) <!-- 2.0.29 -->
+- New Resource aws_config_recorder [#2635](https://github.com/chef/inspec/pull/2635) ([dromazmj](https://github.com/dromazmj)) <!-- 2.0.28 -->
+- http resource: Support OPTIONS method [#2742](https://github.com/chef/inspec/pull/2742) ([cbeckr](https://github.com/cbeckr)) <!-- 2.0.27 -->
+- Ensure we have a proper exit code and report data for ad-hoc runners [#2747](https://github.com/chef/inspec/pull/2747) ([jquick](https://github.com/jquick)) <!-- 2.0.26 -->
+- Various small fixes/adjustments to the integration tests for AWS and Azure [#2745](https://github.com/chef/inspec/pull/2745) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.0.25 -->
+- Move AWS/Azure tests to integration directory [#2675](https://github.com/chef/inspec/pull/2675) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.24 -->
+- Fix inspec check to work with platforms [#2737](https://github.com/chef/inspec/pull/2737) ([jquick](https://github.com/jquick)) <!-- 2.0.23 -->
+- Reword `it` block in `inspec check` tests to match actual test [#2721](https://github.com/chef/inspec/pull/2721) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.22 -->
+- Update maintainers file [#2728](https://github.com/chef/inspec/pull/2728) ([jquick](https://github.com/jquick)) <!-- 2.0.20 -->
+- remove release-2.0 branch from Travis [#2718](https://github.com/chef/inspec/pull/2718) ([juliandunn](https://github.com/juliandunn)) <!-- 2.0.19 -->
+- InSpec SEO [#2725](https://github.com/chef/inspec/pull/2725) ([hannah-radish](https://github.com/hannah-radish)) <!-- 2.0.18 -->
 <!-- release_rollup -->
 
 <!-- latest_stable_release -->
+## [v2.0.17](https://github.com/chef/inspec/tree/v2.0.17) (2018-02-20)
+
+#### Merged Pull Requests
+- Update shell detect to work with platforms [#2712](https://github.com/chef/inspec/pull/2712) ([jquick](https://github.com/jquick))
+<!-- latest_stable_release -->
+
 ## [v2.0.16](https://github.com/chef/inspec/tree/v2.0.16) (2018-02-20)
 
 #### Merged Pull Requests
@@ -36,7 +58,6 @@
 - HM website optimization [#2699](https://github.com/chef/inspec/pull/2699) ([hannah-radish](https://github.com/hannah-radish))
 - move /tutorial to /demo [#2700](https://github.com/chef/inspec/pull/2700) ([arlimus](https://github.com/arlimus))
 - HM Mobile IE [#2705](https://github.com/chef/inspec/pull/2705) ([hannah-radish](https://github.com/hannah-radish))
-<!-- latest_stable_release -->
 
 ## [v1.51.18](https://github.com/chef/inspec/tree/v1.51.18) (2018-02-12)
 

data/MAINTAINERS.md

@@ -17,7 +17,7 @@ project lead.
 ## InSpec
 
   Handles the [InSpec](https://github.com/chef/inspec) toolset.
-
+  
 To mention the team, use @chef/inspec-maintainers
 
 ### Lieutenant
@@ -29,3 +29,5 @@ To mention the team, use @chef/inspec-maintainers
 * [Christoph Hartmann](https://github.com/chris-rock)
 * [Adam Leff](https://github.com/adamleff)
 * [Alex Pop](https://github.com/alexpop)
+* [Jared Quick](https://github.com/jquick)
+

data/MAINTAINERS.toml

@@ -26,7 +26,8 @@ project lead.
         maintainers = [
           "chris-rock",
           "adamleff",
-          "alexpop"
+          "alexpop",
+          "jquick"
         ]
 
 [people]
@@ -45,3 +46,7 @@ project lead.
   [people.alexpop]
     Name = "Alex Pop"
     GitHub = "alexpop"
+
+  [people.jquick]
+    Name = "Jared Quick"
+    GitHub = "jquick"

data/README.md

@@ -84,21 +84,20 @@ gem install inspec
 
 ### Usage via Docker
 
-Download the image and define an alias for convenience:
+Download the image and define a function for convenience:
 
 ```
 docker pull chef/inspec
-alias inspec='docker run -it --rm -v $(pwd):/share chef/inspec'
+function inspec { docker run -it --rm -v $(pwd):/share chef/inspec $@; }
 ```
 
-If you call inspec from cli, it automatically mounts the current directory into the work directory. Therefore you can easily use local tests and key files. Note: Only files in the current directory are available to the container.
+If you call `inspec` from your shell, it automatically mounts the current directory into the Docker container. Therefore you can easily use local tests and key files. Note: Only files in the current directory and sub-directories are available within the container.
 
 ```
 $ ls -1
 vagrant
 test.rb
 
-
 $ inspec exec test.rb -t ssh://root@192.168.64.2:11022 -i vagrant
 ..
 

data/Rakefile

@@ -95,9 +95,9 @@ namespace :test do
   project_dir = File.dirname(__FILE__)
   namespace :aws do
     ['default', 'minimal'].each do |account|
-      integration_dir = File.join(project_dir, 'test', 'aws', account)
+      integration_dir = File.join(project_dir, 'test', 'integration', 'aws', account)
       attribute_file = File.join(integration_dir, '.attribute.yml')
-      
+
       task :"setup:#{account}", :tf_workspace do |t, args|
         tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
         abort("You must either call the top-level test:aws:#{account} task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
@@ -111,7 +111,7 @@ namespace :test do
         sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform apply")
         Rake::Task["test:aws:dump_attrs:#{account}"].execute
       end
-      
+
       task :"dump_attrs:#{account}" do
         sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform output > #{attribute_file}")
         raw_output = File.read(attribute_file)
@@ -123,7 +123,7 @@ namespace :test do
         puts "----> Run"
         sh("bundle exec inspec exec #{integration_dir}/verify -t aws://${AWS_REGION}/inspec-aws-test-#{account} --attrs #{attribute_file}")
       end
-      
+
       task :"cleanup:#{account}", :tf_workspace do |t, args|
         tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
         abort("You must either call the top-level test:aws:#{account} task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
@@ -132,7 +132,7 @@ namespace :test do
         sh("cd #{integration_dir}/build/ && terraform workspace select default")
         sh("cd #{integration_dir}/build && terraform workspace delete #{tf_workspace}")
       end
-      
+
       task :"#{account}" do
         tf_workspace = ENV['INSPEC_TERRAFORM_ENV'] || prompt("Please enter a workspace for your integration tests to run in: ")
         begin
@@ -151,16 +151,17 @@ namespace :test do
 
   namespace :azure do
     # Specify the directory for the integration tests
-    integration_dir = 'test/azure'
-
+    integration_dir = File.join(project_dir, 'test', 'integration', 'azure')
+    attribute_file = File.join(integration_dir, '.attribute.yml')
 
-    task :init_workspace do
-      # Initialize terraform workspace
+    task :setup, :tf_workspace do |t, args|
+      tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+      abort("You must either call the top-level test:azure task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
+      puts '----> Setup'
       sh("cd #{integration_dir}/build/ && terraform init")
-    end
+      sh("cd #{integration_dir}/build/ && terraform workspace new #{tf_workspace}")
 
-    task :setup_integration_tests do
-      puts '----> Setup'
+      # Generate Azure crendentials
       creds = Train.create('azure').connection.connect
 
       # Determine the storage account name and the admin password
@@ -171,35 +172,72 @@ namespace :test do
       suffix = sa_name[0..3]
 
       # Create the plan that can be applied to Azure
-      cmd = format("cd %s/build/ && terraform plan -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'storage_account_name=%s' -var 'admin_password=%s' -var 'suffix=%s' -out inspec-azure.plan", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id], sa_name, admin_password, suffix)
+      cmd  = ""
+      cmd += "cd #{integration_dir}/build/ && terraform plan -out inspec-azure.plan"
+      cmd += " -var 'subscription_id=#{creds[:subscription_id]}' "
+      cmd += " -var 'client_id=#{creds[:client_id]}' "
+      cmd += " -var 'client_secret=#{creds[:client_secret]}' "
+      cmd += " -var 'tenant_id=#{creds[:tenant_id]}' "
+      cmd += " -var 'storage_account_name=#{sa_name}' "
+      cmd += " -var 'admin_password=#{admin_password}' "
+      cmd += " -var 'suffix=#{suffix}' "
       sh(cmd)
 
       # Apply the plan on Azure
-      cmd = format("cd %s/build/ && terraform apply inspec-azure.plan", integration_dir)
+      cmd = "cd #{integration_dir}/build/ && terraform apply inspec-azure.plan"
       sh(cmd)
+
+      # Dump TF outputs to InSpec attributes file
+      Rake::Task["test:azure:dump_attrs"].execute
     end
 
-    task :run_integration_tests do
+    task :"dump_attrs" do
+      sh("cd #{integration_dir}/build/ && terraform output > #{attribute_file}")
+        raw_output = File.read(attribute_file)
+        yaml_output = raw_output.gsub(" = ", " : ")
+        File.open(attribute_file, "w") {|file| file.puts yaml_output}
+      end
+
+    task :run do
       puts '----> Run'
       sh("bundle exec inspec exec #{integration_dir}/verify -t azure://1e0b427a-d58b-494e-ae4f-ee558463ebbf")
     end
 
-    task :cleanup_integration_tests do
+    task :cleanup, :tf_workspace do |t, args|
+      tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+      abort("You must either call the top-level test:azure task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
       puts '----> Cleanup'
+
       creds = Train.create('azure').connection.connect
 
-      cmd = format("cd %s/build/ && terraform destroy -force -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'admin_password=dummy' -var 'storage_account_name=dummy' -var 'suffix=dummy'", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id])
+      cmd  = ""
+      cmd += "cd #{integration_dir}/build/ && terraform destroy -force "
+      cmd += " -var 'subscription_id=#{creds[:subscription_id]}' "
+      cmd += " -var 'client_id=#{creds[:client_id]}' "
+      cmd += " -var 'client_secret=#{creds[:client_secret]}' "
+      cmd += " -var 'tenant_id=#{creds[:tenant_id]}' "
+      cmd += " -var 'storage_account_name=dummy' "
+      cmd += " -var 'admin_password=dummy' "
+      cmd += " -var 'suffix=dummy' "
+
       sh(cmd)
+
+      sh("cd #{integration_dir}/build/ && terraform workspace select default")
+      sh("cd #{integration_dir}/build && terraform workspace delete #{tf_workspace}")
     end
   end
 
   desc "Perform Azure Integration Tests"
   task :azure do
-    Rake::Task['test:azure:init_workspace'].execute
-    Rake::Task['test:azure:cleanup_integration_tests'].execute
-    Rake::Task['test:azure:setup_integration_tests'].execute
-    Rake::Task['test:azure:run_integration_tests'].execute
-    Rake::Task['test:azure:cleanup_integration_tests'].execute
+    tf_workspace = ENV['INSPEC_TERRAFORM_ENV'] || prompt("Please enter a workspace for your integration tests to run in: ")
+    begin
+      Rake::Task["test:azure:setup"].execute({:tf_workspace => tf_workspace})
+      Rake::Task["test:azure:run"].execute
+    rescue
+      abort("Integration testing has failed")
+    ensure
+      Rake::Task["test:azure:cleanup"].execute({:tf_workspace => tf_workspace})
+    end
   end
 end
 

data/docs/matchers.md

@@ -1,18 +1,21 @@
 ---
-title: InSpec Matchers Reference
+title: InSpec Universal Matchers Reference
 ---
 
-# InSpec Matchers Reference
+# InSpec Universal Matchers Reference
 
-Inspec uses matchers to help compare resource values to expectations.
-The following matchers are available:
+InSpec uses matchers to help compare resource values to expectations. Matchers may be dedicated to a specific resource (such as the `aws_iam_root_user` resource's [`have_mfa_enabled`](https://www.inspec.io/docs/reference/resources/aws_iam_root_user/#have_mfa_enabled) matcher). If a matcher may be used on any resource type, it is _universal_.
 
-* `be`
-* `be_in`
-* `cmp`
-* `eq`
-* `include`
-* `match`
+You may also use any matcher provided by [RSpec::Expectations](https://relishapp.com/rspec/rspec-expectations/docs), but those matchers are outside of InSpec's [scope of support](https://www.inspec.io/docs/reference/inspec_and_friends/#rspec).
+
+The following InSpec-supported universal matchers are available:
+
+* [`be`](#be) - make numeric comparisons
+* [`be_in`](#be_in) - look for the property value in a list
+* [`cmp`](#cmp) - general-use equality (try this first)
+* [`eq`](#eq) - type-specific equality
+* [`include`](#include) - look for an expected value in a list-valued property
+* [`match`](#match) - look for patterns in text using regular expressions
 
 <br>
 
@@ -32,7 +35,7 @@ end
 
 ## cmp
 
-Unlike `eq`, cmp is a matcher for less-restrictive comparisons. It will
+Unlike `eq`, `cmp` is a matcher for less-restrictive comparisons. It will
 try to fit the actual value to the type you are comparing it to. This is
 meant to relieve the user from having to write type-casts and
 resolutions.
@@ -116,7 +119,7 @@ describe sshd_config do
 end
 ```
 
-It fails if types don't match. Please keep this in mind, when comparing
+`eq` fails if types don't match. Please keep this in mind, when comparing
 configuration entries that are numbers:
 
 ```ruby

data/docs/resources/auditd.md.erb

@@ -68,9 +68,9 @@ The where accessor can be used to filter on fields. For example:
 
 The key filter may be useful in evaluating rules with particular key values:
 
-  describe auditd.where { key == "privileged" } do
-    its('permissions') { should include ['x'] }
-  end
+    describe auditd.where { key == "privileged" } do
+      its('permissions') { should include ['x'] }
+    end
 
 <br>
 

data/docs/resources/aws_config_recorder.md.erb

@@ -0,0 +1,71 @@
+---
+title: About the aws_config_recorder Resource
+---
+
+# aws\_config\_recorder
+
+Use the `aws_config_recorder` InSpec audit resource to test properties of your AWS Config Service.
+
+The AWS Config service can monitor and record changes to your AWS resource configurations.  The Aws Config Recorder is used to detect changes in resource configurations and capture these changes as configuration items.
+
+<br>
+
+## Syntax
+
+An `aws_config_recorder` resource block declares the tests for a single AWS configuration recorder.
+
+    describe aws_config_recorder('my_recorder') do
+      it { should exist }
+    end
+
+    describe aws_config_recorder(recorder_name: 'my-recorder') do
+      it { should exist }
+    end
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test if the recorder is active and recording.
+
+    describe aws_config_recorder(recorder_name: 'my-recorder') do
+      it { should be_recording }
+    end
+    
+## Properties
+
+### role\_arn
+
+Provides the IAM role arn associated with the configuration recorder.  The role is used to grant permissions to S3 Buckets, SNS topics and to get configuration details for supported AWS resources.
+
+    describe aws_config_recorder(username: 'bob')
+      its('role_arn') { should eq 'arn:aws:iam::721741954427:role/My_Recorder' }
+    end
+    
+### resource\_types
+
+Provides a list of AWS resource types for which the AWS Config records configuration will change. Note that if be_recording_all_resource_types is true than this property is meaningless and will return and empty array.
+
+    describe aws_config_recorder(username: 'bob')
+      its('resource_types') { should include 'AWS::EC2::CustomerGateway' }
+      its('resource_types') { should include 'AWS::EC2::EIP' }
+    end
+    
+<br>
+
+## Matchers
+
+### be\_recording\_all\_resource\_types
+
+Indicates if the ConfigurationRecorder will record changes for all resources, regardless of type. If this is true, resource_types is ignored.
+
+      it { should be_all_supported }
+      
+### be\_recording\_all\_global\_types
+
+Indicates whether the ConfigurationRecorder will record changes for global resource types (such as IAM Users).
+
+      it { should be_recording_all_global_types }
+

data/docs/resources/aws_ec2_instance.md.erb

@@ -65,7 +65,7 @@ This InSpec audit resource has the following special matchers. For a full list o
 
 ### be\_pending
 
-The `be\_pending` matcher tests if the described EC2 instance state is `pending`. This indicates that an instance is provisioning. This state should be temporary.
+The `be_pending` matcher tests if the described EC2 instance state is `pending`. This indicates that an instance is provisioning. This state should be temporary.
 
     it { should be_pending }
 

data/docs/resources/aws_iam_policy.md.erb

@@ -7,9 +7,9 @@ platform: aws
 
 Use the `aws_iam_policy` InSpec audit resource to test properties of a single managed AWS IAM Policy.
 
-A policy is an entity in AWS that, when attached to an identity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine if the request is allowed or denied. 
+A policy is an entity in AWS that, when attached to an identity or resource, defines their permissions. AWS evaluates these policies when a principal, such as a user, makes a request. Permissions in the policies determine if the request is allowed or denied.
 
-Each IAM Policy is uniquely identified by either its policy_name or arn.
+Each IAM Policy is uniquely identified by either its policy\_name or arn.
 
 <br>
 
@@ -142,5 +142,3 @@ The test will pass if the identified policy attached the specified role.
     describe aws_iam_policy('AWSSupportAccess') do
       it { should be_attached_to_role(ROLENAME) }
     end
-
-

data/docs/resources/aws_iam_role.md.erb

@@ -11,10 +11,10 @@ Use the `aws_iam_role` InSpec audit resource to test properties of a single IAM
 
 ## Syntax
 
-  # Ensure that a certain role exists by name
-  describe aws_iam_role('my-role') do
-    it { should exist }
-  end
+    # Ensure that a certain role exists by name
+    describe aws_iam_role('my-role') do
+      it { should exist }
+    end
 
 <br>
 
@@ -24,13 +24,13 @@ Use the `aws_iam_role` InSpec audit resource to test properties of a single IAM
 
 This resource expects a single parameter that uniquely identifies the IAM Role, the Role Name. You may pass it as a string, or as the value in a hash:
 
-  describe aws_iam_role('my-role') do
-    it { should exist }
-  end
-  # Same
-  describe aws_iam_role(role_name: 'my-role') do
-    it { should exist }
-  end
+    describe aws_iam_role('my-role') do
+      it { should exist }
+    end
+    # Same
+    describe aws_iam_role(role_name: 'my-role') do
+      it { should exist }
+    end
 
 <br>
 
@@ -52,7 +52,7 @@ This InSpec audit resource has the following special matchers. For a full list o
 
 ### exist
 
-Indicates that the Role Name provided was found. Use should_not to test for IAM Roles that should not exist.
+Indicates that the Role Name provided was found. Use `should_not` to test for IAM Roles that should not exist.
 
     describe aws_iam_role('should-be-there') do
       it { should exist }
@@ -61,5 +61,3 @@ Indicates that the Role Name provided was found. Use should_not to test for IAM
     describe aws_iam_role('should-not-be-there') do
       it { should_not exist }
     end
-
-

data/docs/resources/aws_route_table.md.erb

@@ -11,10 +11,10 @@ Use the `aws_route_table` InSpec audit resource to test properties of a single R
 
 ## Syntax
 
-  # Ensure that a certain route table exists by name
-  describe aws_route_table('rtb-123abcde') do
-    it { should exist }
-  end
+    # Ensure that a certain route table exists by name
+    describe aws_route_table('rtb-123abcde') do
+      it { should exist }
+    end
 
 ## Resource Parameters
 
@@ -22,13 +22,13 @@ Use the `aws_route_table` InSpec audit resource to test properties of a single R
 
 This resource expects a single parameter that uniquely identifies the Route Table. You may pass it as a string, or as the value in a hash:
 
-  describe aws_route_table('rtb-123abcde') do
-    it { should exist }
-  end
-  # Same
-  describe aws_route_table(route_table_id: 'rtb-123abcde') do
-    it { should exist }
-  end
+    describe aws_route_table('rtb-123abcde') do
+      it { should exist }
+    end
+    # Same
+    describe aws_route_table(route_table_id: 'rtb-123abcde') do
+      it { should exist }
+    end
 
 ## Matchers
 
@@ -36,7 +36,7 @@ For a full list of available matchers, please visit our [matchers page](https://
 
 ### exist
 
-Indicates that the Route Table provided was found.  Use should_not to test for Route Tables that should not exist.
+Indicates that the Route Table provided was found.  Use `should_not` to test for Route Tables that should not exist.
 
     describe aws_route_table('should-be-there') do
       it { should exist }

data/docs/resources/aws_security_group.md.erb

@@ -44,7 +44,7 @@ This InSpec resource accepts the following parameters, which are used to search
 
 The Security Group ID of the Security Group. This is of the format `sg-` followed by 8 hexadecimal characters.  The ID is unique within your AWS account; using ID ensures that you will never match more than one SG. The ID is also the default resource parameter, so you may omit the hash syntax.
 
-    # Using Hash syntax 
+    # Using Hash syntax
     describe aws_security_group(id: 'sg-12345678') do
       it { should exist }
     end
@@ -79,7 +79,7 @@ A string identifying the VPC that contains the security group. Since VPCs common
 
     # This will error if there is more than the default SG
     describe aws_security_group(vpc_id: 'vpc-12345678') do
-      it { should exist }    
+      it { should exist }
     end
 
 <br>
@@ -138,15 +138,14 @@ This InSpec audit resource has the following special matchers. For a full list o
 
 ### exists
 
-The control will pass if the specified SG was found.  Use should_not if you want to verify that the specified SG does not exist.
+The control will pass if the specified SG was found.  Use `should_not` if you want to verify that the specified SG does not exist.
 
     # You will always have at least one SG, the VPC default SG
     describe aws_security_group(group_name: 'default')
       it { should exist }
-    end   
+    end
 
     # Make sure we don't have any security groups with the name 'nogood'
     describe aws_security_group(group_name: 'nogood')
       it { should_not exist }
-    end 
-
+    end

data/docs/resources/aws_security_groups.md.erb

@@ -54,7 +54,7 @@ A string identifying a group. Since groups are contained in VPCs, group names ar
 
 ## Properties
 
-* `entries`, `group\_ids`
+* `entries`, `group_ids`
 
 <br>
 
@@ -88,5 +88,4 @@ The control will pass if the filter returns at least one result. Use `should_not
     # You will always have at least one SG, the VPC default SG
     describe aws_security_groups
       it { should exist }
-    end   
-
+    end

data/docs/resources/aws_sns_topic.md.erb

@@ -10,16 +10,16 @@ Use the `aws_sns_topic` InSpec audit resource to test properties of a single AWS
 
 ## Syntax
 
-  # Ensure that a topic exists and has at least one subscription
-  describe aws_sns_topic('arn:aws:sns:*::my-topic-name') do
-    it { should exist }
-    its('confirmed_subscription_count') { should_not be_zero }
-  end
+    # Ensure that a topic exists and has at least one subscription
+    describe aws_sns_topic('arn:aws:sns:*::my-topic-name') do
+      it { should exist }
+      its('confirmed_subscription_count') { should_not be_zero }
+    end
 
-  # You may also use has syntax to pass the ARN
-  describe aws_sns_topic(arn: 'arn:aws:sns:*::my-topic-name') do
-    it { should exist }
-  end
+    # You may also use has syntax to pass the ARN
+    describe aws_sns_topic(arn: 'arn:aws:sns:*::my-topic-name') do
+      it { should exist }
+    end
 
 ## Resource Parameters
 
@@ -27,7 +27,7 @@ Use the `aws_sns_topic` InSpec audit resource to test properties of a single AWS
 
 This resource expects a single parameter that uniquely identifes the SNS Topic, an ARN. Amazon Resource Names for SNS topics have the format `arn:aws:sns:region:account-id:topicname`.  AWS requires a fully-specified ARN for looking up an SNS topic.  The account ID and region are required.  Wildcards are not permitted.
 
-See also the (AWS documentation on ARNs)[http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html].
+See also the [AWS documentation on ARNs](http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 
 <br>
 
@@ -50,7 +50,7 @@ This InSpec audit resource has the following special matchers. For a full list o
 
 ### exist
 
-Indicates that the ARN provided was found.  Use should_not to test for SNS topics that should not exist.
+Indicates that the ARN provided was found.  Use `should_not` to test for SNS topics that should not exist.
 
     # Expect good news
     describe aws_sns_topic('arn:aws:sns:*::good-news') do
@@ -60,4 +60,4 @@ Indicates that the ARN provided was found.  Use should_not to test for SNS topic
     # No bad news allowed
     describe aws_sns_topic('arn:aws:sns:*::bad-news') do
       it { should_not exist }
-    end
+    end

data/docs/resources/crontab.md.erb

@@ -68,7 +68,8 @@ The following examples show how to use this InSpec audit resource.
 
 ## Property Examples
 
-  ### Test a special time string
+
+### Test a special time string
 
     describe crontab do
       its('minutes') { should cmp '0' }