inspec 2.0.32 → 2.0.45

data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb

@@ -1,100 +1,100 @@
-class AwsCloudwatchLogMetricFilter < Inspec.resource(1)
-  name 'aws_cloudwatch_log_metric_filter'
-  desc 'Verifies individual Cloudwatch Log Metric Filters'
-  example <<-EOX
-  # Look for a LMF by its filter name and log group name.  This combination
-  # will always either find at most one LMF - no duplicates.
-  describe aws_cloudwatch_log_metric_filter(
-    filter_name: 'my-filter',
-    log_group_name: 'my-log-group'
-  ) do
-    it { should exist }
-  end
-
-  # Search for an LMF by pattern and log group.
-  # This could result in an error if the results are not unique.
-  describe aws_cloudwatch_log_metric_filter(
-    log_group_name:  'my-log-group',
-    pattern: 'my-filter'
-  ) do
-    it { should exist }
-  end
-EOX
-  supports platform: 'aws'
-  include AwsSingularResourceMixin
-  attr_reader :filter_name, :log_group_name, :metric_name, :metric_namespace, :pattern
-
-  private
-
-  def validate_params(raw_params)
-    validated_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:filter_name, :log_group_name, :pattern],
-    )
-    if validated_params.empty?
-      raise ArgumentError, 'You must provide either filter_name, log_group, or pattern to aws_cloudwatch_log_metric_filter.'
-    end
-    validated_params
-  end
-
-  def fetch_from_api
-    # get a backend
-    backend = BackendFactory.create(inspec_runner)
-
-    # Perform query with remote filtering
-    aws_search_criteria = {}
-    aws_search_criteria[:filter_name] = filter_name if filter_name
-    aws_search_criteria[:log_group_name] = log_group_name if log_group_name
-    begin
-      aws_results = backend.describe_metric_filters(aws_search_criteria)
-    rescue Aws::CloudWatchLogs::Errors::ResourceNotFoundException
-      @exists = false
-      return
-    end
-
-    # Then perform local filtering
-    if pattern
-      aws_results.select! { |lmf| lmf.filter_pattern == pattern }
-    end
-
-    # Check result count.  We're a singular resource and can tolerate
-    # 0 or 1 results, not multiple.
-    if aws_results.count > 1
-      raise 'More than one result was returned, but aws_cloudwatch_log_metric_filter '\
-            'can only handle a single AWS resource.  Consider passing more resource '\
-            'parameters to narrow down the search.'
-    elsif aws_results.empty?
-      @exists = false
-    else
-      @exists = true
-      # Unpack the funny-shaped object we got back from AWS into our instance vars
-      lmf = aws_results.first
-      @filter_name = lmf.filter_name
-      @log_group_name = lmf.log_group_name
-      @pattern = lmf.filter_pattern # Note inconsistent name
-      # AWS SDK returns an array of metric transformations
-      # but only allows one (mandatory) entry, let's flatten that
-      @metric_name = lmf.metric_transformations.first.metric_name
-      @metric_namespace = lmf.metric_transformations.first.metric_namespace
-    end
-  end
-
-  class Backend
-    # Uses the cloudwatch API to really talk to AWS
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::CloudWatchLogs::Client
-
-      def describe_metric_filters(criteria)
-        query = {}
-        query[:filter_name_prefix] = criteria[:filter_name] if criteria[:filter_name]
-        query[:log_group_name] = criteria[:log_group_name] if criteria[:log_group_name]
-        # 'pattern' is not available as a remote filter,
-        # we filter it after the fact locally
-        # TODO: handle pagination?  Max 50/page.  Maybe you want a plural resource?
-        aws_response = aws_service_client.describe_metric_filters(query)
-        aws_response.metric_filters
-      end
-    end
-  end
-end
+class AwsCloudwatchLogMetricFilter < Inspec.resource(1)
+  name 'aws_cloudwatch_log_metric_filter'
+  desc 'Verifies individual Cloudwatch Log Metric Filters'
+  example <<-EOX
+  # Look for a LMF by its filter name and log group name.  This combination
+  # will always either find at most one LMF - no duplicates.
+  describe aws_cloudwatch_log_metric_filter(
+    filter_name: 'my-filter',
+    log_group_name: 'my-log-group'
+  ) do
+    it { should exist }
+  end
+
+  # Search for an LMF by pattern and log group.
+  # This could result in an error if the results are not unique.
+  describe aws_cloudwatch_log_metric_filter(
+    log_group_name:  'my-log-group',
+    pattern: 'my-filter'
+  ) do
+    it { should exist }
+  end
+EOX
+  supports platform: 'aws'
+  include AwsSingularResourceMixin
+  attr_reader :filter_name, :log_group_name, :metric_name, :metric_namespace, :pattern
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:filter_name, :log_group_name, :pattern],
+    )
+    if validated_params.empty?
+      raise ArgumentError, 'You must provide either filter_name, log_group, or pattern to aws_cloudwatch_log_metric_filter.'
+    end
+    validated_params
+  end
+
+  def fetch_from_api
+    # get a backend
+    backend = BackendFactory.create(inspec_runner)
+
+    # Perform query with remote filtering
+    aws_search_criteria = {}
+    aws_search_criteria[:filter_name] = filter_name if filter_name
+    aws_search_criteria[:log_group_name] = log_group_name if log_group_name
+    begin
+      aws_results = backend.describe_metric_filters(aws_search_criteria)
+    rescue Aws::CloudWatchLogs::Errors::ResourceNotFoundException
+      @exists = false
+      return
+    end
+
+    # Then perform local filtering
+    if pattern
+      aws_results.select! { |lmf| lmf.filter_pattern == pattern }
+    end
+
+    # Check result count.  We're a singular resource and can tolerate
+    # 0 or 1 results, not multiple.
+    if aws_results.count > 1
+      raise 'More than one result was returned, but aws_cloudwatch_log_metric_filter '\
+            'can only handle a single AWS resource.  Consider passing more resource '\
+            'parameters to narrow down the search.'
+    elsif aws_results.empty?
+      @exists = false
+    else
+      @exists = true
+      # Unpack the funny-shaped object we got back from AWS into our instance vars
+      lmf = aws_results.first
+      @filter_name = lmf.filter_name
+      @log_group_name = lmf.log_group_name
+      @pattern = lmf.filter_pattern # Note inconsistent name
+      # AWS SDK returns an array of metric transformations
+      # but only allows one (mandatory) entry, let's flatten that
+      @metric_name = lmf.metric_transformations.first.metric_name
+      @metric_namespace = lmf.metric_transformations.first.metric_namespace
+    end
+  end
+
+  class Backend
+    # Uses the cloudwatch API to really talk to AWS
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::CloudWatchLogs::Client
+
+      def describe_metric_filters(criteria)
+        query = {}
+        query[:filter_name_prefix] = criteria[:filter_name] if criteria[:filter_name]
+        query[:log_group_name] = criteria[:log_group_name] if criteria[:log_group_name]
+        # 'pattern' is not available as a remote filter,
+        # we filter it after the fact locally
+        # TODO: handle pagination?  Max 50/page.  Maybe you want a plural resource?
+        aws_response = aws_service_client.describe_metric_filters(query)
+        aws_response.metric_filters
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_config_recorder.rb

@@ -1,98 +1,98 @@
-class AwsConfigurationRecorder < Inspec.resource(1)
-  name 'aws_config_recorder'
-  desc 'Verifies settings for AWS Configuration Recorder'
-  example "
-    describe aws_config_recorder('My_Recorder') do
-      it { should exist }
-      it { should be_recording }
-      it { should be_all_supported }
-      it { should have_include_global_resource_types }
-    end
-  "
-  supports platform: 'aws'
-
-  include AwsSingularResourceMixin
-  attr_reader :role_arn, :resource_types, :recorder_name, :resp
-
-  def to_s
-    "Configuration_Recorder: #{@recorder_name}"
-  end
-
-  def recording_all_resource_types?
-    @recording_all_resource_types
-  end
-
-  def recording_all_global_types?
-    @recording_all_global_types
-  end
-
-  def status
-    return unless @exists
-    backend = BackendFactory.create(inspec_runner)
-    catch_aws_errors do
-      @resp = backend.describe_configuration_recorder_status(@query)
-      @status = @resp.configuration_recorders_status.first.to_h
-    end
-  end
-
-  def recording?
-    return unless @exists
-    status[:recording]
-  end
-
-  private
-
-  def validate_params(raw_params)
-    validated_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:recorder_name],
-      allowed_scalar_name: :recorder_name,
-      allowed_scalar_type: String,
-    )
-
-    # Must give it a recorder_name
-    if validated_params[:recorder_name].nil?
-      raise ArgumentError, 'You must provide recorder_name to aws_config_recorder'
-    end
-
-    validated_params
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-    @query = { configuration_recorder_names: [@recorder_name] }
-
-    catch_aws_errors do
-      begin
-        @resp = backend.describe_configuration_recorders(@query)
-      rescue Aws::ConfigService::Errors::NoSuchConfigurationRecorderException
-        @exists = false
-        return
-      end
-      @exists = !@resp.empty?
-      return unless @exists
-
-      @recorder = @resp.configuration_recorders.first.to_h
-      @recorder_name = @recorder[:name]
-      @role_arn = @recorder[:role_arn]
-      @recording_all_resource_types = @recorder[:recording_group][:all_supported]
-      @recording_all_global_types = @recorder[:recording_group][:include_global_resource_types]
-      @resource_types = @recorder[:recording_group][:resource_types]
-    end
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::ConfigService::Client
-
-      def describe_configuration_recorders(query)
-        aws_service_client.describe_configuration_recorders(query)
-      end
-
-      def describe_configuration_recorder_status(query)
-        aws_service_client.describe_configuration_recorder_status(query)
-      end
-    end
-  end
-end
+class AwsConfigurationRecorder < Inspec.resource(1)
+  name 'aws_config_recorder'
+  desc 'Verifies settings for AWS Configuration Recorder'
+  example "
+    describe aws_config_recorder('My_Recorder') do
+      it { should exist }
+      it { should be_recording }
+      it { should be_all_supported }
+      it { should have_include_global_resource_types }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :role_arn, :resource_types, :recorder_name, :resp
+
+  def to_s
+    "Configuration_Recorder: #{@recorder_name}"
+  end
+
+  def recording_all_resource_types?
+    @recording_all_resource_types
+  end
+
+  def recording_all_global_types?
+    @recording_all_global_types
+  end
+
+  def status
+    return unless @exists
+    backend = BackendFactory.create(inspec_runner)
+    catch_aws_errors do
+      @resp = backend.describe_configuration_recorder_status(@query)
+      @status = @resp.configuration_recorders_status.first.to_h
+    end
+  end
+
+  def recording?
+    return unless @exists
+    status[:recording]
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:recorder_name],
+      allowed_scalar_name: :recorder_name,
+      allowed_scalar_type: String,
+    )
+
+    # Must give it a recorder_name
+    if validated_params[:recorder_name].nil?
+      raise ArgumentError, 'You must provide recorder_name to aws_config_recorder'
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @query = { configuration_recorder_names: [@recorder_name] }
+
+    catch_aws_errors do
+      begin
+        @resp = backend.describe_configuration_recorders(@query)
+      rescue Aws::ConfigService::Errors::NoSuchConfigurationRecorderException
+        @exists = false
+        return
+      end
+      @exists = !@resp.empty?
+      return unless @exists
+
+      @recorder = @resp.configuration_recorders.first.to_h
+      @recorder_name = @recorder[:name]
+      @role_arn = @recorder[:role_arn]
+      @recording_all_resource_types = @recorder[:recording_group][:all_supported]
+      @recording_all_global_types = @recorder[:recording_group][:include_global_resource_types]
+      @resource_types = @recorder[:recording_group][:resource_types]
+    end
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::ConfigService::Client
+
+      def describe_configuration_recorders(query)
+        aws_service_client.describe_configuration_recorders(query)
+      end
+
+      def describe_configuration_recorder_status(query)
+        aws_service_client.describe_configuration_recorder_status(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_ec2_instance.rb

@@ -1,157 +1,157 @@
-# author: Christoph Hartmann
-class AwsEc2Instance < Inspec.resource(1)
-  name 'aws_ec2_instance'
-  desc 'Verifies settings for an EC2 instance'
-
-  example <<-EOX
-    describe aws_ec2_instance('i-123456') do
-      it { should be_running }
-      it { should have_roles }
-    end
-
-    describe aws_ec2_instance(name: 'my-instance') do
-      it { should be_running }
-      it { should have_roles }
-    end
-EOX
-  supports platform: 'aws'
-
-  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
-  def initialize(opts, conn = nil)
-    @opts = opts
-    @opts.is_a?(Hash) ? @display_name = @opts[:name] : @display_name = opts
-    @ec2_client = conn ? conn.ec2_client : inspec_runner.backend.aws_client(Aws::EC2::Client)
-    @ec2_resource = conn ? conn.ec2_resource : inspec_runner.backend.aws_resource(Aws::EC2::Resource, {})
-    @iam_resource = conn ? conn.iam_resource : inspec_runner.backend.aws_resource(Aws::IAM::Resource, {})
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_resource_mixin.rb
-  def catch_aws_errors
-    yield
-  rescue Aws::Errors::MissingCredentialsError
-    # The AWS error here is unhelpful:
-    # "unable to sign request without credentials set"
-    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
-    fail_resource('No AWS credentials available')
-  rescue Aws::Errors::ServiceError => e
-    fail_resource e.message
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
-  def inspec_runner
-    # When running under inspec-cli, we have an 'inspec' method that
-    # returns the runner. When running under unit tests, we don't
-    # have that, but we still have to call this to pass something
-    # (nil is OK) to the backend.
-    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
-    # TODO: remove after rewrite to include AwsSingularResource
-    inspec if respond_to?(:inspec)
-  end
-
-  def id
-    return @instance_id if defined?(@instance_id)
-    catch_aws_errors do
-      if @opts.is_a?(Hash)
-        first = @ec2_resource.instances(
-          {
-            filters: [{
-              name: 'tag:Name',
-              values: [@opts[:name]],
-            }],
-          },
-        ).first
-        # catch case where the instance is not known
-        @instance_id = first.id unless first.nil?
-      else
-        @instance_id = @opts
-      end
-    end
-  end
-  alias instance_id id
-
-  def exists?
-    return false if instance.nil?
-    instance.exists?
-  end
-
-  # returns the instance state
-  def state
-    catch_aws_errors do
-      instance&.state&.name
-    end
-  end
-
-  # helper methods for each state
-  %w{
-    pending running shutting-down
-    terminated stopping stopped unknown
-  }.each do |state_name|
-    define_method state_name.tr('-', '_') + '?' do
-      state == state_name
-    end
-  end
-
-  # attributes that we want to expose
-  %w{
-    public_ip_address private_ip_address key_name private_dns_name
-    public_dns_name subnet_id architecture root_device_type
-    root_device_name virtualization_type client_token launch_time
-    instance_type image_id vpc_id
-  }.each do |attribute|
-    define_method attribute do
-      catch_aws_errors do
-        instance.send(attribute) if instance
-      end
-    end
-  end
-
-  # Don't document this - it's a bit hard to use.  Our current doctrine
-  # is to use dumb things, like arrays of strings - use security_group_ids instead.
-  def security_groups
-    catch_aws_errors do
-      @security_groups ||= instance.security_groups.map { |sg|
-        { id: sg.group_id, name: sg.group_name }
-      }
-    end
-  end
-
-  def security_group_ids
-    catch_aws_errors do
-      @security_group_ids ||= instance.security_groups.map(&:group_id)
-    end
-  end
-
-  def tags
-    catch_aws_errors do
-      @tags ||= instance.tags.map { |tag| { key: tag.key, value: tag.value } }
-    end
-  end
-
-  def to_s
-    "EC2 Instance #{@display_name}"
-  end
-
-  def has_roles?
-    catch_aws_errors do
-      instance_profile = instance.iam_instance_profile
-
-      if instance_profile
-        roles = @iam_resource.instance_profile(
-          instance_profile.arn.gsub(%r{^.*\/}, ''),
-        ).roles
-      else
-        roles = nil
-      end
-
-      roles && !roles.empty?
-    end
-  end
-
-  private
-
-  def instance
-    catch_aws_errors { @instance ||= @ec2_resource.instance(id) }
-  end
-end
+# author: Christoph Hartmann
+class AwsEc2Instance < Inspec.resource(1)
+  name 'aws_ec2_instance'
+  desc 'Verifies settings for an EC2 instance'
+
+  example <<-EOX
+    describe aws_ec2_instance('i-123456') do
+      it { should be_running }
+      it { should have_roles }
+    end
+
+    describe aws_ec2_instance(name: 'my-instance') do
+      it { should be_running }
+      it { should have_roles }
+    end
+EOX
+  supports platform: 'aws'
+
+  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
+  def initialize(opts, conn = nil)
+    @opts = opts
+    @opts.is_a?(Hash) ? @display_name = @opts[:name] : @display_name = opts
+    @ec2_client = conn ? conn.ec2_client : inspec_runner.backend.aws_client(Aws::EC2::Client)
+    @ec2_resource = conn ? conn.ec2_resource : inspec_runner.backend.aws_resource(Aws::EC2::Resource, {})
+    @iam_resource = conn ? conn.iam_resource : inspec_runner.backend.aws_resource(Aws::IAM::Resource, {})
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_resource_mixin.rb
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource('No AWS credentials available')
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    # TODO: remove after rewrite to include AwsSingularResource
+    inspec if respond_to?(:inspec)
+  end
+
+  def id
+    return @instance_id if defined?(@instance_id)
+    catch_aws_errors do
+      if @opts.is_a?(Hash)
+        first = @ec2_resource.instances(
+          {
+            filters: [{
+              name: 'tag:Name',
+              values: [@opts[:name]],
+            }],
+          },
+        ).first
+        # catch case where the instance is not known
+        @instance_id = first.id unless first.nil?
+      else
+        @instance_id = @opts
+      end
+    end
+  end
+  alias instance_id id
+
+  def exists?
+    return false if instance.nil?
+    instance.exists?
+  end
+
+  # returns the instance state
+  def state
+    catch_aws_errors do
+      instance&.state&.name
+    end
+  end
+
+  # helper methods for each state
+  %w{
+    pending running shutting-down
+    terminated stopping stopped unknown
+  }.each do |state_name|
+    define_method state_name.tr('-', '_') + '?' do
+      state == state_name
+    end
+  end
+
+  # attributes that we want to expose
+  %w{
+    public_ip_address private_ip_address key_name private_dns_name
+    public_dns_name subnet_id architecture root_device_type
+    root_device_name virtualization_type client_token launch_time
+    instance_type image_id vpc_id
+  }.each do |attribute|
+    define_method attribute do
+      catch_aws_errors do
+        instance.send(attribute) if instance
+      end
+    end
+  end
+
+  # Don't document this - it's a bit hard to use.  Our current doctrine
+  # is to use dumb things, like arrays of strings - use security_group_ids instead.
+  def security_groups
+    catch_aws_errors do
+      @security_groups ||= instance.security_groups.map { |sg|
+        { id: sg.group_id, name: sg.group_name }
+      }
+    end
+  end
+
+  def security_group_ids
+    catch_aws_errors do
+      @security_group_ids ||= instance.security_groups.map(&:group_id)
+    end
+  end
+
+  def tags
+    catch_aws_errors do
+      @tags ||= instance.tags.map { |tag| { key: tag.key, value: tag.value } }
+    end
+  end
+
+  def to_s
+    "EC2 Instance #{@display_name}"
+  end
+
+  def has_roles?
+    catch_aws_errors do
+      instance_profile = instance.iam_instance_profile
+
+      if instance_profile
+        roles = @iam_resource.instance_profile(
+          instance_profile.arn.gsub(%r{^.*\/}, ''),
+        ).roles
+      else
+        roles = nil
+      end
+
+      roles && !roles.empty?
+    end
+  end
+
+  private
+
+  def instance
+    catch_aws_errors { @instance ||= @ec2_resource.instance(id) }
+  end
+end