inspec 2.1.0 → 2.1.10

data/lib/resources/aws/aws_iam_root_user.rb

@@ -1,60 +1,60 @@
-class AwsIamRootUser < Inspec.resource(1)
-  name 'aws_iam_root_user'
-  desc 'Verifies settings for AWS root account'
-  example "
-    describe aws_iam_root_user do
-      it { should have_access_key }
-    end
-  "
-  supports platform: 'aws'
-
-  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
-  def initialize(conn = nil)
-    @client = conn ? conn.iam_client : inspec_runner.backend.aws_client(Aws::IAM::Client)
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_resource_mixin.rb
-  def catch_aws_errors
-    yield
-  rescue Aws::Errors::MissingCredentialsError
-    # The AWS error here is unhelpful:
-    # "unable to sign request without credentials set"
-    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
-    fail_resource('No AWS credentials available')
-  rescue Aws::Errors::ServiceError => e
-    fail_resource e.message
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
-  def inspec_runner
-    # When running under inspec-cli, we have an 'inspec' method that
-    # returns the runner. When running under unit tests, we don't
-    # have that, but we still have to call this to pass something
-    # (nil is OK) to the backend.
-    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
-    # TODO: remove after rewrite to include AwsSingularResource
-    inspec if respond_to?(:inspec)
-  end
-
-  def has_access_key?
-    summary_account['AccountAccessKeysPresent'] == 1
-  end
-
-  def has_mfa_enabled?
-    summary_account['AccountMFAEnabled'] == 1
-  end
-
-  def to_s
-    'AWS Root-User'
-  end
-
-  private
-
-  def summary_account
-    catch_aws_errors do
-      @summary_account ||= @client.get_account_summary.summary_map
-    end
-  end
-end
+class AwsIamRootUser < Inspec.resource(1)
+  name 'aws_iam_root_user'
+  desc 'Verifies settings for AWS root account'
+  example "
+    describe aws_iam_root_user do
+      it { should have_access_key }
+    end
+  "
+  supports platform: 'aws'
+
+  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
+  def initialize(conn = nil)
+    @client = conn ? conn.iam_client : inspec_runner.backend.aws_client(Aws::IAM::Client)
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_resource_mixin.rb
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource('No AWS credentials available')
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    # TODO: remove after rewrite to include AwsSingularResource
+    inspec if respond_to?(:inspec)
+  end
+
+  def has_access_key?
+    summary_account['AccountAccessKeysPresent'] == 1
+  end
+
+  def has_mfa_enabled?
+    summary_account['AccountMFAEnabled'] == 1
+  end
+
+  def to_s
+    'AWS Root-User'
+  end
+
+  private
+
+  def summary_account
+    catch_aws_errors do
+      @summary_account ||= @client.get_account_summary.summary_map
+    end
+  end
+end

data/lib/resources/aws/aws_iam_user.rb

@@ -1,111 +1,111 @@
-# author: Alex Bedley
-# author: Steffanie Freeman
-# author: Simon Varlow
-# author: Chris Redekop
-class AwsIamUser < Inspec.resource(1)
-  name 'aws_iam_user'
-  desc 'Verifies settings for AWS IAM user'
-  example "
-    describe aws_iam_user(username: 'test_user') do
-      it { should have_mfa_enabled }
-      it { should_not have_console_password }
-    end
-  "
-  supports platform: 'aws'
-
-  include AwsSingularResourceMixin
-  attr_reader :access_keys, :has_console_password, :has_mfa_enabled, :username
-  alias has_mfa_enabled? has_mfa_enabled
-  alias has_console_password? has_console_password
-
-  def name
-    warn "[DEPRECATION] - Property ':name' is deprecated on the aws_iam_user resource.  Use ':username' instead."
-    username
-  end
-
-  def to_s
-    "IAM User #{username}"
-  end
-
-  private
-
-  def validate_params(raw_params)
-    validated_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:username, :aws_user_struct, :name, :user],
-      allowed_scalar_name: :username,
-      allowed_scalar_type: String,
-    )
-    # If someone passed :name, rename it to :username
-    if validated_params.key?(:name)
-      warn "[DEPRECATION] - Resource parameter ':name' is deprecated on the aws_iam_user resource.  Use ':username' instead."
-      validated_params[:username] = validated_params.delete(:name)
-    end
-
-    # If someone passed :user, rename it to :aws_user_struct
-    if validated_params.key?(:user)
-      warn "[DEPRECATION] - Resource parameter ':user' is deprecated on the aws_iam_user resource.  Use ':aws_user_struct' instead."
-      validated_params[:aws_user_struct] = validated_params.delete(:user)
-    end
-
-    if validated_params.empty?
-      raise ArgumentError, 'You must provide a username to aws_iam_user.'
-    end
-    validated_params
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-    @aws_user_struct ||= nil # silence unitialized warning
-    unless @aws_user_struct
-      begin
-        @aws_user_struct = backend.get_user(user_name: username)
-      rescue Aws::IAM::Errors::NoSuchEntity
-        @exists = false
-        return
-      end
-    end
-    # TODO: extract properties from aws_user_struct?
-
-    @exists = true
-
-    begin
-      _login_profile = backend.get_login_profile(user_name: username)
-      @has_console_password = true
-      # Password age also available here
-    rescue Aws::IAM::Errors::NoSuchEntity
-      @has_console_password = false
-    end
-
-    mfa_info = backend.list_mfa_devices(user_name: username)
-    @has_mfa_enabled = !mfa_info.mfa_devices.empty?
-
-    # TODO: consider returning Inspec AwsIamAccessKey objects
-    @access_keys = backend.list_access_keys(user_name: username).access_key_metadata
-    # If the above call fails, we get nil here; but we promise access_keys will be an array.
-    @access_keys ||= []
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::IAM::Client
-
-      def get_user(criteria)
-        aws_service_client.get_user(criteria)
-      end
-
-      def get_login_profile(criteria)
-        aws_service_client.get_login_profile(criteria)
-      end
-
-      def list_mfa_devices(criteria)
-        aws_service_client.list_mfa_devices(criteria)
-      end
-
-      def list_access_keys(criteria)
-        aws_service_client.list_access_keys(criteria)
-      end
-    end
-  end
-end
+# author: Alex Bedley
+# author: Steffanie Freeman
+# author: Simon Varlow
+# author: Chris Redekop
+class AwsIamUser < Inspec.resource(1)
+  name 'aws_iam_user'
+  desc 'Verifies settings for AWS IAM user'
+  example "
+    describe aws_iam_user(username: 'test_user') do
+      it { should have_mfa_enabled }
+      it { should_not have_console_password }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :access_keys, :has_console_password, :has_mfa_enabled, :username
+  alias has_mfa_enabled? has_mfa_enabled
+  alias has_console_password? has_console_password
+
+  def name
+    warn "[DEPRECATION] - Property ':name' is deprecated on the aws_iam_user resource.  Use ':username' instead."
+    username
+  end
+
+  def to_s
+    "IAM User #{username}"
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:username, :aws_user_struct, :name, :user],
+      allowed_scalar_name: :username,
+      allowed_scalar_type: String,
+    )
+    # If someone passed :name, rename it to :username
+    if validated_params.key?(:name)
+      warn "[DEPRECATION] - Resource parameter ':name' is deprecated on the aws_iam_user resource.  Use ':username' instead."
+      validated_params[:username] = validated_params.delete(:name)
+    end
+
+    # If someone passed :user, rename it to :aws_user_struct
+    if validated_params.key?(:user)
+      warn "[DEPRECATION] - Resource parameter ':user' is deprecated on the aws_iam_user resource.  Use ':aws_user_struct' instead."
+      validated_params[:aws_user_struct] = validated_params.delete(:user)
+    end
+
+    if validated_params.empty?
+      raise ArgumentError, 'You must provide a username to aws_iam_user.'
+    end
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @aws_user_struct ||= nil # silence unitialized warning
+    unless @aws_user_struct
+      begin
+        @aws_user_struct = backend.get_user(user_name: username)
+      rescue Aws::IAM::Errors::NoSuchEntity
+        @exists = false
+        return
+      end
+    end
+    # TODO: extract properties from aws_user_struct?
+
+    @exists = true
+
+    begin
+      _login_profile = backend.get_login_profile(user_name: username)
+      @has_console_password = true
+      # Password age also available here
+    rescue Aws::IAM::Errors::NoSuchEntity
+      @has_console_password = false
+    end
+
+    mfa_info = backend.list_mfa_devices(user_name: username)
+    @has_mfa_enabled = !mfa_info.mfa_devices.empty?
+
+    # TODO: consider returning Inspec AwsIamAccessKey objects
+    @access_keys = backend.list_access_keys(user_name: username).access_key_metadata
+    # If the above call fails, we get nil here; but we promise access_keys will be an array.
+    @access_keys ||= []
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::IAM::Client
+
+      def get_user(criteria)
+        aws_service_client.get_user(criteria)
+      end
+
+      def get_login_profile(criteria)
+        aws_service_client.get_login_profile(criteria)
+      end
+
+      def list_mfa_devices(criteria)
+        aws_service_client.list_mfa_devices(criteria)
+      end
+
+      def list_access_keys(criteria)
+        aws_service_client.list_access_keys(criteria)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_iam_users.rb

@@ -1,108 +1,108 @@
-# author: Alex Bedley
-# author: Steffanie Freeman
-# author: Simon Varlow
-# author: Chris Redekop
-class AwsIamUsers < Inspec.resource(1)
-  name 'aws_iam_users'
-  desc 'Verifies settings for AWS IAM users'
-  example '
-    describe aws_iam_users.where(has_mfa_enabled?: false) do
-      it { should_not exist }
-    end
-    describe aws_iam_users.where(has_console_password?: true) do
-      it { should exist }
-    end
-  '
-  supports platform: 'aws'
-
-  include AwsPluralResourceMixin
-
-  filter = FilterTable.create
-  filter.add_accessor(:where)
-        .add_accessor(:entries)
-        .add(:exists?) { |x| !x.entries.empty? }
-        .add(:has_mfa_enabled?, field: :has_mfa_enabled)
-        .add(:has_console_password?, field: :has_console_password)
-        .add(:password_ever_used?, field: :password_ever_used?)
-        .add(:password_never_used?, field: :password_never_used?)
-        .add(:password_last_used_days_ago, field: :password_last_used_days_ago)
-        .add(:username, field: :user_name)
-  filter.connect(self, :table)
-
-  def validate_params(raw_params)
-    # No params yet
-    unless raw_params.empty?
-      raise ArgumentError, 'aws_iam_users does not accept resource parameters'
-    end
-    raw_params
-  end
-
-  def fetch_from_api_paginated(backend)
-    table = []
-    page_marker = nil
-    loop do
-      api_result = backend.list_users(marker: page_marker)
-      table += api_result.users.map(&:to_h)
-      page_marker = api_result.marker
-      break unless api_result.is_truncated
-    end
-    table
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-    @table = fetch_from_api_paginated(backend)
-
-    # TODO: lazy columns - https://github.com/chef/inspec-aws/issues/100
-    @table.each do |user|
-      begin
-        _login_profile = backend.get_login_profile(user_name: user[:user_name])
-        user[:has_console_password] = true
-      rescue Aws::IAM::Errors::NoSuchEntity
-        user[:has_console_password] = false
-      end
-      user[:has_console_password?] = user[:has_console_password]
-
-      begin
-        aws_mfa_devices = backend.list_mfa_devices(user_name: user[:user_name])
-        user[:has_mfa_enabled] = !aws_mfa_devices.mfa_devices.empty?
-      rescue Aws::IAM::Errors::NoSuchEntity
-        user[:has_mfa_enabled] = false
-      end
-      user[:has_mfa_enabled?] = user[:has_mfa_enabled]
-      password_last_used = user[:password_last_used]
-      user[:password_ever_used?] = !password_last_used.nil?
-      user[:password_never_used?] = password_last_used.nil?
-      next unless user[:password_ever_used?]
-      user[:password_last_used_days_ago] = ((Time.now - password_last_used) / (24*60*60)).to_i
-    end
-    @table
-  end
-
-  def to_s
-    'IAM Users'
-  end
-
-  #===========================================================================#
-  #                        Backend Implementation
-  #===========================================================================#
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::IAM::Client
-
-      # TODO: delegate this out
-      def list_users(query = {})
-        aws_service_client.list_users(query)
-      end
-
-      def get_login_profile(query)
-        aws_service_client.get_login_profile(query)
-      end
-
-      def list_mfa_devices(query)
-        aws_service_client.list_mfa_devices(query)
-      end
-    end
-  end
-end
+# author: Alex Bedley
+# author: Steffanie Freeman
+# author: Simon Varlow
+# author: Chris Redekop
+class AwsIamUsers < Inspec.resource(1)
+  name 'aws_iam_users'
+  desc 'Verifies settings for AWS IAM users'
+  example '
+    describe aws_iam_users.where(has_mfa_enabled?: false) do
+      it { should_not exist }
+    end
+    describe aws_iam_users.where(has_console_password?: true) do
+      it { should exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:has_mfa_enabled?, field: :has_mfa_enabled)
+        .add(:has_console_password?, field: :has_console_password)
+        .add(:password_ever_used?, field: :password_ever_used?)
+        .add(:password_never_used?, field: :password_never_used?)
+        .add(:password_last_used_days_ago, field: :password_last_used_days_ago)
+        .add(:username, field: :user_name)
+  filter.connect(self, :table)
+
+  def validate_params(raw_params)
+    # No params yet
+    unless raw_params.empty?
+      raise ArgumentError, 'aws_iam_users does not accept resource parameters'
+    end
+    raw_params
+  end
+
+  def fetch_from_api_paginated(backend)
+    table = []
+    page_marker = nil
+    loop do
+      api_result = backend.list_users(marker: page_marker)
+      table += api_result.users.map(&:to_h)
+      page_marker = api_result.marker
+      break unless api_result.is_truncated
+    end
+    table
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @table = fetch_from_api_paginated(backend)
+
+    # TODO: lazy columns - https://github.com/chef/inspec-aws/issues/100
+    @table.each do |user|
+      begin
+        _login_profile = backend.get_login_profile(user_name: user[:user_name])
+        user[:has_console_password] = true
+      rescue Aws::IAM::Errors::NoSuchEntity
+        user[:has_console_password] = false
+      end
+      user[:has_console_password?] = user[:has_console_password]
+
+      begin
+        aws_mfa_devices = backend.list_mfa_devices(user_name: user[:user_name])
+        user[:has_mfa_enabled] = !aws_mfa_devices.mfa_devices.empty?
+      rescue Aws::IAM::Errors::NoSuchEntity
+        user[:has_mfa_enabled] = false
+      end
+      user[:has_mfa_enabled?] = user[:has_mfa_enabled]
+      password_last_used = user[:password_last_used]
+      user[:password_ever_used?] = !password_last_used.nil?
+      user[:password_never_used?] = password_last_used.nil?
+      next unless user[:password_ever_used?]
+      user[:password_last_used_days_ago] = ((Time.now - password_last_used) / (24*60*60)).to_i
+    end
+    @table
+  end
+
+  def to_s
+    'IAM Users'
+  end
+
+  #===========================================================================#
+  #                        Backend Implementation
+  #===========================================================================#
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::IAM::Client
+
+      # TODO: delegate this out
+      def list_users(query = {})
+        aws_service_client.list_users(query)
+      end
+
+      def get_login_profile(query)
+        aws_service_client.get_login_profile(query)
+      end
+
+      def list_mfa_devices(query)
+        aws_service_client.list_mfa_devices(query)
+      end
+    end
+  end
+end