inspec 2.1.0 → 2.1.10

data/lib/resources/aws/aws_s3_bucket_object.rb

@@ -0,0 +1,82 @@
+# author: Matthew Dromazos
+class AwsS3BucketObject < Inspec.resource(1)
+  name 'aws_s3_bucket_object'
+  desc 'Verifies settings for a s3 bucket object'
+  example "
+    describe aws_s3_bucket_object(bucket_name: 'bucket_name', key: 'file_name') do
+      it { should exist }
+      it { should_not be_public }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :bucket_name, :key
+
+  def to_s
+    # keep the format that aws uses.
+    "s3://#{@bucket_name}/#{@key}"
+  end
+
+  def object_acl
+    return @object_acl if defined? @object_acl
+    catch_aws_errors do
+      @object_acl = BackendFactory.create(inspec_runner).get_object_acl(bucket: bucket_name, key: key).grants
+    end
+    @object_acl
+  end
+
+  # RSpec will alias this to be_public
+  def public?
+    # first line just for formatting
+    false || \
+      object_acl.any? { |g| g.grantee.type == 'Group' && g.grantee.uri =~ /AllUsers/ } || \
+      object_acl.any? { |g| g.grantee.type == 'Group' && g.grantee.uri =~ /AuthenticatedUsers/ }
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:bucket_name, :key, :id],
+    )
+    if validated_params.empty? or !validated_params.key?(:bucket_name) or !validated_params.key?(:key)
+      raise ArgumentError, 'You must provide a bucket_name and key to aws_s3_bucket_object.'
+    end
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    catch_aws_errors do
+      begin
+        # Just use get_object to detect if the bucket exists
+        backend.get_object(bucket: bucket_name, key: key)
+      rescue Aws::S3::Errors::NoSuchBucket
+        @exists = false
+        return
+      rescue Aws::S3::Errors::NoSuchKey
+        @exists = false
+        return
+      end
+    end
+    @exists = true
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::S3::Client
+
+      # Used to detect if object exists
+      def get_object(query)
+        aws_service_client.get_object(query)
+      end
+
+      def get_object_acl(query)
+        aws_service_client.get_object_acl(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_security_group.rb

@@ -1,93 +1,93 @@
-class AwsSecurityGroup < Inspec.resource(1)
-  name 'aws_security_group'
-  desc 'Verifies settings for an individual AWS Security Group.'
-  example '
-    describe aws_security_group("sg-12345678") do
-      it { should exist }
-    end
-  '
-  supports platform: 'aws'
-
-  include AwsSingularResourceMixin
-  attr_reader :description, :group_id, :group_name, :vpc_id
-
-  def to_s
-    "EC2 Security Group #{@group_id}"
-  end
-
-  private
-
-  def validate_params(raw_params)
-    recognized_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:id, :group_id, :group_name, :vpc_id],
-      allowed_scalar_name: :group_id,
-      allowed_scalar_type: String,
-    )
-
-    # id is an alias for group_id
-    recognized_params[:group_id] = recognized_params.delete(:id) if recognized_params.key?(:id)
-
-    if recognized_params.key?(:group_id) && recognized_params[:group_id] !~ /^sg\-[0-9a-f]{8}/
-      raise ArgumentError, 'aws_security_group security group ID must be in the format "sg-" followed by 8 hexadecimal characters.'
-    end
-
-    if recognized_params.key?(:vpc_id) && recognized_params[:vpc_id] !~ /^vpc\-[0-9a-f]{8}/
-      raise ArgumentError, 'aws_security_group VPC ID must be in the format "vpc-" followed by 8 hexadecimal characters.'
-    end
-
-    validated_params = recognized_params
-
-    if validated_params.empty?
-      raise ArgumentError, 'You must provide parameters to aws_security_group, such as group_name, group_id, or vpc_id.g_group.'
-    end
-    validated_params
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-
-    # Transform into filter format expected by AWS
-    filters = []
-    [
-      :description,
-      :group_id,
-      :group_name,
-      :vpc_id,
-    ].each do |criterion_name|
-      instance_var = "@#{criterion_name}".to_sym
-      next unless instance_variable_defined?(instance_var)
-      val = instance_variable_get(instance_var)
-      next if val.nil?
-      filters.push(
-        {
-          name: criterion_name.to_s.tr('_', '-'),
-          values: [val],
-        },
-      )
-    end
-    dsg_response = backend.describe_security_groups(filters: filters)
-
-    if dsg_response.security_groups.empty?
-      @exists = false
-      return
-    end
-
-    @exists = true
-    @description = dsg_response.security_groups[0].description
-    @group_id   = dsg_response.security_groups[0].group_id
-    @group_name = dsg_response.security_groups[0].group_name
-    @vpc_id     = dsg_response.security_groups[0].vpc_id
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend self
-      self.aws_client_class = Aws::EC2::Client
-
-      def describe_security_groups(query)
-        aws_service_client.describe_security_groups(query)
-      end
-    end
-  end
-end
+class AwsSecurityGroup < Inspec.resource(1)
+  name 'aws_security_group'
+  desc 'Verifies settings for an individual AWS Security Group.'
+  example '
+    describe aws_security_group("sg-12345678") do
+      it { should exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :description, :group_id, :group_name, :vpc_id
+
+  def to_s
+    "EC2 Security Group #{@group_id}"
+  end
+
+  private
+
+  def validate_params(raw_params)
+    recognized_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:id, :group_id, :group_name, :vpc_id],
+      allowed_scalar_name: :group_id,
+      allowed_scalar_type: String,
+    )
+
+    # id is an alias for group_id
+    recognized_params[:group_id] = recognized_params.delete(:id) if recognized_params.key?(:id)
+
+    if recognized_params.key?(:group_id) && recognized_params[:group_id] !~ /^sg\-[0-9a-f]{8}/
+      raise ArgumentError, 'aws_security_group security group ID must be in the format "sg-" followed by 8 hexadecimal characters.'
+    end
+
+    if recognized_params.key?(:vpc_id) && recognized_params[:vpc_id] !~ /^vpc\-[0-9a-f]{8}/
+      raise ArgumentError, 'aws_security_group VPC ID must be in the format "vpc-" followed by 8 hexadecimal characters.'
+    end
+
+    validated_params = recognized_params
+
+    if validated_params.empty?
+      raise ArgumentError, 'You must provide parameters to aws_security_group, such as group_name, group_id, or vpc_id.g_group.'
+    end
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+
+    # Transform into filter format expected by AWS
+    filters = []
+    [
+      :description,
+      :group_id,
+      :group_name,
+      :vpc_id,
+    ].each do |criterion_name|
+      instance_var = "@#{criterion_name}".to_sym
+      next unless instance_variable_defined?(instance_var)
+      val = instance_variable_get(instance_var)
+      next if val.nil?
+      filters.push(
+        {
+          name: criterion_name.to_s.tr('_', '-'),
+          values: [val],
+        },
+      )
+    end
+    dsg_response = backend.describe_security_groups(filters: filters)
+
+    if dsg_response.security_groups.empty?
+      @exists = false
+      return
+    end
+
+    @exists = true
+    @description = dsg_response.security_groups[0].description
+    @group_id   = dsg_response.security_groups[0].group_id
+    @group_name = dsg_response.security_groups[0].group_name
+    @vpc_id     = dsg_response.security_groups[0].vpc_id
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend self
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_security_groups(query)
+        aws_service_client.describe_security_groups(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_security_groups.rb

@@ -1,68 +1,68 @@
-class AwsSecurityGroups < Inspec.resource(1)
-  name 'aws_security_groups'
-  desc 'Verifies settings for AWS Security Groups in bulk'
-  example <<-EOX
-    # Verify that you have security groups defined
-    describe aws_security_groups do
-      it { should exist }
-    end
-
-    # Verify you have more than the default security group
-    describe aws_security_groups do
-      its('entries.count') { should be > 1 }
-    end
-EOX
-  supports platform: 'aws'
-
-  include AwsPluralResourceMixin
-
-  # Underlying FilterTable implementation.
-  filter = FilterTable.create
-  filter.add_accessor(:where)
-        .add_accessor(:entries)
-        .add(:exists?) { |x| !x.entries.empty? }
-        .add(:group_ids, field: :group_id)
-  filter.connect(self, :table)
-
-  def to_s
-    'EC2 Security Groups'
-  end
-
-  private
-
-  def validate_params(raw_criteria)
-    unless raw_criteria.is_a? Hash
-      raise 'Unrecognized criteria for fetching Security Groups. ' \
-            "Use 'criteria: value' format."
-    end
-
-    # No criteria yet
-    unless raw_criteria.empty?
-      raise ArgumentError, 'aws_ec2_security_groups does not currently accept resource parameters.'
-    end
-    raw_criteria
-  end
-
-  def fetch_from_api
-    @table = []
-    backend = BackendFactory.create(inspec_runner)
-    backend.describe_security_groups({}).security_groups.each do |sg_info|
-      @table.push({
-                    group_id: sg_info.group_id,
-        group_name: sg_info.group_name,
-        vpc_id: sg_info.vpc_id,
-                  })
-    end
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend self
-      self.aws_client_class = Aws::EC2::Client
-
-      def describe_security_groups(query)
-        aws_service_client.describe_security_groups(query)
-      end
-    end
-  end
-end
+class AwsSecurityGroups < Inspec.resource(1)
+  name 'aws_security_groups'
+  desc 'Verifies settings for AWS Security Groups in bulk'
+  example <<-EOX
+    # Verify that you have security groups defined
+    describe aws_security_groups do
+      it { should exist }
+    end
+
+    # Verify you have more than the default security group
+    describe aws_security_groups do
+      its('entries.count') { should be > 1 }
+    end
+EOX
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  # Underlying FilterTable implementation.
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:group_ids, field: :group_id)
+  filter.connect(self, :table)
+
+  def to_s
+    'EC2 Security Groups'
+  end
+
+  private
+
+  def validate_params(raw_criteria)
+    unless raw_criteria.is_a? Hash
+      raise 'Unrecognized criteria for fetching Security Groups. ' \
+            "Use 'criteria: value' format."
+    end
+
+    # No criteria yet
+    unless raw_criteria.empty?
+      raise ArgumentError, 'aws_ec2_security_groups does not currently accept resource parameters.'
+    end
+    raw_criteria
+  end
+
+  def fetch_from_api
+    @table = []
+    backend = BackendFactory.create(inspec_runner)
+    backend.describe_security_groups({}).security_groups.each do |sg_info|
+      @table.push({
+                    group_id: sg_info.group_id,
+        group_name: sg_info.group_name,
+        vpc_id: sg_info.vpc_id,
+                  })
+    end
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend self
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_security_groups(query)
+        aws_service_client.describe_security_groups(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_sns_subscription.rb

@@ -0,0 +1,78 @@
+class AwsSnsSubscription < Inspec.resource(1)
+  name 'aws_sns_subscription'
+  desc 'Verifies settings for an SNS Subscription'
+  example "
+    describe aws_sns_subscription('arn:aws:sns:us-east-1::test-topic-01:b214aff5-a2c7-438f-a753-8494493f2ff6') do
+      it { should_not have_raw_message_delivery }
+      it { should be_confirmation_authenticated }
+      its('owner') { should cmp '12345678' }
+      its('topic_arn') { should cmp 'arn:aws:sns:us-east-1::test-topic-01' }
+      its('endpoint') { should cmp 'arn:aws:sqs:us-east-1::test-queue-01' }
+      its('protocol') { should cmp 'sqs' }
+    end
+  "
+
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :arn, :owner, :raw_message_delivery, :topic_arn, :endpoint, :protocol,
+              :confirmation_was_authenticated, :aws_response
+
+  alias confirmation_authenticated? confirmation_was_authenticated
+  alias raw_message_delivery? raw_message_delivery
+
+  def has_raw_message_delivery?
+    raw_message_delivery
+  end
+
+  def to_s
+    "SNS Subscription #{@arn}"
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:subscription_arn],
+      allowed_scalar_name: :subscription_arn,
+      allowed_scalar_type: String,
+    )
+
+    if validated_params.empty?
+      raise ArgumentError, 'You must provide a subscription_arn to aws_sns_subscription.'
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    catch_aws_errors do
+      begin
+        aws_response = backend.get_subscription_attributes(subscription_arn: @subscription_arn).attributes
+        @exists = true
+        @owner = aws_response['Owner']
+        @raw_message_delivery = aws_response['RawMessageDelivery'].eql?('true')
+        @topic_arn = aws_response['TopicArn']
+        @endpoint = aws_response['Endpoint']
+        @protocol = aws_response['Protocol']
+        @confirmation_was_authenticated = aws_response['ConfirmationWasAuthenticated'].eql?('true')
+      rescue Aws::SNS::Errors::NotFound
+        @exists = false
+        return
+      end
+    end
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend self
+      self.aws_client_class = Aws::SNS::Client
+
+      def get_subscription_attributes(criteria)
+        aws_service_client.get_subscription_attributes(criteria)
+      end
+    end
+  end
+end