inspec 2.1.43 → 2.1.54

data/lib/resources/aws/aws_config_delivery_channel.rb

@@ -28,29 +28,23 @@ class AwsConfigDeliveryChannel < Inspec.resource(1)
       allowed_scalar_type: String,
     )
 
-    # Make sure channel_name is given as param
-    if validated_params[:channel_name].nil?
-      raise ArgumentError, 'You must provide a channel_name to aws_config_delivery_channel'
-    end
-
     validated_params
   end
 
   def fetch_from_api
     backend = BackendFactory.create(inspec_runner)
-    query = { delivery_channel_names: [@channel_name] }
-    catch_aws_errors do
-      @resp = backend.describe_delivery_channels(query)
-    end
-    @exists = !@resp.empty?
-    return unless @exists
+    query = @channel_name ? { delivery_channel_names: [@channel_name] } : {}
+    response = backend.describe_delivery_channels(query)
+
+    @exists = !response.delivery_channels.empty?
+    return unless exists?
 
-    @channel = @resp.delivery_channels.first.to_h
-    @channel_name = @channel[:name]
-    @s3_bucket_name = @channel[:s3_bucket_name]
-    @s3_key_prefix = @channel[:s3_key_prefix]
-    @sns_topic_arn = @channel[:sns_topic_arn]
-    @delivery_frequency_in_hours = @channel[:config_snapshot_delivery_properties][:delivery_frequency] unless @channel[:config_snapshot_delivery_properties].nil?
+    channel = response.delivery_channels.first.to_h
+    @channel_name = channel[:name]
+    @s3_bucket_name = channel[:s3_bucket_name]
+    @s3_key_prefix = channel[:s3_key_prefix]
+    @sns_topic_arn = channel[:sns_topic_arn]
+    @delivery_frequency_in_hours = channel.dig(:config_snapshot_delivery_properties, :delivery_frequency)
     frequencies = {
       'One_Hour' => 1,
       'TwentyFour_Hours' => 24,
@@ -59,6 +53,8 @@ class AwsConfigDeliveryChannel < Inspec.resource(1)
       'Twelve_Hours' => 12,
     }
     @delivery_frequency_in_hours = frequencies[@delivery_frequency_in_hours]
+  rescue Aws::ConfigService::Errors::NoSuchDeliveryChannelException
+    @exists = false
   end
 
   class Backend
@@ -66,10 +62,8 @@ class AwsConfigDeliveryChannel < Inspec.resource(1)
       BackendFactory.set_default_backend(self)
       self.aws_client_class = Aws::ConfigService::Client
 
-      def describe_delivery_channels(query)
+      def describe_delivery_channels(query = {})
         aws_service_client.describe_delivery_channels(query)
-      rescue Aws::ConfigService::Errors::NoSuchDeliveryChannelException
-        return {}
       end
     end
   end

data/lib/resources/aws/aws_config_recorder.rb

@@ -12,7 +12,7 @@ class AwsConfigurationRecorder < Inspec.resource(1)
   supports platform: 'aws'
 
   include AwsSingularResourceMixin
-  attr_reader :role_arn, :resource_types, :recorder_name, :resp
+  attr_reader :role_arn, :resource_types, :recorder_name
 
   def to_s
     "Configuration_Recorder: #{@recorder_name}"
@@ -27,11 +27,11 @@ class AwsConfigurationRecorder < Inspec.resource(1)
   end
 
   def status
-    return unless @exists
+    return {} unless @exists
     backend = BackendFactory.create(inspec_runner)
     catch_aws_errors do
-      @resp = backend.describe_configuration_recorder_status(@query)
-      @status = @resp.configuration_recorders_status.first.to_h
+      response = backend.describe_configuration_recorder_status(configuration_recorder_names: [@recorder_name])
+      @status = response.configuration_recorders_status.first.to_h
     end
   end
 
@@ -50,35 +50,30 @@ class AwsConfigurationRecorder < Inspec.resource(1)
       allowed_scalar_type: String,
     )
 
-    # Must give it a recorder_name
-    if validated_params[:recorder_name].nil?
-      raise ArgumentError, 'You must provide recorder_name to aws_config_recorder'
-    end
-
     validated_params
   end
 
   def fetch_from_api
     backend = BackendFactory.create(inspec_runner)
-    @query = { configuration_recorder_names: [@recorder_name] }
+    query = @recorder_name ? { configuration_recorder_names: [@recorder_name] } : {}
+    response = backend.describe_configuration_recorders(query)
 
-    catch_aws_errors do
-      begin
-        @resp = backend.describe_configuration_recorders(@query)
-      rescue Aws::ConfigService::Errors::NoSuchConfigurationRecorderException
-        @exists = false
-        return
-      end
-      @exists = !@resp.empty?
-      return unless @exists
-
-      @recorder = @resp.configuration_recorders.first.to_h
-      @recorder_name = @recorder[:name]
-      @role_arn = @recorder[:role_arn]
-      @recording_all_resource_types = @recorder[:recording_group][:all_supported]
-      @recording_all_global_types = @recorder[:recording_group][:include_global_resource_types]
-      @resource_types = @recorder[:recording_group][:resource_types]
+    @exists = !response.configuration_recorders.empty?
+    return unless exists?
+
+    if response.configuration_recorders.count > 1
+      raise ArgumentError, 'Internal error: unexpectedly received multiple AWS Config Recorder objects from API; expected to be singleton per-region.  Please file a bug report at https://github.com/chef/inspec/issues .'
     end
+
+    recorder = response.configuration_recorders.first.to_h
+    @recorder_name = recorder[:name]
+    @role_arn = recorder[:role_arn]
+    @recording_all_resource_types = recorder[:recording_group][:all_supported]
+    @recording_all_global_types = recorder[:recording_group][:include_global_resource_types]
+    @resource_types = recorder[:recording_group][:resource_types]
+  rescue Aws::ConfigService::Errors::NoSuchConfigurationRecorderException
+    @exists = false
+    return
   end
 
   class Backend

data/lib/resources/aws/aws_iam_policy.rb

@@ -83,7 +83,14 @@ class AwsIamPolicy < Inspec.resource(1)
 
   def statement_count
     return nil unless exists?
-    policy['Statement'].count
+    # Typically it is an array of statements
+    if policy['Statement'].is_a? Array
+      policy['Statement'].count
+    else
+      # But if there is one statement, it is permissable to degenerate the array,
+      # and place the statement as a hash directly under the 'Statement' key
+      return 1
+    end
   end
 
   def has_statement?(raw_criteria = {})
@@ -141,6 +148,11 @@ class AwsIamPolicy < Inspec.resource(1)
   end
 
   def has_statement__normalize_statements
+    # Some single-statement policies place their statement
+    # directly in policy['Statement'], rather than in an
+    # Array within it.  See arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly
+    # Thus, coerce to Array.
+    policy['Statement'] = [policy['Statement']] if policy['Statement'].is_a? Hash
     policy['Statement'].map do |statement|
       # Coerce some values into arrays
       %w{Action Resource}.each do |field|
@@ -177,7 +189,12 @@ class AwsIamPolicy < Inspec.resource(1)
   def has_statement__array_criterion(crit_name, statement, criteria)
     return true unless criteria.key?(crit_name)
     check = criteria[crit_name]
-    values = statement[crit_name] # This is an array due to normalize_statements
+    # This is an array due to normalize_statements
+    # If it is nil, the statement does not have an entry for that dimension;
+    # but since we were asked to match on it (on nothing), we
+    # decide to never match
+    values = statement[crit_name]
+    return false if values.nil?
 
     if check.is_a?(String)
       # If check is a string, it only has to match one of the values

data/lib/resources/aws/aws_iam_role.rb

@@ -11,6 +11,10 @@ class AwsIamRole < Inspec.resource(1)
   include AwsSingularResourceMixin
   attr_reader :description, :role_name
 
+  def to_s
+    "IAM Role #{role_name}"
+  end
+
   private
 
   def validate_params(raw_params)

data/lib/resources/aws/aws_iam_user.rb

@@ -9,12 +9,15 @@ class AwsIamUser < Inspec.resource(1)
     describe aws_iam_user(username: 'test_user') do
       it { should have_mfa_enabled }
       it { should_not have_console_password }
+      it { should_not have_inline_user_policies }
+      it { should_not have_attached_user_policies }
     end
   "
   supports platform: 'aws'
 
   include AwsSingularResourceMixin
-  attr_reader :access_keys, :has_console_password, :has_mfa_enabled, :username
+  attr_reader :access_keys, :attached_policy_names, :attached_policy_arns, \
+              :has_console_password, :has_mfa_enabled, :inline_policy_names, :username
   alias has_mfa_enabled? has_mfa_enabled
   alias has_console_password? has_console_password
 
@@ -27,6 +30,16 @@ class AwsIamUser < Inspec.resource(1)
     "IAM User #{username}"
   end
 
+  def has_attached_policies?
+    return nil unless exists?
+    !attached_policy_names.empty?
+  end
+
+  def has_inline_policies?
+    return nil unless exists?
+    !inline_policy_names.empty?
+  end
+
   private
 
   def validate_params(raw_params)
@@ -62,6 +75,10 @@ class AwsIamUser < Inspec.resource(1)
         @aws_user_struct = backend.get_user(user_name: username)
       rescue Aws::IAM::Errors::NoSuchEntity
         @exists = false
+        @access_keys = []
+        @inline_policy_names = []
+        @attached_policy_arns = []
+        @attached_policy_names = []
         return
       end
     end
@@ -84,6 +101,12 @@ class AwsIamUser < Inspec.resource(1)
     @access_keys = backend.list_access_keys(user_name: username).access_key_metadata
     # If the above call fails, we get nil here; but we promise access_keys will be an array.
     @access_keys ||= []
+
+    @inline_policy_names = backend.list_user_policies(user_name: username).policy_names
+
+    attached_policies = backend.list_attached_user_policies(user_name: username).attached_policies
+    @attached_policy_arns = attached_policies.map { |p| p[:policy_arn] }
+    @attached_policy_names = attached_policies.map { |p| p[:policy_name] }
   end
 
   class Backend
@@ -106,6 +129,14 @@ class AwsIamUser < Inspec.resource(1)
       def list_access_keys(criteria)
         aws_service_client.list_access_keys(criteria)
       end
+
+      def list_user_policies(criteria)
+        aws_service_client.list_user_policies(criteria)
+      end
+
+      def list_attached_user_policies(criteria)
+        aws_service_client.list_attached_user_policies(criteria)
+      end
     end
   end
 end

data/lib/resources/aws/aws_iam_users.rb

@@ -12,6 +12,12 @@ class AwsIamUsers < Inspec.resource(1)
     describe aws_iam_users.where(has_console_password?: true) do
       it { should exist }
     end
+    describe aws_iam_users.where(has_inline_policies?: true) do
+      it { should_not exist }
+    end
+    describe aws_iam_users.where(has_attached_policies?: true) do
+      it { should_not exist }
+    end
   '
   supports platform: 'aws'
 
@@ -23,10 +29,21 @@ class AwsIamUsers < Inspec.resource(1)
         .add(:exists?) { |x| !x.entries.empty? }
         .add(:has_mfa_enabled?, field: :has_mfa_enabled)
         .add(:has_console_password?, field: :has_console_password)
+        .add(:has_inline_policies?, field: :has_inline_policies)
+        .add(:has_attached_policies?, field: :has_attached_policies)
         .add(:password_ever_used?, field: :password_ever_used?)
         .add(:password_never_used?, field: :password_never_used?)
         .add(:password_last_used_days_ago, field: :password_last_used_days_ago)
-        .add(:username, field: :user_name)
+        .add(:usernames, field: :user_name)
+        .add(:username) { |res| res.entries.map { |row| row[:user_name] } } # We should deprecate this; plural resources get plural properties
+  # Next three are needed to declare fields for use by the de-duped set
+  filter.add(:dupe_inline_policy_names, field: :inline_policy_names_source)
+        .add(:dupe_attached_policy_names, field: :attached_policy_names_source)
+        .add(:dupe_attached_policy_arns, field: :attached_policy_arns_source)
+  # These three are now able to access the above three in .entries
+  filter.add(:inline_policy_names) { |obj| obj.dupe_inline_policy_names.flatten.uniq }
+        .add(:attached_policy_names) { |obj| obj.dupe_attached_policy_names.flatten.uniq }
+        .add(:attached_policy_arns) { |obj| obj.dupe_attached_policy_arns.flatten.uniq }
   filter.connect(self, :table)
 
   def validate_params(raw_params)
@@ -49,12 +66,14 @@ class AwsIamUsers < Inspec.resource(1)
     table
   end
 
-  def fetch_from_api
+  def fetch_from_api # rubocop: disable Metrics/AbcSize
     backend = BackendFactory.create(inspec_runner)
     @table = fetch_from_api_paginated(backend)
 
     # TODO: lazy columns - https://github.com/chef/inspec-aws/issues/100
     @table.each do |user|
+      # Some of these throw exceptions to indicate empty results;
+      # others return empty arrays
       begin
         _login_profile = backend.get_login_profile(user_name: user[:user_name])
         user[:has_console_password] = true
@@ -70,6 +89,17 @@ class AwsIamUsers < Inspec.resource(1)
         user[:has_mfa_enabled] = false
       end
       user[:has_mfa_enabled?] = user[:has_mfa_enabled]
+
+      user[:inline_policy_names_source] = backend.list_user_policies(user_name: user[:user_name]).policy_names
+      user[:has_inline_policies] = !user[:inline_policy_names_source].empty?
+      user[:has_inline_policies?] = user[:has_inline_policies]
+
+      attached_policies = backend.list_attached_user_policies(user_name: user[:user_name]).attached_policies
+      user[:has_attached_policies] = !attached_policies.empty?
+      user[:has_attached_policies?] = user[:has_attached_policies]
+      user[:attached_policy_names_source] = attached_policies.map { |p| p[:policy_name] }
+      user[:attached_policy_arns_source] = attached_policies.map { |p| p[:policy_arn] }
+
       password_last_used = user[:password_last_used]
       user[:password_ever_used?] = !password_last_used.nil?
       user[:password_never_used?] = password_last_used.nil?
@@ -103,6 +133,14 @@ class AwsIamUsers < Inspec.resource(1)
       def list_mfa_devices(query)
         aws_service_client.list_mfa_devices(query)
       end
+
+      def list_user_policies(query)
+        aws_service_client.list_user_policies(query)
+      end
+
+      def list_attached_user_policies(query)
+        aws_service_client.list_attached_user_policies(query)
+      end
     end
   end
 end

data/lib/resources/service.rb

@@ -162,7 +162,7 @@ module Inspec::Resources
       elsif %w{aix}.include?(platform)
         SrcMstr.new(inspec)
       elsif %w{amazon}.include?(platform)
-        if os[:release].start_with?('20\d\d')
+        if os[:release] =~ /^20\d\d/
           Upstart.new(inspec, service_ctl)
         else
           Systemd.new(inspec, service_ctl)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec
 version: !ruby/object:Gem::Version
-  version: 2.1.43
+  version: 2.1.54
 platform: ruby
 authors:
 - Dominik Richter
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-12 00:00:00.000000000 Z
+date: 2018-04-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: train
@@ -312,7 +312,7 @@ files:
 - docs/resources/aws_cloudtrail_trails.md.erb
 - docs/resources/aws_cloudwatch_alarm.md.erb
 - docs/resources/aws_cloudwatch_log_metric_filter.md.erb
-- docs/resources/aws_config_delivery_channel.md
+- docs/resources/aws_config_delivery_channel.md.erb
 - docs/resources/aws_config_recorder.md.erb
 - docs/resources/aws_ec2_instance.md.erb
 - docs/resources/aws_iam_access_key.md.erb
@@ -475,6 +475,7 @@ files:
 - examples/kitchen-puppet/README.md
 - examples/kitchen-puppet/manifests/site.pp
 - examples/kitchen-puppet/metadata.json
+- examples/kitchen-puppet/modules/.gitkeep
 - examples/kitchen-puppet/test/integration/default/web_spec.rb
 - examples/meta-profile/README.md
 - examples/meta-profile/controls/example.rb