inspec 2.1.81 → 2.1.83

data/lib/resources/aws/aws_ec2_instance.rb

@@ -1,157 +1,157 @@
-# author: Christoph Hartmann
-class AwsEc2Instance < Inspec.resource(1)
-  name 'aws_ec2_instance'
-  desc 'Verifies settings for an EC2 instance'
-
-  example <<-EOX
-    describe aws_ec2_instance('i-123456') do
-      it { should be_running }
-      it { should have_roles }
-    end
-
-    describe aws_ec2_instance(name: 'my-instance') do
-      it { should be_running }
-      it { should have_roles }
-    end
-EOX
-  supports platform: 'aws'
-
-  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
-  def initialize(opts, conn = nil)
-    @opts = opts
-    @opts.is_a?(Hash) ? @display_name = @opts[:name] : @display_name = opts
-    @ec2_client = conn ? conn.ec2_client : inspec_runner.backend.aws_client(Aws::EC2::Client)
-    @ec2_resource = conn ? conn.ec2_resource : inspec_runner.backend.aws_resource(Aws::EC2::Resource, {})
-    @iam_resource = conn ? conn.iam_resource : inspec_runner.backend.aws_resource(Aws::IAM::Resource, {})
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_resource_mixin.rb
-  def catch_aws_errors
-    yield
-  rescue Aws::Errors::MissingCredentialsError
-    # The AWS error here is unhelpful:
-    # "unable to sign request without credentials set"
-    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
-    fail_resource('No AWS credentials available')
-  rescue Aws::Errors::ServiceError => e
-    fail_resource e.message
-  end
-
-  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
-  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
-  def inspec_runner
-    # When running under inspec-cli, we have an 'inspec' method that
-    # returns the runner. When running under unit tests, we don't
-    # have that, but we still have to call this to pass something
-    # (nil is OK) to the backend.
-    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
-    # TODO: remove after rewrite to include AwsSingularResource
-    inspec if respond_to?(:inspec)
-  end
-
-  def id
-    return @instance_id if defined?(@instance_id)
-    catch_aws_errors do
-      if @opts.is_a?(Hash)
-        first = @ec2_resource.instances(
-          {
-            filters: [{
-              name: 'tag:Name',
-              values: [@opts[:name]],
-            }],
-          },
-        ).first
-        # catch case where the instance is not known
-        @instance_id = first.id unless first.nil?
-      else
-        @instance_id = @opts
-      end
-    end
-  end
-  alias instance_id id
-
-  def exists?
-    return false if instance.nil?
-    instance.exists?
-  end
-
-  # returns the instance state
-  def state
-    catch_aws_errors do
-      instance&.state&.name
-    end
-  end
-
-  # helper methods for each state
-  %w{
-    pending running shutting-down
-    terminated stopping stopped unknown
-  }.each do |state_name|
-    define_method state_name.tr('-', '_') + '?' do
-      state == state_name
-    end
-  end
-
-  # attributes that we want to expose
-  %w{
-    public_ip_address private_ip_address key_name private_dns_name
-    public_dns_name subnet_id architecture root_device_type
-    root_device_name virtualization_type client_token launch_time
-    instance_type image_id vpc_id
-  }.each do |attribute|
-    define_method attribute do
-      catch_aws_errors do
-        instance.send(attribute) if instance
-      end
-    end
-  end
-
-  # Don't document this - it's a bit hard to use.  Our current doctrine
-  # is to use dumb things, like arrays of strings - use security_group_ids instead.
-  def security_groups
-    catch_aws_errors do
-      @security_groups ||= instance.security_groups.map { |sg|
-        { id: sg.group_id, name: sg.group_name }
-      }
-    end
-  end
-
-  def security_group_ids
-    catch_aws_errors do
-      @security_group_ids ||= instance.security_groups.map(&:group_id)
-    end
-  end
-
-  def tags
-    catch_aws_errors do
-      @tags ||= instance.tags.map { |tag| { key: tag.key, value: tag.value } }
-    end
-  end
-
-  def to_s
-    "EC2 Instance #{@display_name}"
-  end
-
-  def has_roles?
-    catch_aws_errors do
-      instance_profile = instance.iam_instance_profile
-
-      if instance_profile
-        roles = @iam_resource.instance_profile(
-          instance_profile.arn.gsub(%r{^.*\/}, ''),
-        ).roles
-      else
-        roles = nil
-      end
-
-      roles && !roles.empty?
-    end
-  end
-
-  private
-
-  def instance
-    catch_aws_errors { @instance ||= @ec2_resource.instance(id) }
-  end
-end
+# author: Christoph Hartmann
+class AwsEc2Instance < Inspec.resource(1)
+  name 'aws_ec2_instance'
+  desc 'Verifies settings for an EC2 instance'
+
+  example <<-EOX
+    describe aws_ec2_instance('i-123456') do
+      it { should be_running }
+      it { should have_roles }
+    end
+
+    describe aws_ec2_instance(name: 'my-instance') do
+      it { should be_running }
+      it { should have_roles }
+    end
+EOX
+  supports platform: 'aws'
+
+  # TODO: rewrite to avoid direct injection, match other resources, use AwsSingularResourceMixin
+  def initialize(opts, conn = nil)
+    @opts = opts
+    @opts.is_a?(Hash) ? @display_name = @opts[:name] : @display_name = opts
+    @ec2_client = conn ? conn.ec2_client : inspec_runner.backend.aws_client(Aws::EC2::Client)
+    @ec2_resource = conn ? conn.ec2_resource : inspec_runner.backend.aws_resource(Aws::EC2::Resource, {})
+    @iam_resource = conn ? conn.iam_resource : inspec_runner.backend.aws_resource(Aws::IAM::Resource, {})
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_resource_mixin.rb
+  def catch_aws_errors
+    yield
+  rescue Aws::Errors::MissingCredentialsError
+    # The AWS error here is unhelpful:
+    # "unable to sign request without credentials set"
+    Inspec::Log.error "It appears that you have not set your AWS credentials.  You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target.  See https://www.inspec.io/docs/reference/platforms for details."
+    fail_resource('No AWS credentials available')
+  rescue Aws::Errors::ServiceError => e
+    fail_resource e.message
+  end
+
+  # TODO: DRY up, see https://github.com/chef/inspec/issues/2633
+  # Copied from resource_support/aws/aws_singular_resource_mixin.rb
+  def inspec_runner
+    # When running under inspec-cli, we have an 'inspec' method that
+    # returns the runner. When running under unit tests, we don't
+    # have that, but we still have to call this to pass something
+    # (nil is OK) to the backend.
+    # TODO: remove with https://github.com/chef/inspec-aws/issues/216
+    # TODO: remove after rewrite to include AwsSingularResource
+    inspec if respond_to?(:inspec)
+  end
+
+  def id
+    return @instance_id if defined?(@instance_id)
+    catch_aws_errors do
+      if @opts.is_a?(Hash)
+        first = @ec2_resource.instances(
+          {
+            filters: [{
+              name: 'tag:Name',
+              values: [@opts[:name]],
+            }],
+          },
+        ).first
+        # catch case where the instance is not known
+        @instance_id = first.id unless first.nil?
+      else
+        @instance_id = @opts
+      end
+    end
+  end
+  alias instance_id id
+
+  def exists?
+    return false if instance.nil?
+    instance.exists?
+  end
+
+  # returns the instance state
+  def state
+    catch_aws_errors do
+      instance&.state&.name
+    end
+  end
+
+  # helper methods for each state
+  %w{
+    pending running shutting-down
+    terminated stopping stopped unknown
+  }.each do |state_name|
+    define_method state_name.tr('-', '_') + '?' do
+      state == state_name
+    end
+  end
+
+  # attributes that we want to expose
+  %w{
+    public_ip_address private_ip_address key_name private_dns_name
+    public_dns_name subnet_id architecture root_device_type
+    root_device_name virtualization_type client_token launch_time
+    instance_type image_id vpc_id
+  }.each do |attribute|
+    define_method attribute do
+      catch_aws_errors do
+        instance.send(attribute) if instance
+      end
+    end
+  end
+
+  # Don't document this - it's a bit hard to use.  Our current doctrine
+  # is to use dumb things, like arrays of strings - use security_group_ids instead.
+  def security_groups
+    catch_aws_errors do
+      @security_groups ||= instance.security_groups.map { |sg|
+        { id: sg.group_id, name: sg.group_name }
+      }
+    end
+  end
+
+  def security_group_ids
+    catch_aws_errors do
+      @security_group_ids ||= instance.security_groups.map(&:group_id)
+    end
+  end
+
+  def tags
+    catch_aws_errors do
+      @tags ||= instance.tags.map { |tag| { key: tag.key, value: tag.value } }
+    end
+  end
+
+  def to_s
+    "EC2 Instance #{@display_name}"
+  end
+
+  def has_roles?
+    catch_aws_errors do
+      instance_profile = instance.iam_instance_profile
+
+      if instance_profile
+        roles = @iam_resource.instance_profile(
+          instance_profile.arn.gsub(%r{^.*\/}, ''),
+        ).roles
+      else
+        roles = nil
+      end
+
+      roles && !roles.empty?
+    end
+  end
+
+  private
+
+  def instance
+    catch_aws_errors { @instance ||= @ec2_resource.instance(id) }
+  end
+end

data/lib/resources/aws/aws_ec2_instances.rb

@@ -1,64 +1,64 @@
-class AwsEc2Instances < Inspec.resource(1)
-  name 'aws_ec2_instances'
-  desc 'Verifies settings for AWS EC2 Instances in bulk'
-  example '
-    describe aws_ec2_instances do
-      it { should exist }
-    end
-  '
-  supports platform: 'aws'
-
-  include AwsPluralResourceMixin
-  def validate_params(resource_params)
-    unless resource_params.empty?
-      raise ArgumentError, 'aws_ec2_instances does not accept resource parameters.'
-    end
-    resource_params
-  end
-
-  # Underlying FilterTable implementation.
-  filter = FilterTable.create
-  filter.add_accessor(:entries)
-        .add(:exists?) { |x| !x.entries.empty? }
-        .add(:instance_ids, field: :instance_id)
-  filter.connect(self, :table)
-
-  def to_s
-    'EC2 Instances'
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-    @table = []
-    pagination_opts = {}
-    loop do
-      api_result = backend.describe_instances(pagination_opts)
-      @table += unpack_describe_instances_response(api_result.reservations)
-      break unless api_result.next_token
-      pagination_opts = { next_token: api_result.next_token }
-    end
-  end
-
-  def unpack_describe_instances_response(reservations)
-    instance_rows = []
-    reservations.each do |res|
-      instance_rows += res.instances.map do |instance_struct|
-        {
-          instance_id: instance_struct.instance_id,
-        }
-      end
-    end
-    instance_rows
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::EC2::Client
-
-      def describe_instances(query)
-        aws_service_client.describe_instances(query)
-      end
-    end
-  end
-end
+class AwsEc2Instances < Inspec.resource(1)
+  name 'aws_ec2_instances'
+  desc 'Verifies settings for AWS EC2 Instances in bulk'
+  example '
+    describe aws_ec2_instances do
+      it { should exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+  def validate_params(resource_params)
+    unless resource_params.empty?
+      raise ArgumentError, 'aws_ec2_instances does not accept resource parameters.'
+    end
+    resource_params
+  end
+
+  # Underlying FilterTable implementation.
+  filter = FilterTable.create
+  filter.add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:instance_ids, field: :instance_id)
+  filter.connect(self, :table)
+
+  def to_s
+    'EC2 Instances'
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    @table = []
+    pagination_opts = {}
+    loop do
+      api_result = backend.describe_instances(pagination_opts)
+      @table += unpack_describe_instances_response(api_result.reservations)
+      break unless api_result.next_token
+      pagination_opts = { next_token: api_result.next_token }
+    end
+  end
+
+  def unpack_describe_instances_response(reservations)
+    instance_rows = []
+    reservations.each do |res|
+      instance_rows += res.instances.map do |instance_struct|
+        {
+          instance_id: instance_struct.instance_id,
+        }
+      end
+    end
+    instance_rows
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::EC2::Client
+
+      def describe_instances(query)
+        aws_service_client.describe_instances(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_iam_access_key.rb

@@ -1,106 +1,106 @@
-class AwsIamAccessKey < Inspec.resource(1)
-  name 'aws_iam_access_key'
-  desc 'Verifies settings for an individual IAM access key'
-  example "
-    describe aws_iam_access_key(username: 'username', id: 'access-key id') do
-      it { should exist }
-      it { should_not be_active }
-      its('create_date') { should be > Time.now - 365 * 86400 }
-      its('last_used_date') { should be > Time.now - 90 * 86400 }
-    end
-  "
-  supports platform: 'aws'
-
-  include AwsSingularResourceMixin
-  attr_reader :access_key_id, :create_date, :status, :username
-  alias id access_key_id
-
-  def validate_params(raw_params)
-    recognized_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:username, :id, :access_key_id],
-      allowed_scalar_name: :access_key_id,
-      allowed_scalar_type: String,
-    )
-
-    # id and access_key_id are aliases; standardize on access_key_id
-    recognized_params[:access_key_id] = recognized_params.delete(:id) if recognized_params.key?(:id)
-
-    # Validate format of access_key_id
-    if recognized_params[:access_key_id] and
-       recognized_params[:access_key_id] !~ /^AKIA[0-9A-Z]{16}$/
-      raise ArgumentError, 'Incorrect format for Access Key ID - expected AKIA followed ' \
-            'by 16 letters or numbers'
-    end
-
-    # One of username and access_key_id is required
-    if recognized_params[:username].nil? && recognized_params[:access_key_id].nil?
-      raise ArgumentError, 'You must provide at lease one of access_key_id or username to aws_iam_access_key'
-    end
-
-    recognized_params
-  end
-
-  def active?
-    return nil unless exists?
-    status == 'Active'
-  end
-
-  def to_s
-    "IAM Access-Key #{access_key_id}"
-  end
-
-  def last_used_date
-    return nil unless exists?
-    return @last_used_date if defined? @last_used_date
-    backend = BackendFactory.create(inspec_runner)
-    catch_aws_errors do
-      @last_used_date = backend.get_access_key_last_used({ access_key_id: access_key_id }).access_key_last_used.last_used_date
-    end
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-    query = {}
-    query[:user_name] = username if username
-
-    response = backend.list_access_keys(query)
-
-    access_keys = response.access_key_metadata.select do |key|
-      if access_key_id
-        key.access_key_id == access_key_id
-      else
-        true
-      end
-    end
-
-    if access_keys.empty?
-      @exists = false
-      return
-    end
-
-    if access_keys.count > 1
-      raise 'More than one access key matched for aws_iam_access_key.  Use more specific paramaters, such as access_key_id.'
-    end
-
-    @exists = true
-    @access_key_id = access_keys[0].access_key_id
-    @username = access_keys[0].user_name
-    @create_date = access_keys[0].create_date
-    @status = access_keys[0].status
-    # Last used date is lazily loaded, separate API call
-  rescue Aws::IAM::Errors::NoSuchEntity
-    @exists = false
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::IAM::Client
-
-      def list_access_keys(query)
-        aws_service_client.list_access_keys(query)
-      end
-    end
-  end
-end
+class AwsIamAccessKey < Inspec.resource(1)
+  name 'aws_iam_access_key'
+  desc 'Verifies settings for an individual IAM access key'
+  example "
+    describe aws_iam_access_key(username: 'username', id: 'access-key id') do
+      it { should exist }
+      it { should_not be_active }
+      its('create_date') { should be > Time.now - 365 * 86400 }
+      its('last_used_date') { should be > Time.now - 90 * 86400 }
+    end
+  "
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :access_key_id, :create_date, :status, :username
+  alias id access_key_id
+
+  def validate_params(raw_params)
+    recognized_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:username, :id, :access_key_id],
+      allowed_scalar_name: :access_key_id,
+      allowed_scalar_type: String,
+    )
+
+    # id and access_key_id are aliases; standardize on access_key_id
+    recognized_params[:access_key_id] = recognized_params.delete(:id) if recognized_params.key?(:id)
+
+    # Validate format of access_key_id
+    if recognized_params[:access_key_id] and
+       recognized_params[:access_key_id] !~ /^AKIA[0-9A-Z]{16}$/
+      raise ArgumentError, 'Incorrect format for Access Key ID - expected AKIA followed ' \
+            'by 16 letters or numbers'
+    end
+
+    # One of username and access_key_id is required
+    if recognized_params[:username].nil? && recognized_params[:access_key_id].nil?
+      raise ArgumentError, 'You must provide at lease one of access_key_id or username to aws_iam_access_key'
+    end
+
+    recognized_params
+  end
+
+  def active?
+    return nil unless exists?
+    status == 'Active'
+  end
+
+  def to_s
+    "IAM Access-Key #{access_key_id}"
+  end
+
+  def last_used_date
+    return nil unless exists?
+    return @last_used_date if defined? @last_used_date
+    backend = BackendFactory.create(inspec_runner)
+    catch_aws_errors do
+      @last_used_date = backend.get_access_key_last_used({ access_key_id: access_key_id }).access_key_last_used.last_used_date
+    end
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+    query = {}
+    query[:user_name] = username if username
+
+    response = backend.list_access_keys(query)
+
+    access_keys = response.access_key_metadata.select do |key|
+      if access_key_id
+        key.access_key_id == access_key_id
+      else
+        true
+      end
+    end
+
+    if access_keys.empty?
+      @exists = false
+      return
+    end
+
+    if access_keys.count > 1
+      raise 'More than one access key matched for aws_iam_access_key.  Use more specific paramaters, such as access_key_id.'
+    end
+
+    @exists = true
+    @access_key_id = access_keys[0].access_key_id
+    @username = access_keys[0].user_name
+    @create_date = access_keys[0].create_date
+    @status = access_keys[0].status
+    # Last used date is lazily loaded, separate API call
+  rescue Aws::IAM::Errors::NoSuchEntity
+    @exists = false
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::IAM::Client
+
+      def list_access_keys(query)
+        aws_service_client.list_access_keys(query)
+      end
+    end
+  end
+end