inspec 2.1.81 → 2.1.83

data/lib/resources/aws/aws_iam_users.rb

@@ -1,146 +1,146 @@
-# author: Alex Bedley
-# author: Steffanie Freeman
-# author: Simon Varlow
-# author: Chris Redekop
-class AwsIamUsers < Inspec.resource(1)
-  name 'aws_iam_users'
-  desc 'Verifies settings for AWS IAM users'
-  example '
-    describe aws_iam_users.where(has_mfa_enabled?: false) do
-      it { should_not exist }
-    end
-    describe aws_iam_users.where(has_console_password?: true) do
-      it { should exist }
-    end
-    describe aws_iam_users.where(has_inline_policies?: true) do
-      it { should_not exist }
-    end
-    describe aws_iam_users.where(has_attached_policies?: true) do
-      it { should_not exist }
-    end
-  '
-  supports platform: 'aws'
-
-  include AwsPluralResourceMixin
-
-  filter = FilterTable.create
-  filter.add_accessor(:where)
-        .add_accessor(:entries)
-        .add(:exists?) { |x| !x.entries.empty? }
-        .add(:has_mfa_enabled?, field: :has_mfa_enabled)
-        .add(:has_console_password?, field: :has_console_password)
-        .add(:has_inline_policies?, field: :has_inline_policies)
-        .add(:has_attached_policies?, field: :has_attached_policies)
-        .add(:password_ever_used?, field: :password_ever_used?)
-        .add(:password_never_used?, field: :password_never_used?)
-        .add(:password_last_used_days_ago, field: :password_last_used_days_ago)
-        .add(:usernames, field: :user_name)
-        .add(:username) { |res| res.entries.map { |row| row[:user_name] } } # We should deprecate this; plural resources get plural properties
-  # Next three are needed to declare fields for use by the de-duped set
-  filter.add(:dupe_inline_policy_names, field: :inline_policy_names_source)
-        .add(:dupe_attached_policy_names, field: :attached_policy_names_source)
-        .add(:dupe_attached_policy_arns, field: :attached_policy_arns_source)
-  # These three are now able to access the above three in .entries
-  filter.add(:inline_policy_names) { |obj| obj.dupe_inline_policy_names.flatten.uniq }
-        .add(:attached_policy_names) { |obj| obj.dupe_attached_policy_names.flatten.uniq }
-        .add(:attached_policy_arns) { |obj| obj.dupe_attached_policy_arns.flatten.uniq }
-  filter.connect(self, :table)
-
-  def validate_params(raw_params)
-    # No params yet
-    unless raw_params.empty?
-      raise ArgumentError, 'aws_iam_users does not accept resource parameters'
-    end
-    raw_params
-  end
-
-  def fetch_from_api_paginated(backend)
-    table = []
-    page_marker = nil
-    loop do
-      api_result = backend.list_users(marker: page_marker)
-      table += api_result.users.map(&:to_h)
-      page_marker = api_result.marker
-      break unless api_result.is_truncated
-    end
-    table
-  end
-
-  def fetch_from_api # rubocop: disable Metrics/AbcSize
-    backend = BackendFactory.create(inspec_runner)
-    @table = fetch_from_api_paginated(backend)
-
-    # TODO: lazy columns - https://github.com/chef/inspec-aws/issues/100
-    @table.each do |user|
-      # Some of these throw exceptions to indicate empty results;
-      # others return empty arrays
-      begin
-        _login_profile = backend.get_login_profile(user_name: user[:user_name])
-        user[:has_console_password] = true
-      rescue Aws::IAM::Errors::NoSuchEntity
-        user[:has_console_password] = false
-      end
-      user[:has_console_password?] = user[:has_console_password]
-
-      begin
-        aws_mfa_devices = backend.list_mfa_devices(user_name: user[:user_name])
-        user[:has_mfa_enabled] = !aws_mfa_devices.mfa_devices.empty?
-      rescue Aws::IAM::Errors::NoSuchEntity
-        user[:has_mfa_enabled] = false
-      end
-      user[:has_mfa_enabled?] = user[:has_mfa_enabled]
-
-      user[:inline_policy_names_source] = backend.list_user_policies(user_name: user[:user_name]).policy_names
-      user[:has_inline_policies] = !user[:inline_policy_names_source].empty?
-      user[:has_inline_policies?] = user[:has_inline_policies]
-
-      attached_policies = backend.list_attached_user_policies(user_name: user[:user_name]).attached_policies
-      user[:has_attached_policies] = !attached_policies.empty?
-      user[:has_attached_policies?] = user[:has_attached_policies]
-      user[:attached_policy_names_source] = attached_policies.map { |p| p[:policy_name] }
-      user[:attached_policy_arns_source] = attached_policies.map { |p| p[:policy_arn] }
-
-      password_last_used = user[:password_last_used]
-      user[:password_ever_used?] = !password_last_used.nil?
-      user[:password_never_used?] = password_last_used.nil?
-      next unless user[:password_ever_used?]
-      user[:password_last_used_days_ago] = ((Time.now - password_last_used) / (24*60*60)).to_i
-    end
-    @table
-  end
-
-  def to_s
-    'IAM Users'
-  end
-
-  #===========================================================================#
-  #                        Backend Implementation
-  #===========================================================================#
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::IAM::Client
-
-      # TODO: delegate this out
-      def list_users(query = {})
-        aws_service_client.list_users(query)
-      end
-
-      def get_login_profile(query)
-        aws_service_client.get_login_profile(query)
-      end
-
-      def list_mfa_devices(query)
-        aws_service_client.list_mfa_devices(query)
-      end
-
-      def list_user_policies(query)
-        aws_service_client.list_user_policies(query)
-      end
-
-      def list_attached_user_policies(query)
-        aws_service_client.list_attached_user_policies(query)
-      end
-    end
-  end
-end
+# author: Alex Bedley
+# author: Steffanie Freeman
+# author: Simon Varlow
+# author: Chris Redekop
+class AwsIamUsers < Inspec.resource(1)
+  name 'aws_iam_users'
+  desc 'Verifies settings for AWS IAM users'
+  example '
+    describe aws_iam_users.where(has_mfa_enabled?: false) do
+      it { should_not exist }
+    end
+    describe aws_iam_users.where(has_console_password?: true) do
+      it { should exist }
+    end
+    describe aws_iam_users.where(has_inline_policies?: true) do
+      it { should_not exist }
+    end
+    describe aws_iam_users.where(has_attached_policies?: true) do
+      it { should_not exist }
+    end
+  '
+  supports platform: 'aws'
+
+  include AwsPluralResourceMixin
+
+  filter = FilterTable.create
+  filter.add_accessor(:where)
+        .add_accessor(:entries)
+        .add(:exists?) { |x| !x.entries.empty? }
+        .add(:has_mfa_enabled?, field: :has_mfa_enabled)
+        .add(:has_console_password?, field: :has_console_password)
+        .add(:has_inline_policies?, field: :has_inline_policies)
+        .add(:has_attached_policies?, field: :has_attached_policies)
+        .add(:password_ever_used?, field: :password_ever_used?)
+        .add(:password_never_used?, field: :password_never_used?)
+        .add(:password_last_used_days_ago, field: :password_last_used_days_ago)
+        .add(:usernames, field: :user_name)
+        .add(:username) { |res| res.entries.map { |row| row[:user_name] } } # We should deprecate this; plural resources get plural properties
+  # Next three are needed to declare fields for use by the de-duped set
+  filter.add(:dupe_inline_policy_names, field: :inline_policy_names_source)
+        .add(:dupe_attached_policy_names, field: :attached_policy_names_source)
+        .add(:dupe_attached_policy_arns, field: :attached_policy_arns_source)
+  # These three are now able to access the above three in .entries
+  filter.add(:inline_policy_names) { |obj| obj.dupe_inline_policy_names.flatten.uniq }
+        .add(:attached_policy_names) { |obj| obj.dupe_attached_policy_names.flatten.uniq }
+        .add(:attached_policy_arns) { |obj| obj.dupe_attached_policy_arns.flatten.uniq }
+  filter.connect(self, :table)
+
+  def validate_params(raw_params)
+    # No params yet
+    unless raw_params.empty?
+      raise ArgumentError, 'aws_iam_users does not accept resource parameters'
+    end
+    raw_params
+  end
+
+  def fetch_from_api_paginated(backend)
+    table = []
+    page_marker = nil
+    loop do
+      api_result = backend.list_users(marker: page_marker)
+      table += api_result.users.map(&:to_h)
+      page_marker = api_result.marker
+      break unless api_result.is_truncated
+    end
+    table
+  end
+
+  def fetch_from_api # rubocop: disable Metrics/AbcSize
+    backend = BackendFactory.create(inspec_runner)
+    @table = fetch_from_api_paginated(backend)
+
+    # TODO: lazy columns - https://github.com/chef/inspec-aws/issues/100
+    @table.each do |user|
+      # Some of these throw exceptions to indicate empty results;
+      # others return empty arrays
+      begin
+        _login_profile = backend.get_login_profile(user_name: user[:user_name])
+        user[:has_console_password] = true
+      rescue Aws::IAM::Errors::NoSuchEntity
+        user[:has_console_password] = false
+      end
+      user[:has_console_password?] = user[:has_console_password]
+
+      begin
+        aws_mfa_devices = backend.list_mfa_devices(user_name: user[:user_name])
+        user[:has_mfa_enabled] = !aws_mfa_devices.mfa_devices.empty?
+      rescue Aws::IAM::Errors::NoSuchEntity
+        user[:has_mfa_enabled] = false
+      end
+      user[:has_mfa_enabled?] = user[:has_mfa_enabled]
+
+      user[:inline_policy_names_source] = backend.list_user_policies(user_name: user[:user_name]).policy_names
+      user[:has_inline_policies] = !user[:inline_policy_names_source].empty?
+      user[:has_inline_policies?] = user[:has_inline_policies]
+
+      attached_policies = backend.list_attached_user_policies(user_name: user[:user_name]).attached_policies
+      user[:has_attached_policies] = !attached_policies.empty?
+      user[:has_attached_policies?] = user[:has_attached_policies]
+      user[:attached_policy_names_source] = attached_policies.map { |p| p[:policy_name] }
+      user[:attached_policy_arns_source] = attached_policies.map { |p| p[:policy_arn] }
+
+      password_last_used = user[:password_last_used]
+      user[:password_ever_used?] = !password_last_used.nil?
+      user[:password_never_used?] = password_last_used.nil?
+      next unless user[:password_ever_used?]
+      user[:password_last_used_days_ago] = ((Time.now - password_last_used) / (24*60*60)).to_i
+    end
+    @table
+  end
+
+  def to_s
+    'IAM Users'
+  end
+
+  #===========================================================================#
+  #                        Backend Implementation
+  #===========================================================================#
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::IAM::Client
+
+      # TODO: delegate this out
+      def list_users(query = {})
+        aws_service_client.list_users(query)
+      end
+
+      def get_login_profile(query)
+        aws_service_client.get_login_profile(query)
+      end
+
+      def list_mfa_devices(query)
+        aws_service_client.list_mfa_devices(query)
+      end
+
+      def list_user_policies(query)
+        aws_service_client.list_user_policies(query)
+      end
+
+      def list_attached_user_policies(query)
+        aws_service_client.list_attached_user_policies(query)
+      end
+    end
+  end
+end

data/lib/resources/aws/aws_kms_key.rb

@@ -1,96 +1,96 @@
-class AwsKmsKey < Inspec.resource(1)
-  name 'aws_kms_key'
-  desc 'Verifies settings for an individual AWS KMS Key'
-  example "
-    describe aws_kms_key('arn:aws:kms:us-east-1::key/4321dcba-21io-23de-85he-ab0987654321') do
-      it { should exist }
-    end
-  "
-
-  supports platform: 'aws'
-
-  include AwsSingularResourceMixin
-  attr_reader :key_id, :arn, :creation_date, :key_usage, :key_state, :description,
-              :deletion_date, :valid_to, :external, :has_key_expiration, :managed_by_aws,
-              :has_rotation_enabled, :enabled
-  # Use aliases for matchers
-  alias deletion_time deletion_date
-  alias invalidation_time valid_to
-  alias external? external
-  alias enabled? enabled
-  alias managed_by_aws? managed_by_aws
-  alias has_key_expiration? has_key_expiration
-  alias has_rotation_enabled? has_rotation_enabled
-
-  def to_s
-    "KMS Key #{@key_id}"
-  end
-
-  def created_days_ago
-    ((Time.now - creation_date)/(24*60*60)).to_i unless creation_date.nil?
-  end
-
-  private
-
-  def validate_params(raw_params)
-    validated_params = check_resource_param_names(
-      raw_params: raw_params,
-      allowed_params: [:key_id],
-      allowed_scalar_name: :key_id,
-      allowed_scalar_type: String,
-    )
-
-    if validated_params.empty?
-      raise ArgumentError, "You must provide the parameter 'key_id' to aws_kms_key."
-    end
-
-    validated_params
-  end
-
-  def fetch_from_api
-    backend = BackendFactory.create(inspec_runner)
-
-    query = { key_id: @key_id }
-    catch_aws_errors do
-      begin
-        resp = backend.describe_key(query)
-
-        @exists = true
-        @key = resp.key_metadata.to_h
-        @key_id = @key[:key_id]
-        @arn = @key[:arn]
-        @creation_date = @key[:creation_date]
-        @enabled = @key[:enabled]
-        @description = @key[:description]
-        @key_usage = @key[:key_usage]
-        @key_state = @key[:key_state]
-        @deletion_date = @key[:deletion_date]
-        @valid_to = @key[:valid_to]
-        @external = @key[:origin] == 'EXTERNAL'
-        @has_key_expiration = @key[:expiration_model] == 'KEY_MATERIAL_EXPIRES'
-        @managed_by_aws = @key[:key_manager] == 'AWS'
-
-        resp = backend.get_key_rotation_status(query)
-        @has_rotation_enabled = resp.key_rotation_enabled unless resp.empty?
-      rescue Aws::KMS::Errors::NotFoundException
-        @exists = false
-        return
-      end
-    end
-  end
-
-  class Backend
-    class AwsClientApi < AwsBackendBase
-      BackendFactory.set_default_backend(self)
-      self.aws_client_class = Aws::KMS::Client
-
-      def describe_key(query)
-        aws_service_client.describe_key(query)
-      end
-
-      def get_key_rotation_status(query)
-        aws_service_client.get_key_rotation_status(query)
-      end
-    end
-  end
-end
+class AwsKmsKey < Inspec.resource(1)
+  name 'aws_kms_key'
+  desc 'Verifies settings for an individual AWS KMS Key'
+  example "
+    describe aws_kms_key('arn:aws:kms:us-east-1::key/4321dcba-21io-23de-85he-ab0987654321') do
+      it { should exist }
+    end
+  "
+
+  supports platform: 'aws'
+
+  include AwsSingularResourceMixin
+  attr_reader :key_id, :arn, :creation_date, :key_usage, :key_state, :description,
+              :deletion_date, :valid_to, :external, :has_key_expiration, :managed_by_aws,
+              :has_rotation_enabled, :enabled
+  # Use aliases for matchers
+  alias deletion_time deletion_date
+  alias invalidation_time valid_to
+  alias external? external
+  alias enabled? enabled
+  alias managed_by_aws? managed_by_aws
+  alias has_key_expiration? has_key_expiration
+  alias has_rotation_enabled? has_rotation_enabled
+
+  def to_s
+    "KMS Key #{@key_id}"
+  end
+
+  def created_days_ago
+    ((Time.now - creation_date)/(24*60*60)).to_i unless creation_date.nil?
+  end
+
+  private
+
+  def validate_params(raw_params)
+    validated_params = check_resource_param_names(
+      raw_params: raw_params,
+      allowed_params: [:key_id],
+      allowed_scalar_name: :key_id,
+      allowed_scalar_type: String,
+    )
+
+    if validated_params.empty?
+      raise ArgumentError, "You must provide the parameter 'key_id' to aws_kms_key."
+    end
+
+    validated_params
+  end
+
+  def fetch_from_api
+    backend = BackendFactory.create(inspec_runner)
+
+    query = { key_id: @key_id }
+    catch_aws_errors do
+      begin
+        resp = backend.describe_key(query)
+
+        @exists = true
+        @key = resp.key_metadata.to_h
+        @key_id = @key[:key_id]
+        @arn = @key[:arn]
+        @creation_date = @key[:creation_date]
+        @enabled = @key[:enabled]
+        @description = @key[:description]
+        @key_usage = @key[:key_usage]
+        @key_state = @key[:key_state]
+        @deletion_date = @key[:deletion_date]
+        @valid_to = @key[:valid_to]
+        @external = @key[:origin] == 'EXTERNAL'
+        @has_key_expiration = @key[:expiration_model] == 'KEY_MATERIAL_EXPIRES'
+        @managed_by_aws = @key[:key_manager] == 'AWS'
+
+        resp = backend.get_key_rotation_status(query)
+        @has_rotation_enabled = resp.key_rotation_enabled unless resp.empty?
+      rescue Aws::KMS::Errors::NotFoundException
+        @exists = false
+        return
+      end
+    end
+  end
+
+  class Backend
+    class AwsClientApi < AwsBackendBase
+      BackendFactory.set_default_backend(self)
+      self.aws_client_class = Aws::KMS::Client
+
+      def describe_key(query)
+        aws_service_client.describe_key(query)
+      end
+
+      def get_key_rotation_status(query)
+        aws_service_client.get_key_rotation_status(query)
+      end
+    end
+  end
+end