inspec 2.3.10 → 2.3.23

data/docs/resources/aws_cloudwatch_alarm.md.erb

@@ -1,101 +0,0 @@
----
-title: About the aws_cloudwatch_alarm Resource
-platform: aws
----
-
-# aws\_cloudwatch\_alarm
-
-Use the `aws_cloudwatch_alarm` InSpec audit resource to test properties of a single Cloudwatch Alarm.
-
-Cloudwatch Alarms are currently identified using the metric name and metric namespace. Future work may allow other approaches to identifying alarms.
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.0.16 of InSpec.
-
-## Syntax
-
-An `aws_cloudwatch_alarm` resource block searches for a Cloudwatch Alarm, specified by several search options. If more than one Alarm matches, an error occurs.
-
-    # Look for a specific alarm
-    aws_cloudwatch_alarm(
-      metric_name: 'my-metric-name',
-      metric_namespace: 'my-metric-namespace',
-    ) do
-      it { should exist }
-    end
-
-<br>
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Ensure an Alarm has at least one alarm action
-
-    describe aws_cloudwatch_alarm(
-      metric: 'my-metric-name',
-      metric_namespace: 'my-metric-namespace',
-    ) do
-      its('alarm_actions') { should_not be_empty }
-    end
-
-<br>
-
-## Properties
-
-* `alarm_actions`
-
-## Property Examples
-
-### alarm\_actions
-
-`alarm_actions` returns a list of strings. Each string is the ARN of an action that will be taken should the alarm be triggered.
-
-    # Ensure that the alarm has at least one action
-    describe aws_cloudwatch_alarm(
-      metric: 'bed-metric',
-      metric_namespace: 'my-metric-namespace',
-    ) do
-      its('alarm_actions') { should_not be_empty }
-    end
-
-<br>
-
-## Matchers
-
-This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
-
-### exists
-
-The control will pass if a Cloudwatch Alarm could be found. Use `should_not` if you expect zero matches.
-
-    # Expect good metric
-    describe aws_cloudwatch_alarm(
-      metric: 'good-metric',
-      metric_namespace: 'my-metric-namespace',
-    ) do
-      it { should exist }
-    end
-
-    # Disallow alarms based on bad-metric
-    describe aws_cloudwatch_alarm(
-      metric: 'bed-metric',
-      metric_namespace: 'my-metric-namespace',
-    ) do
-      it { should_not exist }
-    end
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `cloudwatch:DescribeAlarmsForMetric` action with Effect set to Allow.
-
-You can find detailed documentation at [Actions, Resources, and Condition Keys for Amazon CloudWatch](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatch.html).

data/docs/resources/aws_cloudwatch_log_metric_filter.md.erb

@@ -1,164 +0,0 @@
----
-title: About the aws_cloudwatch_log_metric_filter Resource
-platform: aws
----
-
-# aws\_cloudwatch\_log\_metric\_filter
-
-Use the `aws_cloudwatch_log_metric_filter` InSpec audit resource to search for and test properties of individual AWS Cloudwatch Log Metric Filters.
-
-A Log Metric Filter (LMF) is an AWS resource that observes log traffic, looks for a specified pattern, and then updates a metric about the number times the match occurs.  The metric can also be connected to AWS Cloudwatch Alarms, so that actions can be taken when a match occurs.
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.0.16 of InSpec.
-
-## Syntax
-
-An `aws_cloudwatch_log_metric_filter` resource block searches for an LMF, specified by several search options.  If more than one log metric filter matches, an error occurs.
-
-    # Look for an LMF by its filter name and log group name.  This combination
-    # will always either find at most one LMF - no duplicates.
-    describe aws_cloudwatch_log_metric_filter(
-      filter_name: 'my-filter',
-      log_group_name: 'my-log-group'
-    ) do
-      it { should exist }
-    end
-
-    # Search for an LMF by pattern and log group.
-    # This could result in an error if the results are not unique.
-    describe aws_cloudwatch_log_metric_filter(
-      log_group_name:  'my-log-group',
-      pattern: 'my-filter'
-    ) do
-      it { should exist }
-    end
-
-<br>
-
-## Filter Attributes
-
-* `filter_name`, `log_group_name`, `pattern`
-
-<br>
-
-## Filter Examples
-
-### filter\_name
-
-This is the identifier of the log metric filter within its log group.  To ensure you have a unique result, you must also provide the `log_group_name`.
-
-    describe aws_cloudwatch_log_metric_filter(
-      filter_name: 'my-filter'
-    ) do
-      it { should exist }
-    end
-
-### log\_group\_name
-
-The name of the Cloudwatch Log Group that the LMF is watching.  Together with `filter_name`, this uniquely identifies an LMF.
-
-    describe aws_cloudwatch_log_metric_filter(
-      log_group_name: 'my-log-group',
-    ) do
-      it { should exist }
-    end
-
-### pattern
-
-The filter pattern used to match entries from the logs in the log group.
-
-    describe aws_cloudwatch_log_metric_filter(
-      pattern: '"ERROR" - "Exiting"',
-    ) do
-      it { should exist }
-    end
-
-<br>
-
-## Properties
-
-* `filter_name`, `log_group_name`,` metric_name`, `metric_namespace`, `pattern`
-
-<br>
-
-## Property Examples
-
-### filter\_name
-
-The name of the LMF within the `log_group`.
-
-    # Check the name of the LMF that has a certain pattern
-    describe aws_cloudwatch_log_metric_filter(
-      log_group_name: 'app-log-group',
-      pattern: 'KERBLEWIE',
-    ) do
-      its('filter_name') { should cmp 'kaboom_lmf' }
-    end
-
-### log\_group\_name
-
-The name of the log group that the LMF is watching.
-
-    # Check which log group the LMF 'error-watcher' is watching
-    describe aws_cloudwatch_log_metric_filter(
-      filter_name: 'error-watcher',
-    ) do
-      its('log_group_name') { should cmp 'app-log-group' }
-    end
-
-### metric\_name, metric\_namespace
-
-The name and namespace of the Cloudwatch Metric that will be updated when the LMF matches.  You also need the `metric_namespace` to uniquely identify the metric.
-
-    # Ensure that the LMF has the right metric name
-    describe aws_cloudwatch_log_metric_filter(
-      filter_name: 'my-filter',
-      log_group_name: 'my-log-group',
-    ) do
-      its('metric_name') { should cmp 'MyMetric' }
-      its('metric_namespace') { should cmp 'MyFantasticMetrics' }
-    end
-
-### pattern
-
-The pattern used to match entries from the logs in the log group.
-
-    # Ensure that the LMF is watching for errors
-    describe aws_cloudwatch_log_metric_filter(
-      filter_name: 'error-watcher',
-      log_group_name: 'app-log-group',
-    ) do
-      its('pattern') { should cmp 'ERROR' }
-    end
-
-<br>
-
-## Matchers
-
-This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
-
-### exist
-
-Matches (i.e., passes the test) if the resource parameters (search criteria) were able to locate exactly one LMF.
-
-    describe aws_cloudwatch_log_metric_filter(
-      log_group_name: 'my-log-group',
-    ) do
-      it { should exist }
-    end
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `cloudwatch:DescribeAlarmsForMetric` action with Effect set to Allow.
-
-You can find detailed documentation at [Actions, Resources, and Condition Keys for Amazon CloudWatch](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatch.html).

data/docs/resources/aws_config_delivery_channel.md.erb

@@ -1,111 +0,0 @@
----
-title: About the aws_config_delivery_channel Resource
----
-
-# aws_config_delivery_channel
-
-The AWS Config service can monitor and record changes to your AWS resource configurations. A Delivery Channel can record the changes
-to an S3 Bucket, an SNS or both.
-
-Use the `aws_config_delivery_channel` InSpec audit resource to examine how the AWS Config service delivers those change notifications.
-
-As of April 2018, each AWS region may have only one Delivery Channel.
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.1.21 of InSpec.
-
-## Resource Parameters
-
-An `aws_config_delivery_channel` resource block declares the tests for a single AWS Config Delivery Channel.
-
-You may specify the Delivery Channel name:
-
-    describe aws_config_delivery_channel('my_channel') do
-      it { should exist }
-    end
-
-    describe aws_config_delivery_channel(channel_name: 'my-channel') do
-      it { should exist }
-    end
-
-However, since you may only have one Delivery Channel per region, and InSpec connections are per-region, you may also omit the `channel_name` to obtain the one Delivery Channel (if any) that exists:
-
-    describe aws_config_delivery_channel do
-      it { should exist }
-    end
-
-<br>
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test how frequently the channel writes configuration changes to the s3 bucket.
-
-    describe aws_config_delivery_channel(channel_name: 'my-recorder') do
-      its(delivery_frequency_in_hours) { should be > 3 }
-    end
-
-## Properties
-
-### channel\_name
-
-Returns the name of the Delivery Channel.
-
-    describe aws_config_delivery_channel do
-      its('channel_name') { should cmp 'my-channel' }
-    end
-
-### delivery\_frequency\_in\_hours
-
-Provides how often the AWS Config sends configuration changes to the s3 bucket in the delivery channel.
-
-    describe aws_config_delivery_channel(channel_name: 'my_channel')
-      its('delivery_frequency_in_hours') { should eq 24 }
-      its('delivery_frequency_in_hours') { should be > 24 }
-    end
-
-### s3\_bucket\_name
-
-Provides the name of the s3 bucket that the channel sends configuration changes to. This is an optional value since a Delivery Channel can also talk to an SNS.
-
-    describe aws_config_delivery_channel(channel_name: 'my_channel')
-      its('s3_bucket_name') { should eq 'my_bucket' }
-    end
-
-### s3\_key\_prefix
-
-Provides the s3 object key prefix (or "path") under which configuration data will be recorded.
-
-    describe aws_config_delivery_channel(channel_name: 'my_channel')
-      its('s3_key_prefix') { should eq 'log/' }
-    end
-
-### sns\_topic\_arn
-
-Provides the ARN of the SNS topic for which the channel sends notifications about configuration changes.
-
-    describe aws_config_delivery_channel(channel_name: 'my_channel')
-      its('sns_topic_arn') { should eq 'arn:aws:sns:us-east-1:721741954427:sns_topic' }
-    end
-
-<br>
-
-## Matchers
-
-This resource provides no matchers, aside from the standard `exist` matcher.
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `config:DescribeDeliveryChannels` action with Effect set to Allow.
-
-You can find detailed documentation at [Actions, Resources, and Condition Keys for AWS Config](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsconfig.html).

data/docs/resources/aws_config_recorder.md.erb

@@ -1,96 +0,0 @@
----
-title: About the aws_config_recorder Resource
----
-
-# aws\_config\_recorder
-
-Use the `aws_config_recorder` InSpec audit resource to test properties of your AWS Config Service.
-
-The AWS Config service can monitor and record changes to your AWS resource configurations.  The Aws Config Recorder is used to detect changes in resource configurations and capture these changes as configuration items.
-
-As of April 2018, you are only permitted one configuration recorder per region.
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.0.32 of InSpec.
-
-## Resource Parameters
-
-An `aws_config_recorder` resource block declares the tests for a single AWS configuration recorder.
-
-You may specify a recorder by name:
-
-    describe aws_config_recorder('my_recorder') do
-      it { should exist }
-    end
-
-    describe aws_config_recorder(recorder_name: 'my-recorder') do
-      it { should exist }
-    end
-
-However, since you may only have one recorder per region, and InSpec connections are per-region, you may also omit the `recorder_name` to obtain the one recorder (if any) that exists:
-
-    describe aws_config_recorder do
-      it { should exist }
-    end
-
-<br>
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test if the recorder is active and recording.
-
-    describe aws_config_recorder(recorder_name: 'my-recorder') do
-      it { should be_recording }
-    end
-
-## Properties
-
-### role\_arn
-
-Provides the IAM role arn associated with the configuration recorder.  The role is used to grant permissions to S3 Buckets, SNS topics and to get configuration details for supported AWS resources.
-
-    describe aws_config_recorder(username: 'bob')
-      its('role_arn') { should eq 'arn:aws:iam::721741954427:role/My_Recorder' }
-    end
-
-### resource\_types
-
-Provides a list of AWS resource types for which the AWS Config records configuration will change. Note that if be_recording_all_resource_types is true than this property is meaningless and will return and empty array.
-
-    describe aws_config_recorder(username: 'bob')
-      its('resource_types') { should include 'AWS::EC2::CustomerGateway' }
-      its('resource_types') { should include 'AWS::EC2::EIP' }
-    end
-
-<br>
-
-## Matchers
-
-### be\_recording\_all\_resource\_types
-
-Indicates if the ConfigurationRecorder will record changes for all resources, regardless of type. If this is true, resource_types is ignored.
-
-      it { should be_recording_all_resource_types }
-
-### be\_recording\_all\_global\_types
-
-Indicates whether the ConfigurationRecorder will record changes for global resource types (such as [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal)s).
-
-      it { should be_recording_all_global_types }
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `config:DescribeConfigurationRecorders` action with Effect set to Allow.
-
-You can find detailed documentation at [Actions, Resources, and Condition Keys for AWS Config](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsconfig.html).