inspec 2.3.10 → 2.3.23

data/docs/resources/aws_elbs.md.erb

@@ -1,252 +0,0 @@
----
-title: About the aws_elbs Resource
-platform: aws
----
-
-# aws\_elbs
-
-Use the `aws_elbs` InSpec audit resource to test properties of AWS Elastic Load Balancers (ELBs, also known as a Classic Load Balancers) in bulk, or to search for a group of them based on their properties.
-
-To audit a specific ELB in detail when its name is known, use `aws_elb` (singular).
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.2.10 of InSpec.
-
-## Syntax
-
-An `aws_elb` resource block uses an optional filter to select a group of ELBs and then tests that group.
-
-    # Check that you have at aleast one ELB
-    describe aws_elbs do
-      it { should exist }
-    end
-
-    # Ensure that you have at least one ELB in a specific VPC
-    describe aws_elb.where(vpc_id: 'vpc-12345678') do
-      it { should exist }
-    end
-
-<br>
-
-## Filter Criteria
-
-Use filter criteria with `where` to search for ELBs by their properties.  `where` may be used in method mode (as in `aws_elbs.where(criterion: value)`) or in block mode (as in `aws_elbs.where { any code here }`). Several criteria on this resource may only be used with block-mode, because they are list-based.
-
-### availability\_zones
-
-An array of strings identifying which availability zones in which the load balancer is located. This criterion must be used with block-mode `where`.
-
-    # Find ELBs with a footprint in us-east-2a
-    describe aws_elbs.where {  availability_zones.include? 'us-east-2a' } do
-      it { should exist }
-    end
-
-### dns\_name
-
-Returns the FQDN of the load balancer.  This is the hostname which is exposed to the world.
-
-    # Find ELBs that have the letter z in their DNS name
-    describe aws_elbs.where(dns_name: /z/) do
-      it { should exist }
-    end
-
-### elb\_name
-
-The name of the ELB within AWS. The ELB name is unique within the region. If you know the full ELB name, you should use the `aws_elb` resource instead, as it is much more efficient for testing a specific ELB.
-
-    # Find ELBs whose name ends in `prod`
-    describe aws_elbs.where(elb_name: /prod$/) do
-      it { should exist }
-    end
-
-### external\_ports
-
-An array of integers reflecting the public-facing ports on which the load balancer will be listening for traffic. This criterion must be used with block-mode `where`.
-
-    # Find ELBs listening on port 80
-    describe aws_elbs.where { external_ports.include? 80 } do
-      it { should exist }
-    end
-
-### instance\_ids
-
-An array of strings reflecting the instance IDs of the EC2 instances attached to the ELB. This criterion must be used with block-mode `where`.
-
-    # Find ELBs with at least 3 instances
-    describe aws_elbs.where { instance_ids.count > 2 } do
-      it { should exist }
-    end
-
-
-### internal\_ports
-
-An array of integers reflecting the EC2-facing ports on which the load balancer will be sending traffic to. This criterion must be used with block-mode `where`.
-
-    # Find ELBs sending traffic to port 80
-    describe aws_elbs.where { internal_ports.include? 80 } do
-      it { should exist }
-    end
-
-### security\_group\_ids
-
-An array of strings reflecting the security group IDs (firewall rule sets) assigned to the ELB. This criterion must be used with block-mode `where`.
-
-    # Find ELBs using a particular security group
-    describe aws_elbs.where { security_group_ids.include? 'sg-12345678' } do
-      it { should exist }
-    end
-
-### subnet\_ids
-
-An array of strings reflecting the subnet IDs on which the ELB is located. This criterion must be used with block-mode `where`.
-
-    # Find ELBs located on a particular subnet
-    describe aws_elbs.where { subnet_ids.include? 'subnet-12345678' } do
-      it { should exist }
-    end
-
-### vpc\_id
-
-A String reflecting the ID of the VPC in which the ELB is located.
-
-    # Find all ELBs in a specific VPC.
-    describe aws_elbs.where(vpc_id: 'vpc-12345678') do
-      it { should exist }    
-    end
-
-<br>
-
-## Properties
-
-### availability\_zones
-
-An array of strings identifying which availability zones in which the selected load balancers are located. The array is de-duplicated.
-
-    # Ensure none of our ELBs are in us-east-1c
-    describe aws_elbs do
-      its('availability_zones') { should_not include 'us-east-1c' }
-    end
-
-### count
-
-Returns an integer reflecting the number of matched ELBs.
-
-    # Ensure we have 4 ELBs total.
-    describe aws_elbs do
-      its('count') { should cmp 4 }
-    end
-
-### dns\_names
-
-An array of FQDNs of the selected load balancers.  These are the hostnames which are exposed to the world.
-
-    # Ensure none of the DNS names are an old name
-    describe aws_elbs do
-      its('dns_names') { should_not include 'some.horrid.name' }
-    end
-
-### elb\_names
-
-The names of the selected ELBs within AWS. The ELB name is unique within the region. 
-
-    # You can use this to enumerate the ELBs for detailed tests
-    # Search using the plural, analyze using the singular.
-    aws_elbs.where { instance_ports.include? 80 }.elb_names.each do |elb_name|
-      describe aws_elb(elb_name) do
-        its('security_group_ids') { should include 'sg-12345678' }
-      end
-    end
-
-### external\_ports
-
-An array of integers reflecting the public-facing ports on which the selected load balancers will be listening for traffic. The array is de-duplicated.
-
-    # Ensure that the only ports we are listening on are 80 and 443
-    describe aws_elbs do
-      its('external_ports') { should include 80 }
-      its('external_ports') { should include 443 }
-      its('external_ports.count') { should cmp 2 }      
-    end
-
-
-### instance\_ids
-
-An array of strings reflecting the instance IDs of the EC2 instances attached to the selected ELBs.
-
-    # Ensure there are 10-20 instances total attached to all ELBs
-    describe aws_elbs do
-      its('instance_ids.count') { should be >= 10 }
-      its('instance_ids.count') { should be <= 20 }
-    end
-
-### internal\_ports
-
-An array of integers reflecting the EC2-facing ports on which the selected load balancers will be sending traffic to. The array is de-duplicated.
-
-    # Ensure all ELBs only talk to port 80
-    describe aws_elbs do
-      its('internal_ports') { should contain 80 }
-      its('internal_ports.count') { should cmp 1 }
-    end
-
-### security\_group\_ids
-
-An array of strings reflecting the security group IDs (firewall rule sets) assigned to the selected ELBs. The array is de-duplicated.
-
-    # Ensure all ELBs are using one specific security group
-    describe aws_elbs do
-      its('security_group_ids') { should include 'sg-12345678' }
-      its('security_group_ids.count') { should cmp 1 }      
-    end
-
-### subnet\_ids
-
-An array of strings reflecting the subnet IDs on which the selected ELBs are located. The array is de-duplicated.
-
-    # Ensure all ELBs are on a particular subnet
-    describe aws_elbs do
-      its('subnet_ids') { should include 'subnet-12345678' }
-      its('subnet_ids.count') { should cmp 1 }
-    end
-
-### vpc\_ids
-
-An array of strings reflecting the ID of the VPCs in which the selected ELBs are located. The array is de-duplicated.
-
-    # Ensure all ELBs are in one VPC
-    describe aws_elbs do
-      its('vpc_ids.count') { should cmp 1 }
-    end
-
-## Matchers
-
-This InSpec audit resource has the following resource-specific matchers. For a full list of available matchers, please visit our [Universal Matchers page](https://www.inspec.io/docs/reference/matchers/).
-
-### exists
-
-The audit test will pass if at least one ELB was matched by the filter.  Use with `should_not` to test for absence.
-
-    # We like z's in our DNS names
-    describe aws_elbs.where(dns_name: /z/) do
-      it { should exist }
-    end
-
-    # But k's are just awful
-    describe aws_elbs.where(dns_name: /k/) do
-      it { should_not exist }
-    end
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `elasticloadbalancing:DescribeLoadBalancers` action set to Allow.
-
-You can find detailed documentation at [Authentication and Access Control for Your Load Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html)

data/docs/resources/aws_flow_log.md.erb

@@ -1,128 +0,0 @@
----
-title: About the aws_flow_log Resource
-platform: aws
----
-
-# aws\_flow\_log
-
-Use the `aws_flow_log` InSpec audit resource to test properties of a single Flow Log.
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.2.10 of InSpec.
-
-## Syntax
-
-    describe aws_flow_log('fl-9c718cf5') do
-      it { should exist }
-    end
-
-## Resource Parameters
-### flow\_log\_id
-
-This resource accepts a single parameter or other search terms. You may pass it as a string, or as the value in a hash:
-
-    describe aws_flow_log('fl-9c718cf5') do
-      it { should exist }
-    end
-
-    describe aws_flow_log(flow_log_id: 'fl-8905f8e0') do
-      it { should exist }
-    end
-
-### subnet\_id
-
-To search for a flow log by the associated subnet id:
-
-    describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
-      it { should exist }
-    end
-
-### vpc\_id
-
-To search for a flow log by the associated vpc id:
-
-    describe aws_flow_log(vpc_id: 'vpc-96cabaef') do
-      it { should exist }
-    end
-
-## Properties
-### flow\_log\_id
-
-The `flow_log_id` property tests the name of the flow log.
-
-  describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
-    its('flow_log_id') { should cmp 'fl-9c718cf5' }
-  end
-
-### log\_group\_name
-
-The `log_group_name` property tests the name of the associated log group.
-
-  describe aws_flow_log('fl-9c718cf5') do
-    its('log_group_name') { should cmp 'test_log_group' }
-  end
-
-### resource\_id
-
-The `resource_id` property tests the id of the associated VPC, subnet, or network interface.
-
-  describe aws_flow_log('fl-9c718cf5') do
-    its('resource_id') { should cmp 'subnet-c6a4319c' }
-  end
-
-### resource\_type
-
-The `resource_type` property tests the type of resource the Flow Log is attached to.
-The property will return `eni`, `subnet`, or `vpc`.
-
-  describe aws_flow_log('fl-9c718cf5') do
-    its('resource_type') { should cmp 'subnet' }
-  end
-
-## Matchers
-
-For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
-
-### exist
-
-Indicates that the Flow Log provided was found.  Use `should_not` to test for Flow Logs that should not exist.
-
-    describe aws_flow_log('should-be-there') do
-      it { should exist }
-    end
-
-    describe aws_flow_log('should-not-be-there') do
-      it { should_not exist }
-    end
-
-### be\_attached\_to\_eni
-
-Indicates that the Flow Log is attached to a ENI resource.
-
-    describe aws_flow_log('fl-9c718cf5') do
-      it { should be_attached_to_eni }
-    end
-
-### be\_attached\_to\_subnet
-
-Indicates that the Flow Log is attached to a subnet resource.
-
-    describe aws_flow_log('fl-9c718cf5') do
-      it { should be_attached_to_subnet }
-    end
-
-### be\_attached\_to\_vpc
-
-Indicates that the Flow Log is attached to a vpc resource.
-
-    describe aws_flow_log('fl-9c718cf5') do
-      it { should be_attached_to_vpc }
-    end
-

data/docs/resources/aws_iam_access_key.md.erb

@@ -1,139 +0,0 @@
----
-title: About the aws_iam_access_key Resource
-platform: aws
----
-
-# aws\_iam\_access\_key
-
-Use the `aws_iam_access_key` InSpec audit resource to test properties of a single AWS IAM access key.
-
-<br>
-
-## Availability
-
-### Installation
-
-This resource is distributed along with InSpec itself. You can use it automatically.
-
-### Version
-
-This resource first became available in v2.0.16 of InSpec.
-
-## Syntax
-
-An `aws_iam_access_key` resource block declares the tests for a single AWS IAM access key. An access key is uniquely identified by its access key id.
-
-    # This is unique - the key will either exist or it won't, but it will never be an error.
-    describe aws_iam_access_key(access_key_id: 'AKIA12345678ABCD') do
-      it { should exist }
-      it { should_not be_active }
-      its('create_date') { should be > Time.now - 365 * 86400 }
-      its('last_used_date') { should be > Time.now - 90 * 86400 }
-    end
-
-    # id is an alias for access_key_id
-    describe aws_iam_access_key(id: 'AKIA12345678ABCD') do
-      # Same
-    end
-
-
-Access keys are associated with IAM users, who may have zero, one or two access keys. You may also lookup an access key by username. If the user has more than one access key, an error occurs (You may use `aws_iam_access_keys` with the `username` resource parameter to access a user's keys when they have multiple keys.)
-
-    # This is not unique. If the user has zero or one keys, it is not an error.
-    # If they have two, it is an error.
-    describe aws_iam_access_key(username: 'roderick') do
-      it { should exist }
-      it { should be_active }
-    end
-
-You may also use both username and access key id to ensure that a particular key is associated with a particular user.
-
-    describe aws_iam_access_key(username: 'roderick', access_key_id: 'AKIA12345678ABCD') do
-      it { should exist }
-    end
-
-<br>
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test that an IAM access key is not active
-
-    describe aws_iam_access_key(username: 'username', id: 'access-key-id') do
-      it { should_not be_active }
-    end
-
-### Test that an IAM access key is older than one year
-
-    describe aws_iam_access_key(username: 'username', id: 'access-key-id') do
-      its('create_date') { should be > Time.now - 365 * 86400 }
-    end
-
-### Test that an IAM access key has been used in the past 90 days
-
-    describe aws_iam_access_key(username: 'username', id: 'access-key-id') do
-      its('last_used_date') { should be > Time.now - 90 * 86400 }
-    end
-
-<br>
-
-## Properties
-
-* `access_key_id`, `create_date`, `last_used_date`, `username`
-
-<br>
-
-## Property Examples
-
-### access\_key\_id
-
-The unique ID of this access key.
-
-    describe aws_iam_access_key(username: 'bob')
-      its('access_key_id') { should cmp 'AKIA12345678ABCD' }
-    end
-
-### create\_date
-
-The date and time, as a Ruby DateTime, at which the access key was created.
-
-    # Is the access key less than a year old?
-    describe aws_iam_access_key(username: 'bob')
-      its('create_date') { should be > Time.now - 365 * 86400 }
-    end
-
-### last\_used\_date
-
-The date and time, as a Ruby DateTime, at which the access key was last_used.
-
-    # Has the access key been used in the last year?
-    describe aws_iam_access_key(username: 'bob')
-      its('last_used_date') { should be > Time.now - 365 * 86400 }
-    end
-
-### username
-
-The IAM user that owns this key.
-
-    describe aws_iam_access_key(access_key_id: 'AKIA12345678ABCD')
-      its('username') { should cmp 'bob' }
-    end
-
-<br>
-
-## Matchers
-
-This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
-
-### be\_active
-
-The `be_active` matcher tests if the described IAM access key is active.
-
-    it { should be_active }
-
-## AWS Permissions
-
-Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `iam:ListAccessKeys` action with Effect set to Allow.
-
-You can find detailed documentation at [Actions, Resources, and Condition Keys for Identity And Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_identityandaccessmanagement.html).