inspec 4.56.58 → 5.7.9
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +24 -9
- data/inspec.gemspec +5 -2
- data/lib/plugins/inspec-init/templates/profiles/aws/inspec.yml +1 -1
- metadata +21 -64
- data/lib/resource_support/aws/aws_backend_base.rb +0 -12
- data/lib/resource_support/aws/aws_backend_factory_mixin.rb +0 -12
- data/lib/resource_support/aws/aws_plural_resource_mixin.rb +0 -24
- data/lib/resource_support/aws/aws_resource_mixin.rb +0 -69
- data/lib/resource_support/aws/aws_singular_resource_mixin.rb +0 -27
- data/lib/resource_support/aws.rb +0 -76
- data/lib/resources/aws/aws_billing_report.rb +0 -105
- data/lib/resources/aws/aws_billing_reports.rb +0 -74
- data/lib/resources/aws/aws_cloudtrail_trail.rb +0 -97
- data/lib/resources/aws/aws_cloudtrail_trails.rb +0 -51
- data/lib/resources/aws/aws_cloudwatch_alarm.rb +0 -67
- data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb +0 -105
- data/lib/resources/aws/aws_config_delivery_channel.rb +0 -74
- data/lib/resources/aws/aws_config_recorder.rb +0 -99
- data/lib/resources/aws/aws_ebs_volume.rb +0 -127
- data/lib/resources/aws/aws_ebs_volumes.rb +0 -69
- data/lib/resources/aws/aws_ec2_instance.rb +0 -162
- data/lib/resources/aws/aws_ec2_instances.rb +0 -69
- data/lib/resources/aws/aws_ecs_cluster.rb +0 -87
- data/lib/resources/aws/aws_eks_cluster.rb +0 -105
- data/lib/resources/aws/aws_elb.rb +0 -85
- data/lib/resources/aws/aws_elbs.rb +0 -84
- data/lib/resources/aws/aws_flow_log.rb +0 -106
- data/lib/resources/aws/aws_iam_access_key.rb +0 -112
- data/lib/resources/aws/aws_iam_access_keys.rb +0 -153
- data/lib/resources/aws/aws_iam_group.rb +0 -62
- data/lib/resources/aws/aws_iam_groups.rb +0 -56
- data/lib/resources/aws/aws_iam_password_policy.rb +0 -121
- data/lib/resources/aws/aws_iam_policies.rb +0 -57
- data/lib/resources/aws/aws_iam_policy.rb +0 -311
- data/lib/resources/aws/aws_iam_role.rb +0 -60
- data/lib/resources/aws/aws_iam_root_user.rb +0 -82
- data/lib/resources/aws/aws_iam_user.rb +0 -145
- data/lib/resources/aws/aws_iam_users.rb +0 -160
- data/lib/resources/aws/aws_kms_key.rb +0 -100
- data/lib/resources/aws/aws_kms_keys.rb +0 -58
- data/lib/resources/aws/aws_rds_instance.rb +0 -74
- data/lib/resources/aws/aws_route_table.rb +0 -67
- data/lib/resources/aws/aws_route_tables.rb +0 -64
- data/lib/resources/aws/aws_s3_bucket.rb +0 -141
- data/lib/resources/aws/aws_s3_bucket_object.rb +0 -87
- data/lib/resources/aws/aws_s3_buckets.rb +0 -52
- data/lib/resources/aws/aws_security_group.rb +0 -314
- data/lib/resources/aws/aws_security_groups.rb +0 -71
- data/lib/resources/aws/aws_sns_subscription.rb +0 -82
- data/lib/resources/aws/aws_sns_topic.rb +0 -57
- data/lib/resources/aws/aws_sns_topics.rb +0 -60
- data/lib/resources/aws/aws_sqs_queue.rb +0 -66
- data/lib/resources/aws/aws_subnet.rb +0 -92
- data/lib/resources/aws/aws_subnets.rb +0 -56
- data/lib/resources/aws/aws_vpc.rb +0 -77
- data/lib/resources/aws/aws_vpcs.rb +0 -55
- data/lib/resources/azure/azure_backend.rb +0 -379
- data/lib/resources/azure/azure_generic_resource.rb +0 -55
- data/lib/resources/azure/azure_resource_group.rb +0 -151
- data/lib/resources/azure/azure_virtual_machine.rb +0 -262
- data/lib/resources/azure/azure_virtual_machine_data_disk.rb +0 -131
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: a30df9c0391282f1af069e5ab333a3ddc86d22a12bedea87fb876a9c4f3f4c5c
|
4
|
+
data.tar.gz: f9fd2d8abe6e68c323bfdabb1e0f3667fe7ff74891f05073804dbc7f40f72b22
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 618cfe6a3a0ba579def0ee22ec8da35240b25178c85f84dcdfcce4a44a29406a063be12eb692b99b9861d8b3bf9e848a57cefc50174b755bde5460fdceff654d
|
7
|
+
data.tar.gz: a7814c7ea180a55c83521d998fdc5bd6678c48cd4b810c8eabcab14f4c035f1942853070f32016702fba4a76aa3ea1cdd12e426e8fdea4a08bff9ed976550248
|
data/Gemfile
CHANGED
@@ -23,27 +23,42 @@ group :omnibus do
|
|
23
23
|
end
|
24
24
|
|
25
25
|
group :test do
|
26
|
-
gem "chefstyle", "~> 2.
|
26
|
+
gem "chefstyle", "~> 2.0.3"
|
27
27
|
gem "concurrent-ruby", "~> 1.0"
|
28
|
-
gem "
|
28
|
+
gem "html-proofer", platforms: :ruby # do not attempt to run proofer on windows
|
29
|
+
gem "json_schemer", ">= 0.2.1", "< 0.2.19"
|
29
30
|
gem "m"
|
30
31
|
gem "minitest-sprint", "~> 1.0"
|
31
|
-
gem "minitest", "5.
|
32
|
-
gem "mocha", "~>
|
32
|
+
gem "minitest", "~> 5.5"
|
33
|
+
gem "mocha", "~> 1.1"
|
33
34
|
gem "nokogiri", "~> 1.9"
|
34
35
|
gem "pry-byebug"
|
35
36
|
gem "pry", "~> 0.10"
|
36
37
|
gem "rake", ">= 10"
|
38
|
+
gem "ruby-progressbar", "~> 1.8"
|
37
39
|
gem "simplecov", "~> 0.21"
|
38
40
|
gem "simplecov_json_formatter"
|
39
41
|
gem "webmock", "~> 3.0"
|
40
|
-
|
41
|
-
if Gem.ruby_version >= Gem::Version.new("3.0.0")
|
42
|
-
# html-proofer has a dep on io-event, which is ruby-3 only
|
43
|
-
gem "html-proofer", "~> 3.19.4", platforms: :ruby # do not attempt to run proofer on windows. Pinned to 3.19.4 as test is breaking in updated versions.
|
44
|
-
end
|
45
42
|
end
|
46
43
|
|
47
44
|
group :deploy do
|
48
45
|
gem "inquirer"
|
49
46
|
end
|
47
|
+
|
48
|
+
# Only include Test Kitchen support if we are on Ruby 2.7 or higher
|
49
|
+
# as chef-zero support requires Ruby 2.6
|
50
|
+
# See https://github.com/inspec/inspec/pull/5341
|
51
|
+
if Gem.ruby_version >= Gem::Version.new("2.7.0")
|
52
|
+
group :kitchen do
|
53
|
+
gem "berkshelf"
|
54
|
+
gem "chef", ">= 16.0" # Required to allow net-ssh > 6
|
55
|
+
gem "test-kitchen", ">= 2.8"
|
56
|
+
gem "kitchen-inspec", ">= 2.0"
|
57
|
+
gem "kitchen-dokken", ">= 2.11"
|
58
|
+
gem "git"
|
59
|
+
end
|
60
|
+
end
|
61
|
+
|
62
|
+
if Gem.ruby_version < Gem::Version.new("2.7.0")
|
63
|
+
gem "activesupport", "6.1.4.4"
|
64
|
+
end
|
data/inspec.gemspec
CHANGED
@@ -13,7 +13,7 @@ Gem::Specification.new do |spec|
|
|
13
13
|
spec.license = "Apache-2.0"
|
14
14
|
spec.require_paths = ["lib"]
|
15
15
|
|
16
|
-
spec.required_ruby_version = ">= 2.
|
16
|
+
spec.required_ruby_version = ">= 2.7"
|
17
17
|
|
18
18
|
# ONLY the aws/azure/gcp files. The rest will come in from inspec-core
|
19
19
|
# the gemspec is necessary for appbundler so don't remove it
|
@@ -31,8 +31,11 @@ Gem::Specification.new do |spec|
|
|
31
31
|
spec.add_dependency "cookstyle"
|
32
32
|
spec.add_dependency "rake"
|
33
33
|
|
34
|
+
# progress bar streaming reporter plugin support
|
35
|
+
spec.add_dependency "progress_bar", "~> 1.3.3"
|
36
|
+
|
34
37
|
# Used for Azure profile until integrated into train
|
35
|
-
spec.add_dependency "faraday_middleware", ">= 0.12.2", "< 1.
|
38
|
+
spec.add_dependency "faraday_middleware", ">= 0.12.2", "< 1.1"
|
36
39
|
|
37
40
|
# Train plugins we ship with InSpec
|
38
41
|
spec.add_dependency "train-habitat", "~> 0.1"
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: inspec
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 5.7.9
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Chef InSpec Team
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2022-03-16 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: inspec-core
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version:
|
19
|
+
version: 5.7.9
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version:
|
26
|
+
version: 5.7.9
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: train
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -66,6 +66,20 @@ dependencies:
|
|
66
66
|
- - ">="
|
67
67
|
- !ruby/object:Gem::Version
|
68
68
|
version: '0'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: progress_bar
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - "~>"
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: 1.3.3
|
76
|
+
type: :runtime
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - "~>"
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: 1.3.3
|
69
83
|
- !ruby/object:Gem::Dependency
|
70
84
|
name: faraday_middleware
|
71
85
|
requirement: !ruby/object:Gem::Requirement
|
@@ -75,7 +89,7 @@ dependencies:
|
|
75
89
|
version: 0.12.2
|
76
90
|
- - "<"
|
77
91
|
- !ruby/object:Gem::Version
|
78
|
-
version: '1.
|
92
|
+
version: '1.1'
|
79
93
|
type: :runtime
|
80
94
|
prerelease: false
|
81
95
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -85,7 +99,7 @@ dependencies:
|
|
85
99
|
version: 0.12.2
|
86
100
|
- - "<"
|
87
101
|
- !ruby/object:Gem::Version
|
88
|
-
version: '1.
|
102
|
+
version: '1.1'
|
89
103
|
- !ruby/object:Gem::Dependency
|
90
104
|
name: train-habitat
|
91
105
|
requirement: !ruby/object:Gem::Requirement
|
@@ -167,63 +181,6 @@ files:
|
|
167
181
|
- lib/plugins/inspec-init/templates/profiles/gcp/controls/example.rb
|
168
182
|
- lib/plugins/inspec-init/templates/profiles/gcp/inputs.yml
|
169
183
|
- lib/plugins/inspec-init/templates/profiles/gcp/inspec.yml
|
170
|
-
- lib/resource_support/aws.rb
|
171
|
-
- lib/resource_support/aws/aws_backend_base.rb
|
172
|
-
- lib/resource_support/aws/aws_backend_factory_mixin.rb
|
173
|
-
- lib/resource_support/aws/aws_plural_resource_mixin.rb
|
174
|
-
- lib/resource_support/aws/aws_resource_mixin.rb
|
175
|
-
- lib/resource_support/aws/aws_singular_resource_mixin.rb
|
176
|
-
- lib/resources/aws/aws_billing_report.rb
|
177
|
-
- lib/resources/aws/aws_billing_reports.rb
|
178
|
-
- lib/resources/aws/aws_cloudtrail_trail.rb
|
179
|
-
- lib/resources/aws/aws_cloudtrail_trails.rb
|
180
|
-
- lib/resources/aws/aws_cloudwatch_alarm.rb
|
181
|
-
- lib/resources/aws/aws_cloudwatch_log_metric_filter.rb
|
182
|
-
- lib/resources/aws/aws_config_delivery_channel.rb
|
183
|
-
- lib/resources/aws/aws_config_recorder.rb
|
184
|
-
- lib/resources/aws/aws_ebs_volume.rb
|
185
|
-
- lib/resources/aws/aws_ebs_volumes.rb
|
186
|
-
- lib/resources/aws/aws_ec2_instance.rb
|
187
|
-
- lib/resources/aws/aws_ec2_instances.rb
|
188
|
-
- lib/resources/aws/aws_ecs_cluster.rb
|
189
|
-
- lib/resources/aws/aws_eks_cluster.rb
|
190
|
-
- lib/resources/aws/aws_elb.rb
|
191
|
-
- lib/resources/aws/aws_elbs.rb
|
192
|
-
- lib/resources/aws/aws_flow_log.rb
|
193
|
-
- lib/resources/aws/aws_iam_access_key.rb
|
194
|
-
- lib/resources/aws/aws_iam_access_keys.rb
|
195
|
-
- lib/resources/aws/aws_iam_group.rb
|
196
|
-
- lib/resources/aws/aws_iam_groups.rb
|
197
|
-
- lib/resources/aws/aws_iam_password_policy.rb
|
198
|
-
- lib/resources/aws/aws_iam_policies.rb
|
199
|
-
- lib/resources/aws/aws_iam_policy.rb
|
200
|
-
- lib/resources/aws/aws_iam_role.rb
|
201
|
-
- lib/resources/aws/aws_iam_root_user.rb
|
202
|
-
- lib/resources/aws/aws_iam_user.rb
|
203
|
-
- lib/resources/aws/aws_iam_users.rb
|
204
|
-
- lib/resources/aws/aws_kms_key.rb
|
205
|
-
- lib/resources/aws/aws_kms_keys.rb
|
206
|
-
- lib/resources/aws/aws_rds_instance.rb
|
207
|
-
- lib/resources/aws/aws_route_table.rb
|
208
|
-
- lib/resources/aws/aws_route_tables.rb
|
209
|
-
- lib/resources/aws/aws_s3_bucket.rb
|
210
|
-
- lib/resources/aws/aws_s3_bucket_object.rb
|
211
|
-
- lib/resources/aws/aws_s3_buckets.rb
|
212
|
-
- lib/resources/aws/aws_security_group.rb
|
213
|
-
- lib/resources/aws/aws_security_groups.rb
|
214
|
-
- lib/resources/aws/aws_sns_subscription.rb
|
215
|
-
- lib/resources/aws/aws_sns_topic.rb
|
216
|
-
- lib/resources/aws/aws_sns_topics.rb
|
217
|
-
- lib/resources/aws/aws_sqs_queue.rb
|
218
|
-
- lib/resources/aws/aws_subnet.rb
|
219
|
-
- lib/resources/aws/aws_subnets.rb
|
220
|
-
- lib/resources/aws/aws_vpc.rb
|
221
|
-
- lib/resources/aws/aws_vpcs.rb
|
222
|
-
- lib/resources/azure/azure_backend.rb
|
223
|
-
- lib/resources/azure/azure_generic_resource.rb
|
224
|
-
- lib/resources/azure/azure_resource_group.rb
|
225
|
-
- lib/resources/azure/azure_virtual_machine.rb
|
226
|
-
- lib/resources/azure/azure_virtual_machine_data_disk.rb
|
227
184
|
homepage: https://github.com/inspec/inspec
|
228
185
|
licenses:
|
229
186
|
- Apache-2.0
|
@@ -236,7 +193,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
236
193
|
requirements:
|
237
194
|
- - ">="
|
238
195
|
- !ruby/object:Gem::Version
|
239
|
-
version: '2.
|
196
|
+
version: '2.7'
|
240
197
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
241
198
|
requirements:
|
242
199
|
- - ">="
|
@@ -1,12 +0,0 @@
|
|
1
|
-
class AwsBackendBase
|
2
|
-
attr_reader :aws_transport
|
3
|
-
class << self; attr_accessor :aws_client_class end
|
4
|
-
|
5
|
-
def initialize(inspec = nil)
|
6
|
-
@aws_transport = inspec ? inspec.backend : nil
|
7
|
-
end
|
8
|
-
|
9
|
-
def aws_service_client
|
10
|
-
aws_transport.aws_client(self.class.aws_client_class)
|
11
|
-
end
|
12
|
-
end
|
@@ -1,24 +0,0 @@
|
|
1
|
-
require "resource_support/aws/aws_resource_mixin"
|
2
|
-
require "resource_support/aws/aws_backend_factory_mixin"
|
3
|
-
|
4
|
-
module AwsPluralResourceMixin
|
5
|
-
include AwsResourceMixin
|
6
|
-
attr_reader :table
|
7
|
-
|
8
|
-
# This sets up a class, AwsSomeResource::BackendFactory, that
|
9
|
-
# provides a mechanism to create and use backends without
|
10
|
-
# having to know which is selected. This is mainly used for
|
11
|
-
# unit testing.
|
12
|
-
# TODO: DRY up. This code exists in both the Singular and Plural mixins.
|
13
|
-
# We'd like to put it in AwsResourceMixin, but included only sees the
|
14
|
-
# directly-including class - we can't see second-order includers.
|
15
|
-
def self.included(base)
|
16
|
-
# Create a new class, whose body is simply to extend the
|
17
|
-
# backend factory mixin
|
18
|
-
resource_backend_factory_class = Class.new(Object) do
|
19
|
-
extend AwsBackendFactoryMixin
|
20
|
-
end
|
21
|
-
# Name that class
|
22
|
-
base.const_set("BackendFactory", resource_backend_factory_class)
|
23
|
-
end
|
24
|
-
end
|
@@ -1,69 +0,0 @@
|
|
1
|
-
module AwsResourceMixin
|
2
|
-
def initialize(resource_params = {})
|
3
|
-
Inspec.deprecate(:aws_resources_in_resource_pack,
|
4
|
-
"Resource '#{@__resource_name__ ||= self.class.to_s}'")
|
5
|
-
validate_params(resource_params).each do |param, value|
|
6
|
-
instance_variable_set(:"@#{param}", value)
|
7
|
-
end
|
8
|
-
catch_aws_errors do
|
9
|
-
fetch_from_api
|
10
|
-
end
|
11
|
-
rescue ArgumentError => e
|
12
|
-
# continue with ArgumentError if testing
|
13
|
-
raise unless respond_to?(:inspec) && inspec
|
14
|
-
|
15
|
-
raise Inspec::Exceptions::ResourceFailed, e.message
|
16
|
-
end
|
17
|
-
|
18
|
-
# Default implementation of validate params accepts everything.
|
19
|
-
def validate_params(resource_params)
|
20
|
-
resource_params
|
21
|
-
end
|
22
|
-
|
23
|
-
def check_resource_param_names(raw_params: {}, allowed_params: [], allowed_scalar_name: nil, allowed_scalar_type: nil)
|
24
|
-
# Some resources allow passing in a single ID value. Check and convert to hash if so.
|
25
|
-
if allowed_scalar_name && !raw_params.is_a?(Hash)
|
26
|
-
value_seen = raw_params
|
27
|
-
if value_seen.is_a?(allowed_scalar_type)
|
28
|
-
raw_params = { allowed_scalar_name => value_seen }
|
29
|
-
else
|
30
|
-
raise ArgumentError, "If you pass a single value to the resource, it must " \
|
31
|
-
"be a #{allowed_scalar_type}, not an #{value_seen.class}."
|
32
|
-
end
|
33
|
-
end
|
34
|
-
|
35
|
-
# Remove all expected params from the raw param hash
|
36
|
-
recognized_params = {}
|
37
|
-
allowed_params.each do |expected_param|
|
38
|
-
recognized_params[expected_param] = raw_params.delete(expected_param) if raw_params.key?(expected_param)
|
39
|
-
end
|
40
|
-
|
41
|
-
# Any leftovers are unwelcome
|
42
|
-
unless raw_params.empty?
|
43
|
-
raise ArgumentError, "Unrecognized resource param '#{raw_params.keys.first}'. Expected parameters: #{allowed_params.join(", ")}"
|
44
|
-
end
|
45
|
-
|
46
|
-
recognized_params
|
47
|
-
end
|
48
|
-
|
49
|
-
def inspec_runner
|
50
|
-
# When running under inspec-cli, we have an 'inspec' method that
|
51
|
-
# returns the runner. When running under unit tests, we don't
|
52
|
-
# have that, but we still have to call this to pass something
|
53
|
-
# (nil is OK) to the backend.
|
54
|
-
# TODO: remove with https://github.com/chef/inspec-aws/issues/216
|
55
|
-
inspec if respond_to?(:inspec)
|
56
|
-
end
|
57
|
-
|
58
|
-
# Intercept AWS exceptions
|
59
|
-
def catch_aws_errors
|
60
|
-
yield
|
61
|
-
rescue Aws::Errors::MissingCredentialsError
|
62
|
-
# The AWS error here is unhelpful:
|
63
|
-
# "unable to sign request without credentials set"
|
64
|
-
Inspec::Log.error "It appears that you have not set your AWS credentials. You may set them using environment variables, or using the 'aws://region/aws_credentials_profile' target. See https://docs.chef.io/inspec/platforms/ for details."
|
65
|
-
fail_resource("No AWS credentials available")
|
66
|
-
rescue Aws::Errors::ServiceError => e
|
67
|
-
fail_resource e.message
|
68
|
-
end
|
69
|
-
end
|
@@ -1,27 +0,0 @@
|
|
1
|
-
require "resource_support/aws/aws_resource_mixin"
|
2
|
-
require "resource_support/aws/aws_backend_factory_mixin"
|
3
|
-
|
4
|
-
module AwsSingularResourceMixin
|
5
|
-
include AwsResourceMixin
|
6
|
-
|
7
|
-
def exists?
|
8
|
-
@exists
|
9
|
-
end
|
10
|
-
|
11
|
-
# This sets up a class, AwsSomeResource::BackendFactory, that
|
12
|
-
# provides a mechanism to create and use backends without
|
13
|
-
# having to know which is selected. This is mainly used for
|
14
|
-
# unit testing.
|
15
|
-
# TODO: DRY up. This code exists in both the Singular and Plural mixins.
|
16
|
-
# We'd like to put it in AwsResourceMixin, but included only sees the
|
17
|
-
# directly-including class - we can't see second-order includers.
|
18
|
-
def self.included(base)
|
19
|
-
# Create a new class, whose body is simply to extend the
|
20
|
-
# backend factory mixin
|
21
|
-
resource_backend_factory_class = Class.new(Object) do
|
22
|
-
extend AwsBackendFactoryMixin
|
23
|
-
end
|
24
|
-
# Name that class
|
25
|
-
base.const_set("BackendFactory", resource_backend_factory_class)
|
26
|
-
end
|
27
|
-
end
|
data/lib/resource_support/aws.rb
DELETED
@@ -1,76 +0,0 @@
|
|
1
|
-
# Main AWS loader file. The intent is for this to be
|
2
|
-
# loaded only if AWS resources are needed.
|
3
|
-
|
4
|
-
require "aws-sdk-core"
|
5
|
-
|
6
|
-
require "aws-sdk-cloudtrail"
|
7
|
-
require "aws-sdk-cloudwatch"
|
8
|
-
require "aws-sdk-cloudwatchlogs"
|
9
|
-
require "aws-sdk-costandusagereportservice"
|
10
|
-
require "aws-sdk-configservice"
|
11
|
-
require "aws-sdk-ec2"
|
12
|
-
require "aws-sdk-ecs"
|
13
|
-
require "aws-sdk-eks"
|
14
|
-
require "aws-sdk-elasticloadbalancing"
|
15
|
-
require "aws-sdk-iam"
|
16
|
-
require "aws-sdk-kms"
|
17
|
-
require "aws-sdk-rds"
|
18
|
-
require "aws-sdk-s3"
|
19
|
-
require "aws-sdk-sqs"
|
20
|
-
require "aws-sdk-sns"
|
21
|
-
|
22
|
-
require "resource_support/aws/aws_backend_factory_mixin"
|
23
|
-
require "resource_support/aws/aws_resource_mixin"
|
24
|
-
require "resource_support/aws/aws_singular_resource_mixin"
|
25
|
-
require "resource_support/aws/aws_plural_resource_mixin"
|
26
|
-
require "resource_support/aws/aws_backend_base"
|
27
|
-
|
28
|
-
# Load all AWS resources
|
29
|
-
# TODO: loop over and load entire directory
|
30
|
-
# for f in ls lib/resources/aws/*; do t=$(echo $f | cut -c 5- | cut -f1 -d. ); echo "require '${t}'"; done
|
31
|
-
require "resources/aws/aws_billing_report"
|
32
|
-
require "resources/aws/aws_billing_reports"
|
33
|
-
require "resources/aws/aws_cloudtrail_trail"
|
34
|
-
require "resources/aws/aws_cloudtrail_trails"
|
35
|
-
require "resources/aws/aws_cloudwatch_alarm"
|
36
|
-
require "resources/aws/aws_cloudwatch_log_metric_filter"
|
37
|
-
require "resources/aws/aws_config_delivery_channel"
|
38
|
-
require "resources/aws/aws_config_recorder"
|
39
|
-
require "resources/aws/aws_ec2_instance"
|
40
|
-
require "resources/aws/aws_ebs_volume"
|
41
|
-
require "resources/aws/aws_ebs_volumes"
|
42
|
-
require "resources/aws/aws_flow_log"
|
43
|
-
require "resources/aws/aws_ec2_instances"
|
44
|
-
require "resources/aws/aws_ecs_cluster"
|
45
|
-
require "resources/aws/aws_eks_cluster"
|
46
|
-
require "resources/aws/aws_elb"
|
47
|
-
require "resources/aws/aws_elbs"
|
48
|
-
require "resources/aws/aws_iam_access_key"
|
49
|
-
require "resources/aws/aws_iam_access_keys"
|
50
|
-
require "resources/aws/aws_iam_group"
|
51
|
-
require "resources/aws/aws_iam_groups"
|
52
|
-
require "resources/aws/aws_iam_password_policy"
|
53
|
-
require "resources/aws/aws_iam_policies"
|
54
|
-
require "resources/aws/aws_iam_policy"
|
55
|
-
require "resources/aws/aws_iam_role"
|
56
|
-
require "resources/aws/aws_iam_root_user"
|
57
|
-
require "resources/aws/aws_iam_user"
|
58
|
-
require "resources/aws/aws_iam_users"
|
59
|
-
require "resources/aws/aws_kms_key"
|
60
|
-
require "resources/aws/aws_kms_keys"
|
61
|
-
require "resources/aws/aws_rds_instance"
|
62
|
-
require "resources/aws/aws_route_table"
|
63
|
-
require "resources/aws/aws_route_tables"
|
64
|
-
require "resources/aws/aws_s3_bucket"
|
65
|
-
require "resources/aws/aws_s3_bucket_object"
|
66
|
-
require "resources/aws/aws_s3_buckets"
|
67
|
-
require "resources/aws/aws_security_group"
|
68
|
-
require "resources/aws/aws_security_groups"
|
69
|
-
require "resources/aws/aws_sns_subscription"
|
70
|
-
require "resources/aws/aws_sns_topic"
|
71
|
-
require "resources/aws/aws_sns_topics"
|
72
|
-
require "resources/aws/aws_sqs_queue"
|
73
|
-
require "resources/aws/aws_subnet"
|
74
|
-
require "resources/aws/aws_subnets"
|
75
|
-
require "resources/aws/aws_vpc"
|
76
|
-
require "resources/aws/aws_vpcs"
|
@@ -1,105 +0,0 @@
|
|
1
|
-
require "resource_support/aws/aws_singular_resource_mixin"
|
2
|
-
require "resource_support/aws/aws_backend_base"
|
3
|
-
|
4
|
-
require "aws-sdk-costandusagereportservice"
|
5
|
-
|
6
|
-
class AwsBillingReport < Inspec.resource(1)
|
7
|
-
name "aws_billing_report"
|
8
|
-
supports platform: "aws"
|
9
|
-
desc "Verifies settings for AWS Cost and Billing Reports."
|
10
|
-
example <<~EXAMPLE
|
11
|
-
describe aws_billing_report('inspec1') do
|
12
|
-
its('report_name') { should cmp 'inspec1' }
|
13
|
-
its('time_unit') { should cmp 'hourly' }
|
14
|
-
end
|
15
|
-
|
16
|
-
describe aws_billing_report(report: 'inspec1') do
|
17
|
-
it { should exist }
|
18
|
-
end
|
19
|
-
EXAMPLE
|
20
|
-
|
21
|
-
include AwsSingularResourceMixin
|
22
|
-
|
23
|
-
attr_reader :report_name, :time_unit, :format, :compression, :s3_bucket,
|
24
|
-
:s3_prefix, :s3_region
|
25
|
-
|
26
|
-
def to_s
|
27
|
-
"AWS Billing Report #{report_name}"
|
28
|
-
end
|
29
|
-
|
30
|
-
def hourly?
|
31
|
-
exists? ? time_unit.eql?("hourly") : nil
|
32
|
-
end
|
33
|
-
|
34
|
-
def daily?
|
35
|
-
exists? ? time_unit.eql?("daily") : nil
|
36
|
-
end
|
37
|
-
|
38
|
-
def zip?
|
39
|
-
exists? ? compression.eql?("zip") : nil
|
40
|
-
end
|
41
|
-
|
42
|
-
def gzip?
|
43
|
-
exists? ? compression.eql?("gzip") : nil
|
44
|
-
end
|
45
|
-
|
46
|
-
private
|
47
|
-
|
48
|
-
def validate_params(raw_params)
|
49
|
-
validated_params = check_resource_param_names(
|
50
|
-
raw_params: raw_params,
|
51
|
-
allowed_params: [:report_name],
|
52
|
-
allowed_scalar_name: :report_name,
|
53
|
-
allowed_scalar_type: String
|
54
|
-
)
|
55
|
-
|
56
|
-
if validated_params.empty?
|
57
|
-
raise ArgumentError, "You must provide the parameter 'report_name' to aws_billing_report."
|
58
|
-
end
|
59
|
-
|
60
|
-
validated_params
|
61
|
-
end
|
62
|
-
|
63
|
-
def fetch_from_api
|
64
|
-
report = find_report(report_name)
|
65
|
-
@exists = !report.nil?
|
66
|
-
if exists?
|
67
|
-
@time_unit = report.time_unit.downcase
|
68
|
-
@format = report.format.downcase
|
69
|
-
@compression = report.compression.downcase
|
70
|
-
@s3_bucket = report.s3_bucket
|
71
|
-
@s3_prefix = report.s3_prefix
|
72
|
-
@s3_region = report.s3_region
|
73
|
-
end
|
74
|
-
end
|
75
|
-
|
76
|
-
def find_report(report_name)
|
77
|
-
pagination_opts = {}
|
78
|
-
found_report_def = nil
|
79
|
-
while found_report_def.nil?
|
80
|
-
api_result = backend.describe_report_definitions(pagination_opts)
|
81
|
-
next_token = api_result.next_token
|
82
|
-
found_report_def = api_result.report_definitions.find { |report_def| report_def.report_name == report_name }
|
83
|
-
pagination_opts = { next_token: next_token }
|
84
|
-
|
85
|
-
next if found_report_def.nil? && next_token # Loop again: didn't find it, but there are more results
|
86
|
-
break if found_report_def.nil? && next_token.nil? # Give up: didn't find it, no more results
|
87
|
-
end
|
88
|
-
found_report_def
|
89
|
-
end
|
90
|
-
|
91
|
-
def backend
|
92
|
-
@backend ||= BackendFactory.create(inspec_runner)
|
93
|
-
end
|
94
|
-
|
95
|
-
class Backend
|
96
|
-
class AwsClientApi < AwsBackendBase
|
97
|
-
AwsBillingReport::BackendFactory.set_default_backend(self)
|
98
|
-
self.aws_client_class = Aws::CostandUsageReportService::Client
|
99
|
-
|
100
|
-
def describe_report_definitions(query = {})
|
101
|
-
aws_service_client.describe_report_definitions(query)
|
102
|
-
end
|
103
|
-
end
|
104
|
-
end
|
105
|
-
end
|
@@ -1,74 +0,0 @@
|
|
1
|
-
require "inspec/utils/filter"
|
2
|
-
require "resource_support/aws/aws_plural_resource_mixin"
|
3
|
-
require "resource_support/aws/aws_backend_base"
|
4
|
-
require "aws-sdk-costandusagereportservice"
|
5
|
-
|
6
|
-
class AwsBillingReports < Inspec.resource(1)
|
7
|
-
name "aws_billing_reports"
|
8
|
-
supports platform: "aws"
|
9
|
-
desc "Verifies settings for AWS Cost and Billing Reports."
|
10
|
-
example <<~EXAMPLE
|
11
|
-
describe aws_billing_reports do
|
12
|
-
its('report_names') { should include 'inspec1' }
|
13
|
-
its('s3_buckets') { should include 'inspec1-s3-bucket' }
|
14
|
-
end
|
15
|
-
|
16
|
-
describe aws_billing_reports.where { report_name =~ /inspec.*/ } do
|
17
|
-
its ('report_names') { should include ['inspec1'] }
|
18
|
-
its ('time_units') { should include ['DAILY'] }
|
19
|
-
its ('s3_buckets') { should include ['inspec1-s3-bucket'] }
|
20
|
-
end
|
21
|
-
EXAMPLE
|
22
|
-
|
23
|
-
include AwsPluralResourceMixin
|
24
|
-
|
25
|
-
filtertable = FilterTable.create
|
26
|
-
filtertable.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
|
27
|
-
.register_column(:report_names, field: :report_name)
|
28
|
-
.register_column(:time_units, field: :time_unit, style: :simple)
|
29
|
-
.register_column(:formats, field: :format, style: :simple)
|
30
|
-
.register_column(:compressions, field: :compression, style: :simple)
|
31
|
-
.register_column(:s3_buckets, field: :s3_bucket, style: :simple)
|
32
|
-
.register_column(:s3_prefixes, field: :s3_prefix, style: :simple)
|
33
|
-
.register_column(:s3_regions, field: :s3_region, style: :simple)
|
34
|
-
filtertable.install_filter_methods_on_resource(self, :table)
|
35
|
-
|
36
|
-
def validate_params(resource_params)
|
37
|
-
unless resource_params.empty?
|
38
|
-
raise ArgumentError, "aws_billing_reports does not accept resource parameters."
|
39
|
-
end
|
40
|
-
|
41
|
-
resource_params
|
42
|
-
end
|
43
|
-
|
44
|
-
def to_s
|
45
|
-
"AWS Billing Reports"
|
46
|
-
end
|
47
|
-
|
48
|
-
def fetch_from_api
|
49
|
-
@table = []
|
50
|
-
pagination_opts = {}
|
51
|
-
backend = BackendFactory.create(inspec_runner)
|
52
|
-
loop do
|
53
|
-
api_result = backend.describe_report_definitions(pagination_opts)
|
54
|
-
api_result.report_definitions.each do |raw_report|
|
55
|
-
report = raw_report.to_h
|
56
|
-
%i{time_unit compression}.each { |field| report[field].downcase! }
|
57
|
-
@table << report
|
58
|
-
end
|
59
|
-
pagination_opts = { next_token: api_result.next_token }
|
60
|
-
break unless api_result.next_token
|
61
|
-
end
|
62
|
-
end
|
63
|
-
|
64
|
-
class Backend
|
65
|
-
class AwsClientApi < AwsBackendBase
|
66
|
-
AwsBillingReports::BackendFactory.set_default_backend(self)
|
67
|
-
self.aws_client_class = Aws::CostandUsageReportService::Client
|
68
|
-
|
69
|
-
def describe_report_definitions(options = {})
|
70
|
-
aws_service_client.describe_report_definitions(options)
|
71
|
-
end
|
72
|
-
end
|
73
|
-
end
|
74
|
-
end
|