inspec 4.7.3 → 4.7.18

data/lib/resources/aws/aws_iam_role.rb

@@ -31,6 +31,7 @@ class AwsIamRole < Inspec.resource(1)
     if validated_params.empty?
       raise ArgumentError, "You must provide a role_name to aws_iam_role."
     end
+
     validated_params
   end
 

data/lib/resources/aws/aws_iam_user.rb

@@ -17,7 +17,7 @@ class AwsIamUser < Inspec.resource(1)
 
   include AwsSingularResourceMixin
   attr_reader :access_keys, :attached_policy_names, :attached_policy_arns, \
-              :has_console_password, :has_mfa_enabled, :inline_policy_names, :username
+    :has_console_password, :has_mfa_enabled, :inline_policy_names, :username
   alias has_mfa_enabled? has_mfa_enabled
   alias has_console_password? has_console_password
 
@@ -32,11 +32,13 @@ class AwsIamUser < Inspec.resource(1)
 
   def has_attached_policies?
     return nil unless exists?
+
     !attached_policy_names.empty?
   end
 
   def has_inline_policies?
     return nil unless exists?
+
     !inline_policy_names.empty?
   end
 
@@ -45,7 +47,7 @@ class AwsIamUser < Inspec.resource(1)
   def validate_params(raw_params)
     validated_params = check_resource_param_names(
       raw_params: raw_params,
-      allowed_params: [:username, :aws_user_struct, :name, :user],
+      allowed_params: %i{username aws_user_struct name user},
       allowed_scalar_name: :username,
       allowed_scalar_type: String
     )
@@ -64,6 +66,7 @@ class AwsIamUser < Inspec.resource(1)
     if validated_params.empty?
       raise ArgumentError, "You must provide a username to aws_iam_user."
     end
+
     validated_params
   end
 

data/lib/resources/aws/aws_iam_users.rb

@@ -65,26 +65,26 @@ class AwsIamUsers < Inspec.resource(1)
 
   # These are included on the initial fetch
   filter.register_column(:usernames, field: :user_name)
-        .register_column(:username) { |res| res.entries.map { |row| row[:user_name] } } # We should deprecate this; plural resources get plural properties
-        .register_column(:password_ever_used?, field: :password_ever_used?)
-        .register_column(:password_never_used?, field: :password_never_used?)
-        .register_column(:password_last_used_days_ago, field: :password_last_used_days_ago)
+    .register_column(:username) { |res| res.entries.map { |row| row[:user_name] } } # We should deprecate this; plural resources get plural properties
+    .register_column(:password_ever_used?, field: :password_ever_used?)
+    .register_column(:password_never_used?, field: :password_never_used?)
+    .register_column(:password_last_used_days_ago, field: :password_last_used_days_ago)
 
   # Remaining properties / criteria are handled lazily, grouped by fetcher
   filter.register_column(:has_console_password?, field: :has_console_password?, lazy: method(:lazy_get_login_profile))
-        .register_column(:has_console_password, field: :has_console_password, lazy: method(:lazy_get_login_profile))
+    .register_column(:has_console_password, field: :has_console_password, lazy: method(:lazy_get_login_profile))
 
   filter.register_column(:has_mfa_enabled?, field: :has_mfa_enabled?, lazy: method(:lazy_list_mfa_devices))
-        .register_column(:has_mfa_enabled, field: :has_mfa_enabled, lazy: method(:lazy_list_mfa_devices))
+    .register_column(:has_mfa_enabled, field: :has_mfa_enabled, lazy: method(:lazy_list_mfa_devices))
 
   filter.register_column(:has_inline_policies?, field: :has_inline_policies?, lazy: method(:lazy_list_user_policies))
-        .register_column(:has_inline_policies, field: :has_inline_policies, lazy: method(:lazy_list_user_policies))
-        .register_column(:inline_policy_names, field: :inline_policy_names, style: :simple, lazy: method(:lazy_list_user_policies))
+    .register_column(:has_inline_policies, field: :has_inline_policies, lazy: method(:lazy_list_user_policies))
+    .register_column(:inline_policy_names, field: :inline_policy_names, style: :simple, lazy: method(:lazy_list_user_policies))
 
   filter.register_column(:has_attached_policies?, field: :has_attached_policies?, lazy: method(:lazy_list_attached_policies))
-        .register_column(:has_attached_policies, field: :has_attached_policies, lazy: method(:lazy_list_attached_policies))
-        .register_column(:attached_policy_names, field: :attached_policy_names, style: :simple, lazy: method(:lazy_list_attached_policies))
-        .register_column(:attached_policy_arns, field: :attached_policy_arns, style: :simple, lazy: method(:lazy_list_attached_policies))
+    .register_column(:has_attached_policies, field: :has_attached_policies, lazy: method(:lazy_list_attached_policies))
+    .register_column(:attached_policy_names, field: :attached_policy_names, style: :simple, lazy: method(:lazy_list_attached_policies))
+    .register_column(:attached_policy_arns, field: :attached_policy_arns, style: :simple, lazy: method(:lazy_list_attached_policies))
   filter.install_filter_methods_on_resource(self, :table)
 
   def validate_params(raw_params)
@@ -92,6 +92,7 @@ class AwsIamUsers < Inspec.resource(1)
     unless raw_params.empty?
       raise ArgumentError, "aws_iam_users does not accept resource parameters"
     end
+
     raw_params
   end
 

data/lib/resources/aws/aws_kms_key.rb

@@ -15,8 +15,8 @@ class AwsKmsKey < Inspec.resource(1)
 
   include AwsSingularResourceMixin
   attr_reader :key_id, :arn, :creation_date, :key_usage, :key_state, :description,
-              :deletion_date, :valid_to, :external, :has_key_expiration, :managed_by_aws,
-              :has_rotation_enabled, :enabled
+    :deletion_date, :valid_to, :external, :has_key_expiration, :managed_by_aws,
+    :has_rotation_enabled, :enabled
   # Use aliases for matchers
   alias deletion_time deletion_date
   alias invalidation_time valid_to

data/lib/resources/aws/aws_kms_keys.rb

@@ -17,6 +17,7 @@ class AwsKmsKeys < Inspec.resource(1)
     unless resource_params.empty?
       raise ArgumentError, "aws_kms_keys does not accept resource parameters."
     end
+
     resource_params
   end
 
@@ -24,7 +25,7 @@ class AwsKmsKeys < Inspec.resource(1)
   filter = FilterTable.create
   filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
   filter.register_column(:key_arns, field: :key_arn)
-        .register_column(:key_ids, field: :key_id)
+    .register_column(:key_ids, field: :key_id)
   filter.install_filter_methods_on_resource(self, :table)
 
   def to_s
@@ -39,6 +40,7 @@ class AwsKmsKeys < Inspec.resource(1)
       api_result = backend.list_keys(pagination_opts)
       @table += api_result.keys.map(&:to_h)
       break unless api_result.truncated
+
       pagination_opts = { marker: api_result.next_marker }
     end
   end

data/lib/resources/aws/aws_route_table.rb

@@ -33,8 +33,8 @@ class AwsRouteTable < Inspec.resource(1)
     if validated_params.key?(:route_table_id) &&
         validated_params[:route_table_id] !~ /^rtb\-([0-9a-f]{17})|(^rtb\-[0-9a-f]{8})$/
       raise ArgumentError,
-            "aws_route_table Route Table ID must be in the" \
-            ' format "rtb-" followed by 8 or 17 hexadecimal characters.'
+        "aws_route_table Route Table ID must be in the" \
+        ' format "rtb-" followed by 8 or 17 hexadecimal characters.'
     end
 
     validated_params

data/lib/resources/aws/aws_route_tables.rb

@@ -17,7 +17,7 @@ class AwsRouteTables < Inspec.resource(1)
   filter = FilterTable.create
   filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
   filter.register_column(:vpc_ids, field: :vpc_id)
-        .register_column(:route_table_ids, field: :route_table_id)
+    .register_column(:route_table_ids, field: :route_table_id)
   filter.install_filter_methods_on_resource(self, :routes_data)
 
   def routes_data
@@ -40,6 +40,7 @@ class AwsRouteTables < Inspec.resource(1)
     unless raw_criteria.empty?
       raise ArgumentError, "aws_route_tables does not currently accept resource parameters."
     end
+
     raw_criteria
   end
 

data/lib/resources/aws/aws_s3_bucket.rb

@@ -40,11 +40,13 @@ class AwsS3Bucket < Inspec.resource(1)
 
   def has_default_encryption_enabled?
     return false unless @exists
+
     @has_default_encryption_enabled ||= fetch_bucket_encryption_configuration
   end
 
   def has_access_logging_enabled?
     return false unless @exists
+
     catch_aws_errors do
       @has_access_logging_enabled ||= !BackendFactory.create(inspec_runner).get_bucket_logging(bucket: bucket_name).logging_enabled.nil?
     end
@@ -101,9 +103,9 @@ class AwsS3Bucket < Inspec.resource(1)
     @has_default_encryption_enabled ||= catch_aws_errors do
       begin
         !BackendFactory.create(inspec_runner)
-                       .get_bucket_encryption(bucket: bucket_name)
-                       .server_side_encryption_configuration
-                       .nil?
+          .get_bucket_encryption(bucket: bucket_name)
+          .server_side_encryption_configuration
+          .nil?
       rescue Aws::S3::Errors::ServerSideEncryptionConfigurationNotFoundError
         false
       end

data/lib/resources/aws/aws_s3_bucket_object.rb

@@ -23,6 +23,7 @@ class AwsS3BucketObject < Inspec.resource(1)
 
   def object_acl
     return @object_acl if defined? @object_acl
+
     catch_aws_errors do
       @object_acl = BackendFactory.create(inspec_runner).get_object_acl(bucket: bucket_name, key: key).grants
     end
@@ -42,11 +43,12 @@ class AwsS3BucketObject < Inspec.resource(1)
   def validate_params(raw_params)
     validated_params = check_resource_param_names(
       raw_params: raw_params,
-      allowed_params: [:bucket_name, :key, :id]
+      allowed_params: %i{bucket_name key id}
     )
     if validated_params.empty? || !validated_params.key?(:bucket_name) || !validated_params.key?(:key)
       raise ArgumentError, "You must provide a bucket_name and key to aws_s3_bucket_object."
     end
+
     validated_params
   end
 

data/lib/resources/aws/aws_s3_buckets.rb

@@ -28,6 +28,7 @@ class AwsS3Buckets < Inspec.resource(1)
     unless resource_params.empty?
       raise ArgumentError, "aws_s3_buckets does not accept resource parameters."
     end
+
     resource_params
   end
 

data/lib/resources/aws/aws_security_group.rb

@@ -49,6 +49,7 @@ class AwsSecurityGroup < Inspec.resource(1)
     # allow_{in_out}_only require either a single-rule group, or you
     # to select a rule using position.
     return false unless rules.count == 1 || criteria.key?(:position)
+
     if criteria.key?(:security_group)
       if criteria.key?(:position)
         pos = criteria[:position] - 1
@@ -97,7 +98,7 @@ class AwsSecurityGroup < Inspec.resource(1)
 
     # Any leftovers are unwelcome
     unless raw_criteria.empty?
-      raise ArgumentError, "Unrecognized security group rule 'allow' criteria '#{raw_criteria.keys.join(',')}'. Expected criteria: #{allowed_criteria.join(', ')}"
+      raise ArgumentError, "Unrecognized security group rule 'allow' criteria '#{raw_criteria.keys.join(",")}'. Expected criteria: #{allowed_criteria.join(", ")}"
     end
 
     recognized_criteria
@@ -138,12 +139,14 @@ class AwsSecurityGroup < Inspec.resource(1)
       from = criteria[:from_port]
       # It's a match if neither criteria was specified
       return true if to.nil? && from.nil?
+
       # Normalize to integers
       to = to.to_i unless to.nil?
       from = from.to_i unless from.nil?
       # It's a match if either was specified and the other was not
       return true if rule[:to_port] == to && from.nil?
       return true if rule[:from_port] == from && to.nil?
+
       # Finally, both must match.
       rule[:to_port] == to && rule[:from_port] == from
     elsif !criteria[:port]
@@ -159,6 +162,7 @@ class AwsSecurityGroup < Inspec.resource(1)
 
   def allow__match_protocol(rule, criteria)
     return true unless criteria.key?(:protocol)
+
     prot = criteria[:protocol]
     # We provide a "fluency alias" for -1 (any).
     prot = "-1" if prot == "any"
@@ -194,25 +198,29 @@ class AwsSecurityGroup < Inspec.resource(1)
 
   def allow__match_ipv4_range(rule, criteria)
     return true unless criteria.key?(:ipv4_range)
+
     match_ipv4_or_6_range(rule, criteria)
   end
 
   def allow__match_ipv6_range(rule, criteria)
     return true unless criteria.key?(:ipv6_range)
+
     match_ipv4_or_6_range(rule, criteria)
   end
 
   def allow__match_security_group(rule, criteria)
     return true unless criteria.key?(:security_group)
+
     query = criteria[:security_group]
     return false unless rule[:user_id_group_pairs]
+
     rule[:user_id_group_pairs].any? { |group| query == group[:group_id] }
   end
 
   def validate_params(raw_params)
     recognized_params = check_resource_param_names(
       raw_params: raw_params,
-      allowed_params: [:id, :group_id, :group_name, :vpc_id],
+      allowed_params: %i{id group_id group_name vpc_id},
       allowed_scalar_name: :group_id,
       allowed_scalar_type: String
     )
@@ -233,13 +241,14 @@ class AwsSecurityGroup < Inspec.resource(1)
     if validated_params.empty?
       raise ArgumentError, "You must provide parameters to aws_security_group, such as group_name, group_id, or vpc_id.g_group."
     end
+
     validated_params
   end
 
   def count_sg_rules(ip_permissions)
     rule_count = 0
     ip_permissions.each do |ip_permission|
-      [:ip_ranges, :ipv_6_ranges, :user_id_group_pairs].each do |key|
+      %i{ip_ranges ipv_6_ranges user_id_group_pairs}.each do |key|
         if ip_permission.key? key
           rule_count += ip_permission[key].length
         end
@@ -253,16 +262,18 @@ class AwsSecurityGroup < Inspec.resource(1)
 
     # Transform into filter format expected by AWS
     filters = []
-    [
-      :description,
-      :group_id,
-      :group_name,
-      :vpc_id,
-    ].each do |criterion_name|
+    %i{
+      description
+      group_id
+      group_name
+      vpc_id
+    }.each do |criterion_name|
       instance_var = "@#{criterion_name}".to_sym
       next unless instance_variable_defined?(instance_var)
+
       val = instance_variable_get(instance_var)
       next if val.nil?
+
       filters.push(
         {
           name: criterion_name.to_s.tr("_", "-"),

data/lib/resources/aws/aws_security_groups.rb

@@ -42,6 +42,7 @@ class AwsSecurityGroups < Inspec.resource(1)
     unless raw_criteria.empty?
       raise ArgumentError, "aws_ec2_security_groups does not currently accept resource parameters."
     end
+
     raw_criteria
   end
 

data/lib/resources/aws/aws_sns_subscription.rb

@@ -20,7 +20,7 @@ class AwsSnsSubscription < Inspec.resource(1)
 
   include AwsSingularResourceMixin
   attr_reader :arn, :owner, :raw_message_delivery, :topic_arn, :endpoint, :protocol,
-              :confirmation_was_authenticated, :aws_response
+    :confirmation_was_authenticated, :aws_response
 
   alias confirmation_authenticated? confirmation_was_authenticated
   alias raw_message_delivery? raw_message_delivery

data/lib/resources/aws/aws_sns_topics.rb

@@ -18,6 +18,7 @@ class AwsSnsTopics < Inspec.resource(1)
     unless resource_params.empty?
       raise ArgumentError, "aws_sns_topics does not accept resource parameters."
     end
+
     resource_params
   end
 
@@ -30,6 +31,7 @@ class AwsSnsTopics < Inspec.resource(1)
         api_result = backend.list_topics(pagination_opts)
         @table += api_result.topics.map(&:to_h)
         break if api_result.next_token.nil?
+
         pagination_opts = { next_token: api_result.next_token }
       end
     end

data/lib/resources/aws/aws_subnet.rb

@@ -15,8 +15,8 @@ class AwsSubnet < Inspec.resource(1)
 
   include AwsSingularResourceMixin
   attr_reader :assigning_ipv_6_address_on_creation, :availability_zone, :available_ip_address_count,
-              :available, :cidr_block, :default_for_az, :ipv_6_cidr_block_association_set,
-              :mapping_public_ip_on_launch, :subnet_id, :vpc_id
+    :available, :cidr_block, :default_for_az, :ipv_6_cidr_block_association_set,
+    :mapping_public_ip_on_launch, :subnet_id, :vpc_id
   alias available? available
   alias default_for_az? default_for_az
   alias mapping_public_ip_on_launch? mapping_public_ip_on_launch

data/lib/resources/aws/aws_subnets.rb

@@ -21,6 +21,7 @@ class AwsSubnets < Inspec.resource(1)
     unless resource_params.empty?
       raise ArgumentError, "aws_vpc_subnets does not accept resource parameters."
     end
+
     resource_params
   end
 
@@ -33,9 +34,9 @@ class AwsSubnets < Inspec.resource(1)
   filter = FilterTable.create
   filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
   filter.register_column(:vpc_ids, field: :vpc_id)
-        .register_column(:subnet_ids, field: :subnet_id)
-        .register_column(:cidr_blocks, field: :cidr_block)
-        .register_column(:states, field: :state)
+    .register_column(:subnet_ids, field: :subnet_id)
+    .register_column(:cidr_blocks, field: :cidr_block)
+    .register_column(:states, field: :state)
   filter.install_filter_methods_on_resource(self, :table)
 
   def to_s

data/lib/resources/aws/aws_vpc.rb

@@ -20,7 +20,7 @@ class AwsVpc < Inspec.resource(1)
   end
 
   attr_reader :cidr_block, :dhcp_options_id, :instance_tenancy, :is_default,\
-              :state, :vpc_id
+    :state, :vpc_id
 
   alias default? is_default
 

data/lib/resources/aws/aws_vpcs.rb

@@ -18,10 +18,10 @@ class AwsVpcs < Inspec.resource(1)
   filter = FilterTable.create
   filter.register_custom_matcher(:exists?) { |x| !x.entries.empty? }
   filter.register_column(:cidr_blocks, field: :cidr_block)
-        .register_column(:vpc_ids, field: :vpc_id)
+    .register_column(:vpc_ids, field: :vpc_id)
   # We need a dummy here, so FilterTable will define and populate the dhcp_options_id field
   filter.register_column(:dummy, field: :dhcp_options_id)
-        .register_column(:dhcp_options_ids) { |obj| obj.entries.map(&:dhcp_options_id).uniq }
+    .register_column(:dhcp_options_ids) { |obj| obj.entries.map(&:dhcp_options_id).uniq }
   filter.install_filter_methods_on_resource(self, :table)
 
   def validate_params(raw_params)
@@ -29,6 +29,7 @@ class AwsVpcs < Inspec.resource(1)
     unless raw_params.empty?
       raise ArgumentError, "aws_vpcs does not accept resource parameters"
     end
+
     raw_params
   end
 

data/lib/resources/azure/azure_generic_resource.rb

@@ -32,10 +32,10 @@ module Inspec::Resources
     # Define the filter table so that it can be interrogated
     @filter = FilterTable.create
     @filter.register_filter_method(:contains)
-           .register_column(:type, field: "type")
-           .register_column(:name, field: "name")
-           .register_column(:location, field: "location")
-           .register_column(:properties, field: "properties")
+      .register_column(:type, field: "type")
+      .register_column(:name, field: "name")
+      .register_column(:location, field: "location")
+      .register_column(:properties, field: "properties")
 
     @filter.install_filter_methods_on_resource(self, :probes)
 

data/lib/resources/azure/azure_resource_group.rb

@@ -131,6 +131,7 @@ module Inspec::Resources
     # @private
     def create_has_methods
       return if failed_resource?
+
       # Create the has methods for each of the mappings
       # This is a quick test to show that the resource group has at least one of these things
       mapping.each do |name, type|