inspec 1.51.25 → 2.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 989b25f3c8ed378cf7ec3580045812b39866fb60
-  data.tar.gz: e84c1fc487dedd86208c9a0ff1802f05e416b4eb
+  metadata.gz: e7923a9284d909a94f986218ff9f89f5241b5952
+  data.tar.gz: e19fc206a4c814a51d24d56902b1a32b63c8a173
 SHA512:
-  metadata.gz: c5692520e23adfaccc539648a4a6a45574500a5f416d69d11fdf815cc2aeccd1022e48e4b6037818418c44429f2271bd7204250763eb66d8f8e2df024b50905e
-  data.tar.gz: 3ffa101802b8512979e14d6d9fd4578219caf589fdd4ee82704cfe78ff0c92bbaf36e1da988fe805111c48256d8d67f3d603da1eff37566a17cf1a1d78c16721
+  metadata.gz: 4e2cb5db850d22b7fba377bc6845e296fc5da8b22dd37b873dd6693a6fe564f2e84e2b2c20c5b8e041714972280ae74da02ff61703298b7a5647d39f48fd66dd
+  data.tar.gz: a71bab78912c612c454ddf3deb5d053bb5e3c61e1c4838594ba4d8d09feffd5813dd1f20e3cee90c38100717982f11ba3a8652d9b19a2974fdf215de6d9a1382

data/.rubocop.yml

@@ -8,7 +8,7 @@ AllCops:
   - 'examples/**/*'
   - 'vendor/**/*'
   - 'lib/bundles/inspec-init/templates/**/*'
-  - 'www/tutorial/**/*'
+  - 'www/demo/**/*'
 AlignParameters:
   Enabled: true
 BlockDelimiters:

data/CHANGELOG.md

@@ -1,39 +1,44 @@
 # Change Log
 <!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
-<!-- latest_release 1.51.25 -->
-## [v1.51.25](https://github.com/chef/inspec/tree/v1.51.25) (2018-05-10)
+<!-- latest_release 2.0.16 -->
+## [v2.0.16](https://github.com/chef/inspec/tree/v2.0.16) (2018-02-20)
 
 #### Merged Pull Requests
-- Backport ci verify scripts [#3038](https://github.com/chef/inspec/pull/3038) ([miah](https://github.com/miah))
+- HM Mobile IE [#2705](https://github.com/chef/inspec/pull/2705) ([hannah-radish](https://github.com/hannah-radish))
 <!-- latest_release -->
 
-<!-- release_rollup since=1.51.21 -->
-### Changes since 1.51.21 release
-
-#### Bug Fixes
-- Allow the depends key to be exposed in json profiles report 1.x [#3035](https://github.com/chef/inspec/pull/3035) ([jquick](https://github.com/jquick)) <!-- 1.51.24 -->
+<!-- release_rollup since=1.51.18 -->
+### Changes since 1.51.18 release
 
 #### Merged Pull Requests
-- Backport ci verify scripts [#3038](https://github.com/chef/inspec/pull/3038) ([miah](https://github.com/miah)) <!-- 1.51.25 -->
-- cmp should recognise a string being a negative int (#3007) [#3012](https://github.com/chef/inspec/pull/3012) ([james-stocks](https://github.com/james-stocks)) <!-- 1.51.23 -->
-- 1.x - Adjust version test to allow for inspec 2.x being available [#3015](https://github.com/chef/inspec/pull/3015) ([james-stocks](https://github.com/james-stocks)) <!-- 1.51.22 -->
+- HM Mobile IE [#2705](https://github.com/chef/inspec/pull/2705) ([hannah-radish](https://github.com/hannah-radish)) <!-- 2.0.16 -->
+- move /tutorial to /demo [#2700](https://github.com/chef/inspec/pull/2700) ([arlimus](https://github.com/arlimus)) <!-- 2.0.15 -->
+- HM website optimization [#2699](https://github.com/chef/inspec/pull/2699) ([hannah-radish](https://github.com/hannah-radish)) <!-- 2.0.14 -->
+- www: fix sidebar stickiness [#2698](https://github.com/chef/inspec/pull/2698) ([arlimus](https://github.com/arlimus)) <!-- 2.0.13 -->
+- Add correct `supports platform` to resources. [#2674](https://github.com/chef/inspec/pull/2674) ([miah](https://github.com/miah)) <!-- 2.0.12 -->
+- Fix legacy reporter output to file [#2667](https://github.com/chef/inspec/pull/2667) ([jquick](https://github.com/jquick)) <!-- 2.0.11 -->
+- Add example profiles for AWS/Azure [#2680](https://github.com/chef/inspec/pull/2680) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.10 -->
+- Revert download button [#2684](https://github.com/chef/inspec/pull/2684) ([hannah-radish](https://github.com/hannah-radish)) <!-- 2.0.9 -->
+- Hannah Review1 [#2683](https://github.com/chef/inspec/pull/2683) ([hannah-radish](https://github.com/hannah-radish)) <!-- 2.0.8 -->
+- Capture ArgumentErrors from aws. [#2673](https://github.com/chef/inspec/pull/2673) ([jquick](https://github.com/jquick)) <!-- 2.0.7 -->
+- Fix bundle exec calls [#2670](https://github.com/chef/inspec/pull/2670) ([jquick](https://github.com/jquick)) <!-- 2.0.6 -->
+- Fixes merge conflict messages [#2677](https://github.com/chef/inspec/pull/2677) ([kagarmoe](https://github.com/kagarmoe)) <!-- 2.0.5 -->
+- Add `Release:` to AWS `inspec detect` example [#2672](https://github.com/chef/inspec/pull/2672) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.0.4 -->
+- Remove duplicated encryption key test. [#2671](https://github.com/chef/inspec/pull/2671) ([juliandunn](https://github.com/juliandunn)) <!-- 2.0.3 -->
+- Prevent resources from loading if supports check fails [#2665](https://github.com/chef/inspec/pull/2665) ([jquick](https://github.com/jquick)) <!-- 2.0.2 -->
+- Add in release-2.0 changes to master [#2655](https://github.com/chef/inspec/pull/2655) ([jquick](https://github.com/jquick)) <!-- 2.0.1 -->
+- package resource: Fix Windows package detection [#2624](https://github.com/chef/inspec/pull/2624) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 1.51.20 -->
+- Fix the /private/var osx issue causing functional tests to fail [#2616](https://github.com/chef/inspec/pull/2616) ([jquick](https://github.com/jquick)) <!-- 1.51.19 -->
 <!-- release_rollup -->
 
 <!-- latest_stable_release -->
-## [v1.51.21](https://github.com/chef/inspec/tree/v1.51.21) (2018-02-20)
-
-#### Merged Pull Requests
-- Fix the /private/var osx issue causing functional tests to fail [#2616](https://github.com/chef/inspec/pull/2616) ([jquick](https://github.com/jquick))
-- package resource: Fix Windows package detection [#2624](https://github.com/chef/inspec/pull/2624) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
-- Fix legacy reporter output to file (inspec-v1.x) [#2689](https://github.com/chef/inspec/pull/2689) ([jquick](https://github.com/jquick))
-<!-- latest_stable_release -->
-
 ## [v1.51.18](https://github.com/chef/inspec/tree/v1.51.18) (2018-02-12)
 
 #### Merged Pull Requests
 - Force a default reporter for ad-hoc runners [#2610](https://github.com/chef/inspec/pull/2610) ([jquick](https://github.com/jquick))
 - Allow ad-hoc runners to use rspec formats. [#2621](https://github.com/chef/inspec/pull/2621) ([jquick](https://github.com/jquick))
 - Add json fields to schema and add tests. [#2618](https://github.com/chef/inspec/pull/2618) ([jquick](https://github.com/jquick))
+<!-- latest_stable_release -->
 
 ## [v1.51.15](https://github.com/chef/inspec/tree/v1.51.15) (2018-02-09)
 

data/Gemfile

@@ -8,6 +8,7 @@ if Gem::Version.new(RUBY_VERSION) < Gem::Version.new('2.2.2')
 end
 
 gem 'ffi', '>= 1.9.14'
+gem 'aws-sdk', '~> 2'
 
 group :test do
   gem 'bundler', '~> 1.5'
@@ -15,11 +16,12 @@ group :test do
   gem 'rake', '>= 10'
   gem 'rubocop', '= 0.49.1'
   gem 'simplecov', '~> 0.10'
-  gem 'concurrent-ruby', '~> 0.9'
+  gem 'concurrent-ruby', '~> 1.0'
   gem 'mocha', '~> 1.1'
   gem 'ruby-progressbar', '~> 1.8'
   gem 'webmock', '~> 2.3.2'
   gem 'jsonschema', '~> 2.0.2'
+  gem 'passgen'
   gem 'm'
 end
 

data/README.md

@@ -242,6 +242,18 @@ inspec exec test.rb --sudo [--sudo-password ...] [--sudo-options ...] [--sudo_co
 
 # run in a subshell
 inspec exec test.rb --shell [--shell-options ...] [--shell-command ...]
+
+# run a profile targeting AWS using env vars
+inspec exec test.rb -t aws://
+
+# or store your AWS credentials in your ~/.aws/credentials profiles file
+inspec exec test.rb -t aws://us-east-2/my-profile
+
+# run a profile targeting Azure using env vars
+inspec exec test.rb -t azure://
+
+# or store your Azure credentials in your ~/.azure/credentials profiles file
+inspec exec test.rb -t azure://subscription_id
 ```
 
 ### detect
@@ -322,6 +334,7 @@ You may also [browse the Supermarket for shared Compliance Profiles](https://sup
 
 InSpec is inspired by the wonderful [Serverspec](http://serverspec.org) project. Kudos to [mizzy](https://github.com/mizzy) and [all contributors](https://github.com/mizzy/serverspec/graphs/contributors)!
 
+The AWS resources were inspired by [inspec-aws](https://github.com/arothian/inspec-aws) from [arothian](https://github.com/arothian).
 
 ## Contribute
 
@@ -339,10 +352,11 @@ The InSpec community and maintainers are very active and helpful. This project b
 
 ## Testing InSpec
 
-We perform `unit` and `integration` tests.
+We offer `unit`, `integration`, and `aws` tests.
 
 - `unit` tests ensure the intended behaviour of the implementation
 - `integration` tests run against Docker-based VMs via test-kitchen and [kitchen-inspec](https://github.com/chef/kitchen-inspec)
+- `aws` tests exercise the AWS resources against real AWS accounts
 
 ### Unit tests
 
@@ -360,7 +374,6 @@ You may also run a single test within a file by line number:
 
 ```bash
 bundle exec m test/unit/resources/user_test.rb -l 123
-```
 
 ### Integration tests
 
@@ -396,14 +409,20 @@ You may test all instances in parallel with:
 bundle exec kitchen test -c
 ```
 
+### AWS Tests
+
+Use the rake task `bundle exec rake test:aws` to test the AWS resources against a pair of real AWS accounts.
+
+Please see TESTING_AGAINST_AWS.md for details on how to setup the needed AWS accounts to perform testing.
+
 ## License
 
 |  |  |
 | ------ | --- |
 | **Author:** | Dominik Richter (<drichter@chef.io>) |
 | **Author:** | Christoph Hartmann (<chartmann@chef.io>) |
-| **Copyright:** | Copyright (c) 2015 Chef Software Inc. |
 | **Copyright:** | Copyright (c) 2015 Vulcano Security GmbH. |
+| **Copyright:** | Copyright (c) 2017 Chef Software Inc. |
 | **License:** | Apache License, Version 2.0 |
 
 Licensed under the Apache License, Version 2.0 (the "License");

data/Rakefile

@@ -4,9 +4,16 @@
 require 'bundler'
 require 'bundler/gem_tasks'
 require 'rake/testtask'
+require 'passgen'
+require 'train'
 require_relative 'tasks/maintainers'
 require_relative 'tasks/spdx'
 
+def prompt(message)
+  print(message)
+  STDIN.gets.chomp
+end
+
 # The docs tasks rely on ruby-progressbar. If we can't load it, then don't
 # load the docs tasks. This is necessary to allow this Rakefile to work
 # when the "tests" gem group in the Gemfile has been excluded, such as
@@ -84,6 +91,116 @@ namespace :test do
 
     sh('sh', '-c', sh_cmd)
   end
+
+  project_dir = File.dirname(__FILE__)
+  namespace :aws do
+    ['default', 'minimal'].each do |account|
+      integration_dir = File.join(project_dir, 'test', 'aws', account)
+      attribute_file = File.join(integration_dir, '.attribute.yml')
+      
+      task :"setup:#{account}", :tf_workspace do |t, args|
+        tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+        abort("You must either call the top-level test:aws:#{account} task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
+        puts "----> Setup"
+        abort("You must set the environment variable AWS_REGION") unless ENV['AWS_REGION']
+        puts "----> Checking for required AWS profile..."
+        sh("aws configure get aws_access_key_id --profile inspec-aws-test-#{account} > /dev/null")
+        sh("cd #{integration_dir}/build/ && terraform init")
+        sh("cd #{integration_dir}/build/ && terraform workspace new #{tf_workspace}")
+        sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform plan")
+        sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform apply")
+        Rake::Task["test:aws:dump_attrs:#{account}"].execute
+      end
+      
+      task :"dump_attrs:#{account}" do
+        sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform output > #{attribute_file}")
+        raw_output = File.read(attribute_file)
+        yaml_output = raw_output.gsub(" = ", " : ")
+        File.open(attribute_file, "w") {|file| file.puts yaml_output}
+      end
+
+      task :"run:#{account}" do
+        puts "----> Run"
+        sh("bundle exec inspec exec #{integration_dir}/verify -t aws://${AWS_REGION}/inspec-aws-test-#{account} --attrs #{attribute_file}")
+      end
+      
+      task :"cleanup:#{account}", :tf_workspace do |t, args|
+        tf_workspace = args[:tf_workspace] || ENV['INSPEC_TERRAFORM_ENV']
+        abort("You must either call the top-level test:aws:#{account} task, or set the INSPEC_TERRAFORM_ENV variable.") unless tf_workspace
+        puts "----> Cleanup"
+        sh("cd #{integration_dir}/build/ && AWS_PROFILE=inspec-aws-test-#{account} terraform destroy -force")
+        sh("cd #{integration_dir}/build/ && terraform workspace select default")
+        sh("cd #{integration_dir}/build && terraform workspace delete #{tf_workspace}")
+      end
+      
+      task :"#{account}" do
+        tf_workspace = ENV['INSPEC_TERRAFORM_ENV'] || prompt("Please enter a workspace for your integration tests to run in: ")
+        begin
+          Rake::Task["test:aws:setup:#{account}"].execute({:tf_workspace => tf_workspace})
+          Rake::Task["test:aws:run:#{account}"].execute
+        rescue
+          abort("Integration testing has failed for the #{account} account")
+        ensure
+          Rake::Task["test:aws:cleanup:#{account}"].execute({:tf_workspace => tf_workspace})
+        end
+      end
+    end
+  end
+  desc "Perform AWS Integration Tests"
+  task aws: [:'aws:default', :'aws:minimal']
+
+  namespace :azure do
+    # Specify the directory for the integration tests
+    integration_dir = 'test/azure'
+
+
+    task :init_workspace do
+      # Initialize terraform workspace
+      sh("cd #{integration_dir}/build/ && terraform init")
+    end
+
+    task :setup_integration_tests do
+      puts '----> Setup'
+      creds = Train.create('azure').connection.connect
+
+      # Determine the storage account name and the admin password
+      sa_name = (0...15).map { (65 + rand(26)).chr }.join.downcase
+      admin_password = Passgen::generate(length: 12, uppercase: true, lowercase: true, symbols: true, digits: true)
+
+      # Use the first 4 characters of the storage account to create a suffix
+      suffix = sa_name[0..3]
+
+      # Create the plan that can be applied to Azure
+      cmd = format("cd %s/build/ && terraform plan -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'storage_account_name=%s' -var 'admin_password=%s' -var 'suffix=%s' -out inspec-azure.plan", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id], sa_name, admin_password, suffix)
+      sh(cmd)
+
+      # Apply the plan on Azure
+      cmd = format("cd %s/build/ && terraform apply inspec-azure.plan", integration_dir)
+      sh(cmd)
+    end
+
+    task :run_integration_tests do
+      puts '----> Run'
+      sh("bundle exec inspec exec #{integration_dir}/verify -t azure://1e0b427a-d58b-494e-ae4f-ee558463ebbf")
+    end
+
+    task :cleanup_integration_tests do
+      puts '----> Cleanup'
+      creds = Train.create('azure').connection.connect
+
+      cmd = format("cd %s/build/ && terraform destroy -force -var 'subscription_id=%s' -var 'client_id=%s' -var 'client_secret=%s' -var 'tenant_id=%s' -var 'admin_password=dummy' -var 'storage_account_name=dummy' -var 'suffix=dummy'", integration_dir, creds[:subscription_id], creds[:client_id], creds[:client_secret], creds[:tenant_id])
+      sh(cmd)
+    end
+  end
+
+  desc "Perform Azure Integration Tests"
+  task :azure do
+    Rake::Task['test:azure:init_workspace'].execute
+    Rake::Task['test:azure:cleanup_integration_tests'].execute
+    Rake::Task['test:azure:setup_integration_tests'].execute
+    Rake::Task['test:azure:run_integration_tests'].execute
+    Rake::Task['test:azure:cleanup_integration_tests'].execute
+  end
 end
 
 # Print the current version of this gem or update it.

data/docs/platforms.md

@@ -0,0 +1,119 @@
+# Using InSpec 2.0 on Cloud Platforms
+
+We are pleased to announce that with this release of InSpec 2.0, we have expanded our platform support beyond individual machines and now include support for select AWS and Azure resources.
+
+With InSpec 2.0, you may now use several InSpec resources to audit properties of your cloud infrastructure - for example, an Amazon Web Services S3 bucket.
+
+<br>
+
+## AWS Platform Support in InSpec 2.0
+
+### Setting up AWS credentials for InSpec
+
+InSpec uses the standard AWS authentication mechanisms. Typically, you will create an IAM user specifically for auditing activities.
+
+* 1 Create an IAM user in the AWS console, with your choice of username. Check the box marked "Programmatic Access."
+* 2 On the Permissions screen, choose Direct Attach. Select the AWS-managed IAM Profile named "ReadOnlyAccess." If you wish to restrict the user further, you may do so; see individual InSpec resources to identify which permissions are required.
+* 3 After generating the key, record the Access Key ID and Secret Key.
+
+#### Using Environment Variables to provide credentials
+
+You may provide the credentials to InSpec by setting the following environment variables: `AWS_REGION`, `AWS_ACCESS_KEY_ID`, and `AWS_SECRET_KEY_ID`. You may also use `AWS_PROFILE`, or if you are using MFA, `AWS_SESSION_TOKEN`. See the [AWS Command Line Interface Docs](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) for details.
+
+Once you have your environment variables set, you can verify your credentials by running:
+
+```bash
+you$ inspec detect -t aws://
+
+== Platform Details
+Name:      aws
+Families:  cloud, api
+Release:   aws-sdk-v2.10.125
+```
+
+#### Using the InSpec target option to provide credentials on AWS
+
+Look for a file in your home directory named `~/.aws/credentials`. If it does not exist, create it. Choose a name for your profile; here, we're using the name 'auditing'. Add your credentials as a new profile, in INI format:
+
+```bash
+[auditing]
+aws_access_key_id = AKIA....
+aws_secret_access_key = 1234....abcd
+```
+
+You may now run InSpec using the `--target` / `-t` option, using the format `-t aws://region/profile`.  For example, to connect to the Ohio region using a profile named 'auditing', use `-t aws://us-east-2/auditing`.
+
+To verify your credentials,
+
+```bash
+you$ inspec detect -t aws://
+
+== Platform Details
+Name:      aws
+Families:  cloud, api
+Release:   aws-sdk-v2.10.125
+```
+
+<br>
+
+## Azure Platform Support in InSpec 2.0
+
+### Setting up Azure credentials for InSpec
+
+To use InSpec Azure resources, you will need to create a Service Principal Name (SPN) for auditing an Azure subscription.
+
+This can be done on the command line or from the Azure Portal:
+
+* [Azure CLI](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal-cli)
+* [PowerShell](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal)
+* [Azure Portal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal)
+
+The information from the SPN can be specified either in the file `~/.azure/credentials`, as environment variables, or by using InSpec target URIs.
+
+#### Setting up the Azure Credentials File
+
+By default InSpec is configured to look at ~/.azure/credentials, and it should contain:
+
+```powershell
+[<SUBSCRIPTION_ID>]
+client_id = "<CLIENT_ID>"
+client_secret = "<CLIENT_SECRET>"
+tenant_id = "<TENANT_ID>"
+```
+
+NOTE: In the Azure web portal, these values are labeled differently:
+* The client_id is referred to as the 'Application ID'
+* The client_secret is referred to as the 'Key (Password Type)'
+* The tenant_id is referred to as the 'Directory ID'
+
+With the credentials are in place you may now execute InSpec:
+
+```bash
+inspec exec my-inspec-profile -t azure://
+```
+
+#### Using Environment variables to provide credentials
+
+You may also set the Azure credentials via environment variables:
+
+* `AZURE_SUBSCRIPTION_ID`
+* `AZURE_CLIENT_ID`
+* `AZURE_CLIENT_SECRET`
+* `AZURE_TENANT_ID`
+
+For example:
+
+```bash
+AZURE_SUBSCRIPTION_ID="2fbdbb02-df2e-11e6-bf01-fe55135034f3" \
+AZURE_CLIENT_ID="58dc4f6c-df2e-11e6-bf01-fe55135034f3" \
+AZURE_CLIENT_SECRET="Jibr4iwwaaZwBb6W" \
+AZURE_TENANT_ID="6ad89b58-df2e-11e6-bf01-fe55135034f3" inspec exec my-profile -t azure://
+```
+
+#### Using the InSpec target option to provide credentials on Azure
+
+If you have created a `~/.azure/credentials` file as above, you may also use the InSpec command line `--target` / `-t` option to select a subscription ID.  For example:
+
+```bash
+inspec exec my-profile -t azure://2fbdbb02-df2e-11e6-bf01-fe55135034f3
+```