sport_ngin_aws_auditor 3.11.3 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8d0f76d7c93a5ec23dfbc04f861ea9f1bae8e32a
-  data.tar.gz: 5f9f2299fc81a61bcffe6d5e15a22d167a880de7
+  metadata.gz: 426f863fd847de5399249f6e81575fcdef99ae29
+  data.tar.gz: 8ad69c1ef79d4e0b3b92c59264655c28b719c001
 SHA512:
-  metadata.gz: be355e56498bb4b5d63b3f4031f7b5b3b947b0c555410edd1d5ec133c4fdb01b345f8465da37d3fcd6e76b39818fa5a997f244d8ba796c6a0f41769501f2452c
-  data.tar.gz: 6b1013de4972e1bfadbe884606f897a1ed8afbebae32069188da0782b152893bdc14e7282ee05dd75edf56e693aa0e3714c4e1f235e20c6c9ac0804d3d5f4ec3
+  metadata.gz: 52a07a51a83b4229dc3df8ce7bac6685f0b19b369ea01f100a637ae35876c06e2b4a1044a69f4d15bf7913c6114519db72144a420790bf8efa32a396cdb5a81b
+  data.tar.gz: bb2bbf9806d201085f611f18c6cff3439b71dcb32a6397d2bb8a059a6fca3925442b2aa522d0f1f5f74b81b3f96ee36e93207ee233648c33e70cb6a53160fa0a

data/.travis.yml

@@ -6,6 +6,6 @@ branches:
 
 language: ruby
 rvm:
-  - 2.2
+  - 2.2.5
 cache: bundler
 script: bundle exec rspec

data/CHANGELOG.markdown

@@ -1,122 +0,0 @@
-#### v3.11.3
-* Missed this bug because I did not test previous bug's fix in Slack
-
-  > Emma Sax: Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/30
-
-#### v3.11.2
-* We actually do not want to cache the counts of instances and reserved instances between multiple runs
-
-  > Emma Sax: Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/29
-
-#### v3.11.1
-* Must merge this PR in to run the audit command correctly
-
-  > Emma Sax: Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/28
-
-#### v3.11.0
-* Automatically ignore instances based on a regex string
-
-  > Emma Sax: Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/26
-
-#### v3.10.1
-* Caching should not affect RI counts between runs
-
-  > Emma Sax: Andy Fleener, Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/25
-
-#### v3.10.0
-* Handling region-based RIs
-
-  > Emma Sax: Andy Fleener, Luke Ludwig, Tim Sandquist, Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/21
-
-#### v3.9.0
-* Add the ability to pass config data in as a flag
-
-  > Emma Sax: Andy Fleener, Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/24
-
-#### v3.8.3
-* Fixing bugs with outputs and counts
-
-  > Emma Sax: Tim Sandquist, Unknown User: https://github.com/sportngin/sport_ngin_aws_auditor/pull/23
-
-#### v3.8.2
-* Fixing bugs so that counts are accurate again
-
-  > Emma Sax: : https://github.com/sportngin/sport_ngin_aws_auditor/pull/20
-
-#### v3.8.1
-#### v3.8.0
-* Clarifying printout of audit command
-
-  > Emma Sax: : https://github.com/sportngin/sport_ngin_aws_auditor/pull/18
-
-#### v3.7.0
-* Print retired tags into slack/terminal on audit
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/sport_ngin_aws_auditor/pull/17
-
-#### v3.6.0
-* Print reserved instances that have retired in past week
-
-  > Emma Sax: Andy Fleener: https://github.com/sportngin/sport_ngin_aws_auditor/pull/16
-
-#### v3.5.0
-* Cleaning up slack printouts with the audit command
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/sport_ngin_aws_auditor/pull/15
-
-#### v3.4.1
-#### v3.4.0
-* Add other RDS engine types
-
-  > matl33t: Emma Sax, Brian Bergstrom: https://github.com/sportngin/sport_ngin_aws_auditor/pull/11
-
-#### v3.3.1
-* Fixing bug where Slack will print discrepancies if there are *only* tagged instances
-
-  > Emma Sax: : https://github.com/sportngin/sport_ngin_aws_auditor/pull/13
-
-#### v3.3.0
-* Slack should print instances that have tags
-
-  > Emma Sax: Andy Fleener: https://github.com/sportngin/sport_ngin_aws_auditor/pull/12
-
-#### v3.2.0
-* Proper recognition of windows/linux/vpc instances
-
-  > Emma Sax: Andy Fleener: https://github.com/sportngin/sport_ngin_aws_auditor/pull/8
-
-#### v3.1.2
-#### v3.1.0
-* Authentication with AWS roles instead of credentials file
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/sport_ngin_aws_auditor/pull/7
-
-#### v3.0.2
-#### v3.0.1
-#### v3.0.0
-* Rename gem directories and modules
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/sport_ngin_aws_auditor/pull/6
-
-#### v2.1.0
-* Adding option to print audit results to Slack channel
-
-  > Emma Sax, Matt Krieger: Brian Bergstrom: https://github.com/sportngin/aws_auditor/pull/4
-
-* Adding option to print audit results to Slack channel
-
-  > Emma Sax, Matt Krieger: Brian Bergstrom: https://github.com/sportngin/aws_auditor/pull/4
-
-#### v2.0.0
-* Adding enhancements for taking no-reserved-instance tag into consideration during audit
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/aws_auditor/pull/2
-
-#### v1.0.0
-* Upgrading aws-sdk version from v1 to v2
-
-  > Emma Sax: Brian Bergstrom: https://github.com/sportngin/aws_auditor/pull/3
-
-* First tests, Travis CI, MFA support, and fog file compatibility
-
-  > Brian Bergstrom: Emma Sax: https://github.com/sportngin/aws_auditor/pull/1

data/bin/sport-ngin-aws-auditor

@@ -11,7 +11,15 @@ version SportNginAwsAuditor::VERSION
 wrap_help_text :verbatim
 
 flag [:config], :desc => 'SportNginAwsAuditor config file path', :default_value => SportNginAwsAuditor::DefaultPaths.config
+flag [:display], :desc => 'The name that should be printed in the output'
 switch [:aws_roles], :desc => 'Use AWS roles instead of an ~/.aws/credentials file'
+switch [:assume_roles], :desc => 'Assume roles to audit cross accounts; should have roles/policies already set up'
+flag [:role_name], :desc => 'The name of the role that is giving cross account access', :default_value => 'CrossAccountAuditorAccess'
+flag [:arn_id], :desc => 'The identifying digits of the AWS arn if using assume_roles;
+                          should be the numerical part of the example:
+                          arn:aws:iam::999999999999:role/#{role_name}'
+flag [:region], :desc => 'The region(s) the audit should occur in; if no region is specified, then the auditor will be run in every
+                          U.S. region. To run multiple regions, the input should be a string like: us-east-1, us-east-2'
 
 program_long_desc """
 DOCUMENTATION

data/lib/sport_ngin_aws_auditor/audit_data.rb

@@ -1,14 +1,27 @@
 require_relative './instance_helper'
+require_relative './convenience_wrappers'
 
 module SportNginAwsAuditor
   class AuditData
+    extend EC2Wrapper
+    extend RDSWrapper
+    extend CacheWrapper
 
-    attr_accessor :data, :retired_tags, :retired_ris, :selected_audit_type, :klass, :tag_name, :region, :ignore_instances_regexes
-    def initialize(instances, reserved, class_type, tag_name, ignore_instances_regexes)
-      self.selected_audit_type = (!instances && !reserved) ? "all" : (instances ? "instances" : "reserved")
-      self.klass = SportNginAwsAuditor.const_get(class_type)
-      self.tag_name = tag_name
-      self.ignore_instances_regexes = ignore_instances_regexes
+    attr_accessor :data, :retired_tags, :retired_ris, :selected_audit_type, :klass, :tag_name, :region, :ignore_instances_regexes, :client
+    def initialize(info)
+      self.selected_audit_type = (!info[:instances] && !info[:reserved]) ? "all" : (info[:instances] ? "instances" : "reserved")
+      self.klass = SportNginAwsAuditor.const_get(info[:class])
+      self.tag_name = info[:tag_name]
+      self.ignore_instances_regexes = info[:regexes]
+      self.region = info[:region].match(/(\w{2}-\w{4,})/)[0] if info[:region].match(/(\w{2}-\w{4,})/)
+      
+      if info[:class] == "EC2Instance"
+        self.client = EC2Wrapper.ec2(info[:region])
+      elsif info[:class] == "RDSInstance"
+        self.client = RDSWrapper.rds(info[:region])
+      elsif info[:class] == "CacheInstance"
+        self.client = CacheWrapper.cache(info[:region])
+      end
     end
 
     def instances?
@@ -28,7 +41,7 @@ module SportNginAwsAuditor
         instance_hash, retired_tags = gather_instances_data
         retired_ris = nil
       elsif reserved?
-        instance_hash = self.klass.instance_count_hash(self.klass.get_reserved_instances)
+        instance_hash = self.klass.instance_count_hash(self.klass.get_reserved_instances(self.client))
         retired_tags, retired_ris = nil
       elsif all?
         instance_hash, retired_tags, retired_ris = gather_all_data
@@ -45,8 +58,7 @@ module SportNginAwsAuditor
     end
 
     def gather_instances_data
-      instances = self.klass.get_instances(tag_name)
-      gather_region(instances)
+      instances = self.klass.get_instances(self.client, tag_name)
       retired_tags = self.klass.get_retired_tags(instances)
       instances_with_tag = self.klass.filter_instances_with_tags(instances)
       instances_without_tag = self.klass.filter_instances_without_tags(instances)
@@ -57,23 +69,12 @@ module SportNginAwsAuditor
     end
 
     def gather_all_data
-      instances = self.klass.get_instances(tag_name)
-      gather_region(instances)
+      instances = self.klass.get_instances(self.client, tag_name)
       retired_tags = self.klass.get_retired_tags(instances)
-      instance_hash = self.klass.compare(instances, ignore_instances_regexes)
-      retired_ris = self.klass.get_recent_retired_reserved_instances
+      instance_hash = self.klass.compare(instances, ignore_instances_regexes, self.client)
+      retired_ris = self.klass.get_recent_retired_reserved_instances(self.client)
 
       return instance_hash, retired_tags, retired_ris
     end
-
-    def gather_region(instances)
-      if self.klass == SportNginAwsAuditor::EC2Instance
-        # if instances.first.availability_zone = 'us-east-1a'...
-        match = instances.first.availability_zone.match(/(\w{2}-\w{4,})/)
-
-        # then region = 'us-east'
-        self.region = match[0] unless match.nil?
-      end
-    end
   end
 end

data/lib/sport_ngin_aws_auditor/aws.rb

@@ -8,29 +8,42 @@ module SportNginAwsAuditor
   end
 
   class AWSSDK
-    def self.authenticate(environment)
+    def self.authenticate_with_iam(environment)
       shared_credentials = Aws::SharedCredentials.new(profile_name: environment)
-      Aws.config.update({region: 'us-east-1', credentials: shared_credentials})
-
+      update_aws_config({region: 'us-east-1', credentials: shared_credentials})
       iam = Aws::IAM::Client.new
 
-       # this will be an array of 0 or 1 because iam.list_mfa_devices.mfa_devices will only return 0 or 1 device per user;
-       # if user doesn't have MFA enabled, then this loop won't even execute
+      # this will be an array of 0 or 1 because iam.list_mfa_devices.mfa_devices will only return 0 or 1 device per user;
+      # if user doesn't have MFA enabled, then this loop won't even execute
       iam.list_mfa_devices.mfa_devices.each do |mfadevice|
-        mfa_serial_number = mfadevice.serial_number
-        mfa_token = Output.ask("Enter MFA token: "){ |q|  q.validate = /^\d{6}$/ }
-        session_credentials_hash = get_session(mfa_token,
-                                               mfa_serial_number,
-                                               shared_credentials.credentials.access_key_id,
-                                               shared_credentials.credentials.secret_access_key).credentials
-
-        session_credentials = Aws::Credentials.new(session_credentials_hash.access_key_id,
-                                                   session_credentials_hash.secret_access_key,
-                                                   session_credentials_hash.session_token)
-        Aws.config.update({region: 'us-east-1', credentials: session_credentials})
+        authenticate_with_mfa(mfadevice, shared_credentials)
       end
     end
 
+    def self.authenticate_with_mfa(mfadevice, shared_credentials)
+      mfa_serial_number = mfadevice.serial_number
+      mfa_token = Output.ask("Enter MFA token: "){ |q|  q.validate = /^\d{6}$/ }
+      session_credentials_hash = get_session(mfa_token,
+                                             mfa_serial_number,
+                                             shared_credentials.credentials.access_key_id,
+                                             shared_credentials.credentials.secret_access_key).credentials
+
+      session_credentials = Aws::Credentials.new(session_credentials_hash.access_key_id,
+                                                 session_credentials_hash.secret_access_key,
+                                                 session_credentials_hash.session_token)
+      update_aws_config({region: 'us-east-1', credentials: session_credentials})
+    end
+
+    def self.authenticate_with_assumed_roles(environment, arn_id, role_name, sts_client)
+      role_arn = "arn:aws:iam::#{arn_id}:role/#{role_name}"
+      session_name = "auditor#{Time.now.to_i}"
+      assumed_role_credentials = Aws::AssumeRoleCredentials.new(client: sts_client,
+                                                                role_arn: role_arn,
+                                                                role_session_name: session_name)
+      update_aws_config({region: 'us-east-1', credentials: assumed_role_credentials})
+      return assumed_role_credentials
+    end
+
     def self.get_session(mfa_token, mfa_serial_number, access_key_id, secret_access_key)
       return @session if @session
       sts = Aws::STS::Client.new(access_key_id: access_key_id,
@@ -39,10 +52,10 @@ module SportNginAwsAuditor
       @session = sts.get_session_token(duration_seconds: 3600,
                                        serial_number: mfa_serial_number,
                                        token_code: mfa_token)
-    end
+    end    
 
-    def self.authenticate_with_roles(environment)
-        Aws.config.update({region: 'us-east-1'})
+    def self.update_aws_config(options)
+        Aws.config.update(options)
     end
   end
 end

data/lib/sport_ngin_aws_auditor/cache_instance.rb

@@ -7,23 +7,23 @@ module SportNginAwsAuditor
     extend AWSWrapper
 
     class << self
-      def get_instances(tag_name=nil)
+      def get_instances(client, tag_name=nil)
         account_id = get_account_id
-        cache.describe_cache_clusters.cache_clusters.map do |instance|
+        client.describe_cache_clusters.cache_clusters.map do |instance|
           next unless instance.cache_cluster_status.to_s == 'available'
-          new(instance, account_id, tag_name, cache)
+          new(instance, account_id, tag_name, client)
         end.compact
       end
 
-      def get_reserved_instances
-        cache.describe_reserved_cache_nodes.reserved_cache_nodes.map do |instance|
+      def get_reserved_instances(client)
+        client.describe_reserved_cache_nodes.reserved_cache_nodes.map do |instance|
           next unless instance.state.to_s == 'active'
           new(instance)
         end.compact
       end
 
-      def get_retired_reserved_instances
-        cache.describe_reserved_cache_nodes.reserved_cache_nodes.map do |instance|
+      def get_retired_reserved_instances(client)
+        client.describe_reserved_cache_nodes.reserved_cache_nodes.map do |instance|
           next unless instance.state == 'retired'
           new(instance)
         end.compact
@@ -31,7 +31,7 @@ module SportNginAwsAuditor
     end
 
     attr_accessor :id, :name, :instance_type, :scope, :engine, :count, :tag_value, :tag_reason, :expiration_date, :availability_zone
-    def initialize(cache_instance, account_id=nil, tag_name=nil, cache=nil)
+    def initialize(cache_instance, account_id=nil, tag_name=nil, client=nil)
       if cache_instance.class.to_s == "Aws::ElastiCache::Types::ReservedCacheNode"
         self.id = cache_instance.reserved_cache_node_id
         self.name = cache_instance.reserved_cache_node_id
@@ -56,7 +56,7 @@ module SportNginAwsAuditor
           arn = "arn:aws:elasticache:#{region}:#{account_id}:cluster:#{self.id}"
 
           # go through to see if the tag we're looking for is one of them
-          cache.list_tags_for_resource(resource_name: arn).tag_list.each do |tag|
+          client.list_tags_for_resource(resource_name: arn).tag_list.each do |tag|
             if tag.key == tag_name
               self.tag_value = tag.value
             elsif tag.key == 'no-reserved-instance-reason'

data/lib/sport_ngin_aws_auditor/convenience_wrappers.rb

@@ -1,30 +1,48 @@
 require_relative './aws'
+require 'aws-sdk'
 require_relative './google'
 
 module SportNginAwsAuditor
-  attr_accessor :creds
+  attr_accessor :assume_role_creds
 
   module AWSWrapper
-    attr_accessor :aws, :account_id
-
-    def aws(environment, roles)
-      if roles
-        SportNginAwsAuditor::AWSSDK.authenticate_with_roles(environment)
+    def aws(environment, global_options)
+      if global_options[:aws_roles]
+        SportNginAwsAuditor::AWSSDK.update_aws_config({region: 'us-east-1'})
+      elsif global_options[:assume_roles]
+        @assume_role_creds = SportNginAwsAuditor::AWSSDK.authenticate_with_assumed_roles(environment,
+                                                                                         global_options[:arn_id],
+                                                                                         global_options[:role_name],
+                                                                                         get_sts_client(environment))
       else
-        SportNginAwsAuditor::AWSSDK.authenticate(environment)
+        SportNginAwsAuditor::AWSSDK.authenticate_with_iam(environment)
       end
     end
 
     def get_account_id
-      @account_id ||= Aws::STS::Client.new.get_caller_identity.account
+      Aws::STS::Client.new.get_caller_identity.account
+    end
+
+    def get_sts_client(environment)
+      @sts_client ||= Aws::STS::Client.new(profile: environment, region: 'us-east-1')
+    end
+
+    def reset_credentials
+      SportNginAwsAuditor::AWSSDK.update_aws_config({credentials: Aws::InstanceProfileCredentials.new})
     end
   end
 
   module EC2Wrapper
-    attr_accessor :ec2
-
-    def ec2
-      @ec2 ||= Aws::EC2::Client.new
+    def self.ec2(region=nil)
+      if @assume_role_creds && region 
+        @ec2 = Aws::EC2::Client.new(credentials: @assume_role_creds, region: region)
+      elsif @assume_role_creds && !region
+        @ec2 = Aws::EC2::Client.new(credentials: @assume_role_creds)
+      elsif @assume_role_creds.nil? && region
+        @ec2 = Aws::EC2::Client.new(region: region)
+      else
+        @ec2 = Aws::EC2::Client.new
+      end
     end
   end
 
@@ -32,23 +50,40 @@ module SportNginAwsAuditor
     attr_accessor :opsworks
 
     def opsworks
-      @opsworks ||= Aws::OpsWorks::Client.new
+      return @opsworks if @opsworks
+      if @assume_role_creds
+        @opsworks = Aws::Opsworks::Client.new(credentials: @assume_role_creds)
+      else
+        @opsworks = Aws::OpsWorks::Client.new
+      end
     end
   end
 
   module RDSWrapper
-    attr_accessor :rds
-
-    def rds
-      @rds ||= Aws::RDS::Client.new
+    def self.rds(region=nil)
+      if @assume_role_creds && region
+        @rds = Aws::RDS::Client.new(credentials: @assume_role_creds, region: region)
+      elsif @assume_role_creds && !region
+        @rds = Aws::RDS::Client.new(credentials: @assume_role_creds)
+      elsif @assume_role_creds.nil? && region
+        @rds = Aws::RDS::Client.new(region: region)
+      else
+        @rds = Aws::RDS::Client.new
+      end
     end
   end
     
   module CacheWrapper
-    attr_accessor :cache
-
-    def cache
-      @cache ||= Aws::ElastiCache::Client.new
+    def self.cache(region=nil)
+      if @assume_role_creds && region
+        @cache = Aws::ElastiCache::Client.new(credentials: @assume_role_creds, region: region)
+      elsif @assume_role_creds && !region
+        @cache = Aws::ElastiCache::Client.new(credentials: @assume_role_creds)
+      elsif @assume_role_creds.nil? && region
+        @cache = Aws::ElastiCache::Client.new(region: region)
+      else
+        @cache = Aws::ElastiCache::Client.new
+      end
     end
   end
 

data/lib/sport_ngin_aws_auditor/ec2_instance.rb

@@ -6,33 +6,33 @@ module SportNginAwsAuditor
     extend EC2Wrapper
 
     class << self
-      def get_instances(tag_name=nil)
-        instances = ec2.describe_instances.reservations.map do |reservation|
+      def get_instances(client, tag_name=nil)
+        instances = client.describe_instances.reservations.map do |reservation|
           reservation.instances.map do |instance|
             next unless instance.state.name == 'running'
             new(instance, tag_name)
           end.compact
         end.flatten.compact
-        get_more_info(instances)
+        get_more_info(instances, client)
       end
 
-      def get_reserved_instances
-        ec2.describe_reserved_instances.reserved_instances.map do |instance|
+      def get_reserved_instances(client)
+        client.describe_reserved_instances.reserved_instances.map do |instance|
           next unless instance.state == 'active'
           new(instance, nil, instance.instance_count)
         end.compact
       end
 
-      def get_retired_reserved_instances
-        ec2.describe_reserved_instances.reserved_instances.map do |instance|
+      def get_retired_reserved_instances(client)
+        client.describe_reserved_instances.reserved_instances.map do |instance|
           next unless instance.state == 'retired'
           new(instance, nil, instance.instance_count)
         end.compact
       end
 
-      def bucketize
+      def bucketize(client)
         buckets = {}
-        get_instances.map do |instance|
+        get_instances(client).map do |instance|
           name = instance.stack_name || instance.name
           if name
             buckets[name] = [] unless buckets.has_key? name
@@ -44,9 +44,9 @@ module SportNginAwsAuditor
         buckets.sort_by{|k,v| k }
       end
 
-      def get_more_info(instances)
+      def get_more_info(instances, client)
         instances.each do |instance|
-          tags = ec2.describe_tags(:filters => [{:name => "resource-id", :values => [instance.id]}]).tags
+          tags = client.describe_tags(:filters => [{:name => "resource-id", :values => [instance.id]}]).tags
           tags = Hash[tags.map { |tag| [tag[:key], tag[:value]]}.compact]
           instance.name = tags["Name"]
           instance.stack_name = tags["opsworks:stack"]

data/lib/sport_ngin_aws_auditor/instance_helper.rb

@@ -4,12 +4,12 @@ require_relative './audit_data'
 module SportNginAwsAuditor
   module InstanceHelper
 
-    def instance_hash
-      Hash[get_instances.map { |instance| instance.nil? ? next : [instance.id, instance]}.compact]
+    def instance_hash(client)
+      Hash[get_instances(client).map { |instance| instance.nil? ? next : [instance.id, instance]}.compact]
     end
 
-    def reserved_instance_hash
-      Hash[get_reserved_instances.map { |instance| instance.nil? ? next : [instance.id, instance]}.compact]
+    def reserved_instance_hash(client)
+      Hash[get_reserved_instances(client).map { |instance| instance.nil? ? next : [instance.id, instance]}.compact]
     end
 
     #################### ADDING DATA TO HASH ####################
@@ -102,8 +102,8 @@ module SportNginAwsAuditor
       return ignored_instances, instances_with_tag, instance_hash
     end
 
-    def sort_through_RIs
-      ris = get_reserved_instances
+    def sort_through_RIs(client)
+      ris = get_reserved_instances(client)
       ris_availability = filter_ris_availability_zone(ris)
       ris_region = filter_ris_region_based(ris)
       ris_hash = instance_count_hash(ris_availability)
@@ -127,9 +127,9 @@ module SportNginAwsAuditor
       return differences
     end
 
-    def compare(instances, ignore_instances_regexes)
+    def compare(instances, ignore_instances_regexes, client)
       ignored_instances, instances_with_tag, instance_hash = sort_through_instances(instances, ignore_instances_regexes)
-      ris_region, ris_hash = sort_through_RIs
+      ris_region, ris_hash = sort_through_RIs(client)
       differences = measure_differences(instance_hash, ris_hash)
       add_additional_data(ris_region, instances_with_tag, ignored_instances, differences)
       differences
@@ -177,8 +177,8 @@ module SportNginAwsAuditor
 
     # this gets all retired reserved instances and filters out only the ones that have expired
     # within the past week
-    def get_recent_retired_reserved_instances
-      get_retired_reserved_instances.select do |ri|
+    def get_recent_retired_reserved_instances(client)
+      get_retired_reserved_instances(client).select do |ri|
         ri.expiration_date > (Time.now - 604800)
       end
     end

data/lib/sport_ngin_aws_auditor/rds_instance.rb

@@ -7,23 +7,23 @@ module SportNginAwsAuditor
     extend AWSWrapper
 
     class << self
-      def get_instances(tag_name=nil)
+      def get_instances(client, tag_name=nil)
         account_id = get_account_id
-        rds.describe_db_instances.db_instances.map do |instance|
+        client.describe_db_instances.db_instances.map do |instance|
           next unless instance.db_instance_status.to_s == 'available'
-          new(instance, account_id, tag_name, rds)
+          new(instance, account_id, tag_name, client)
         end.compact
       end
 
-      def get_reserved_instances
-        rds.describe_reserved_db_instances.reserved_db_instances.map do |instance|
+      def get_reserved_instances(client)
+        client.describe_reserved_db_instances.reserved_db_instances.map do |instance|
           next unless instance.state.to_s == 'active'
           new(instance)
         end.compact
       end
 
-      def get_retired_reserved_instances
-        rds.describe_reserved_db_instances.reserved_db_instances.map do |instance|
+      def get_retired_reserved_instances(client)
+        client.describe_reserved_db_instances.reserved_db_instances.map do |instance|
           next unless instance.state == 'retired'
           new(instance)
         end.compact
@@ -31,7 +31,7 @@ module SportNginAwsAuditor
     end
 
     attr_accessor :id, :name, :multi_az, :scope, :instance_type, :engine, :count, :tag_value, :tag_reason, :expiration_date
-    def initialize(rds_instance, account_id=nil, tag_name=nil, rds=nil)
+    def initialize(rds_instance, account_id=nil, tag_name=nil, client=nil)
       if rds_instance.class.to_s == "Aws::RDS::Types::ReservedDBInstance"
         self.id = rds_instance.reserved_db_instances_offering_id
         self.scope = nil
@@ -55,7 +55,7 @@ module SportNginAwsAuditor
           arn = "arn:aws:rds:#{region}:#{account_id}:db:#{self.id}"
 
            # go through to see if the tag we're looking for is one of them
-          rds.list_tags_for_resource(resource_name: arn).tag_list.each do |tag|
+          client.list_tags_for_resource(resource_name: arn).tag_list.each do |tag|
             if tag.key == tag_name
               self.tag_value = tag.value
             elsif tag.key == 'no-reserved-instance-reason'