mirror of
https://github.com/inspec/inspec
synced 2024-12-18 00:53:22 +00:00
74 lines
1.7 KiB
Text
74 lines
1.7 KiB
Text
---
|
|
title: About the aws_iam_group Resource
|
|
platform: aws
|
|
---
|
|
|
|
# aws\_iam\_group
|
|
|
|
Use the `aws_iam_group` InSpec audit resource to test properties of a single IAM group.
|
|
|
|
To test properties of multiple or all groups, use the `aws_iam_groups` resource.
|
|
|
|
<br>
|
|
|
|
## Availability
|
|
|
|
### Installation
|
|
|
|
This resource is distributed along with InSpec itself. You can use it automatically.
|
|
|
|
### Version
|
|
|
|
This resource first became available in v2.0.16 of InSpec.
|
|
|
|
## Syntax
|
|
|
|
An `aws_iam_group` resource block identifies a group by group name.
|
|
|
|
# Find a group by group name
|
|
describe aws_iam_group('mygroup') do
|
|
it { should exist }
|
|
end
|
|
|
|
# Hash syntax for group name
|
|
describe aws_iam_group(group_name: 'mygroup') do
|
|
it { should exist }
|
|
end
|
|
|
|
<br>
|
|
|
|
## Examples
|
|
|
|
The following examples show how to use this InSpec audit resource.
|
|
|
|
As this is the initial release of `aws_iam_group`, its limited functionality precludes examples.
|
|
|
|
<br>
|
|
|
|
## Properties
|
|
|
|
### users
|
|
|
|
Provides a list of the users that are attached to the group
|
|
|
|
describe aws_iam_group('mygroup')
|
|
its('users') { should include 'iam_user_name' }
|
|
end
|
|
|
|
<br>
|
|
|
|
## Matchers
|
|
|
|
### exists
|
|
|
|
The control will pass if a group with the given group name exists.
|
|
|
|
describe aws_iam_group('mygroup')
|
|
it { should exist }
|
|
end
|
|
|
|
## AWS Permissions
|
|
|
|
Your [Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-principal) will need the `iam:GetGroup` action with Effect set to Allow.
|
|
|
|
You can find detailed documentation at [Actions, Resources, and Condition Keys for Identity And Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_identityandaccessmanagement.html).
|