mirror of
https://github.com/inspec/inspec
synced 2024-12-24 20:13:16 +00:00
d5a9a39a00
Fixes #5 Signed-off-by: Russell Seymour <russell.seymour@turtlesystems.co.uk>
195 lines
No EOL
7.2 KiB
Markdown
195 lines
No EOL
7.2 KiB
Markdown
# InSpec Azure Resource Pack
|
|
|
|
This resource pack provides resources for Azure Resources. It will ship with the required resources to write your own compliance rules:
|
|
|
|
```
|
|
├── README.md - this readme
|
|
├── controls - contains example controls
|
|
└── libraries - contains Azure resources
|
|
```
|
|
|
|
## Get Started
|
|
|
|
This profile uses the Azure Ruby SDK and as such requires a Service Principal Name (SPN) to be created in the Azure subscription that is being tested.
|
|
|
|
This can be done on the command line or from the Azure Portal
|
|
|
|
- Azure CLI: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal-cli
|
|
- PowerShell: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal
|
|
- Azure Portal: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal
|
|
|
|
The information from the SPN can be specified either in a file `~/.azure/credentials`, a different file or as environment variables.
|
|
|
|
### Credentials File
|
|
|
|
The simplest way is to create the file `~/.azure/credentials` with the following format. The profile is configured to look for this file by default do no settings are required.
|
|
|
|
```
|
|
[<SUBSCRIPTION_ID>]
|
|
client_id = "<CLIENT_ID>"
|
|
client_secret = "<CLIENT_SECRET>"
|
|
tenant_id = "<TENANT_ID>"
|
|
```
|
|
|
|
So to run the profile now it is as simple as running:
|
|
|
|
```bash
|
|
inspec exec inspec-azure
|
|
```
|
|
|
|
A different credentials file, with the same format, can be specified as an environment variable `AZURE_CREDS_FILE`:
|
|
|
|
```bash
|
|
AZURE_CREDS_FILE="/path/to/another/file" inspec exec inspec-azure
|
|
```
|
|
|
|
Note that this file format supports multiple subscription_ids. By default `inspec-azure` will pick the first subscription in the file. However if another subscription should be used then specify it in the environment variable `AZURE_SUBSCRIPTION_ID`.
|
|
|
|
```bash
|
|
AZURE_SUBSCRIPTION_ID="2fbdbb02-df2e-11e6-bf01-fe55135034f3" inspec exec inspec-azure
|
|
```
|
|
|
|
### Environment variables
|
|
|
|
It is possible to not have a credentials file at all and specify all of the required information as the following environment variables:
|
|
|
|
- `AZURE_SUBSCRIPTION_ID`
|
|
- `AZURE_CLIENT_ID`
|
|
- `AZURE_CLIENT_SECRET`
|
|
- `AZURE_TENANT_ID`
|
|
|
|
For example:
|
|
|
|
```bash
|
|
AZURE_SUBSCRIPTION_ID="2fbdbb02-df2e-11e6-bf01-fe55135034f3" \
|
|
AZURE_CLIENT_ID="58dc4f6c-df2e-11e6-bf01-fe55135034f3" \
|
|
AZURE_CLIENT_SECRET="Jibr4iwwaaZwBb6W" \
|
|
AZURE_TENANT_ID="6ad89b58-df2e-11e6-bf01-fe55135034f3" inspec exec inspec-azure
|
|
```
|
|
|
|
## Use the resources
|
|
|
|
Since this is an InSpec resource pack, it only defines InSpec resources. It includes example tests only. To easily use the Azure InSpec resources in your tests do the following:
|
|
|
|
### Create a new profile
|
|
|
|
```bash
|
|
inspec init profile my-profile
|
|
```
|
|
|
|
### Adapt the `inspec.yml`
|
|
|
|
```yaml
|
|
name: my-profile
|
|
title: My own Azure profile
|
|
version: 0.1.0
|
|
depends:
|
|
- name: azure
|
|
url: https://github.com/chef/inspec-azure/archive/master.tar.gz
|
|
```
|
|
|
|
### Add controls
|
|
|
|
Since your profile depends on the resource pack, you can use those resources in your own profile:
|
|
|
|
```ruby
|
|
control 'azure-1' do
|
|
impact 1.0
|
|
title 'Checks that the machine was built from the correct image'
|
|
|
|
describe azurevm_image(host: 'example-01', resource_group: 'MyResourceGroup') do
|
|
its('sku') { should eq '16.04.0-LTS' }
|
|
its('publisher') { should ieq 'Canonical' }
|
|
its('offer') { should ieq 'UbuntuServer' }
|
|
end
|
|
end
|
|
```
|
|
|
|
### Available Resources
|
|
|
|
- `azure_vm` - This resource reads information about a virtual machine in the specified resource group
|
|
|
|
| Resource Name | Resources | Description |
|
|
|---------------|-----------|-------------|
|
|
| azure_vm | publisher | Publisher that provided the image in the marketplace |
|
|
| | offer | The offer of the image |
|
|
| | sku | The SKU being used |
|
|
| | size | The size of the machine |
|
|
| | location | Where the machine has been deployed |
|
|
| | boot_diagnostics? | Whether boot diagnostics have been enabled or not |
|
|
| | nic_count | How many network cards are attached to the machine |
|
|
| | username | The admin username that has been assigned to the machine |
|
|
| | computername | Computer name of the machine in the operating system. This maybe different to the VM name as seen in Azure |
|
|
| | hostname | Alias for computername |
|
|
| | password_authentication? | If password authentication is enabled. For Windows machines this is always true |
|
|
| | ssh_key_count | How many SSH public keys have been added to the machine. For Windows this is always 0 |
|
|
| | os_type | Tyep type of operating system. Linux or Windows |
|
|
|
|
- `azure_vm_datadisks` - Resource to read the data disks for a machine and check that they are of the correct size etc
|
|
|
|
| Resource Name | Resources | Description |
|
|
|---------------|-----------|-------------|
|
|
| azure_vm_datadisks | has_disks? | Boolean test to see if a machine has datadisks |
|
|
| | count | Returns the number of data disks attached to the machine |
|
|
| | where | Filter that allows for different tests to be performed, see examples below |
|
|
|
|
When data disks are retrieved from a machine they are given as an array. The `where` filter will interogate the array according the criteria it is given. The followin attributes are available in the filter:
|
|
|
|
- `disk` - Disk number (0 index based)
|
|
- `caching` - What sort of caching is enabled on the data disk
|
|
- `create_option` - How the disk was created
|
|
- `size` - The size of the disk in GB
|
|
- `lun` - The LUN number
|
|
- `name` - Name of the disk
|
|
- `uri` - Full URI to the disk in Blob storage
|
|
- `storage_account` - The name of the storage account in which the Blob storage exists
|
|
|
|
**Note: This does not yet work with Managed Disks**
|
|
|
|
## Examples
|
|
|
|
### Test for 1 disk with a size greater than 10gb
|
|
|
|
```ruby
|
|
control 'azure-1' do
|
|
impact 1.0
|
|
title 'Checks that the machine has exactly one data disk and it is over 10gb in size'
|
|
|
|
describe azurevm_image(host: 'example-01', resource_group: 'MyResourceGroup') do
|
|
its('has_disks?') { should be true }
|
|
its('count') { should eq 1 }
|
|
end
|
|
|
|
describe azurevm_image(host: 'example-01', resource_group: 'MyResourceGroup').where { disk == 0 and size > 10 } do
|
|
its('entries') { should_not be_empty }
|
|
end
|
|
end
|
|
```
|
|
|
|
### Using the example controls
|
|
|
|
There a number of example controls that have been added to this resource. They are driven by environment variables to make them easier to run. For example the following would test a machine called `example-01` in the resource group `exmaple-rg`.
|
|
|
|
```bash
|
|
$> AZURE_VM_NAME='example-01' AZURE_RESOURCE_GROUP_NAME='example-rg' bundle exec inspec exec .
|
|
```
|
|
|
|
## License
|
|
|
|
| | |
|
|
| ------ | --- |
|
|
| **Author:** | Russell Seymour (<russell@chef.io>) |
|
|
| **Copyright:** | Copyright (c) 2017 Chef Software Inc. |
|
|
| **License:** | Apache License, Version 2.0 |
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License. |