mirror of
https://github.com/inspec/inspec
synced 2024-12-18 00:53:22 +00:00
342 lines
No EOL
7.9 KiB
Text
342 lines
No EOL
7.9 KiB
Text
---
|
|
title: About the azure_resource_group_resource_counts Resource
|
|
---
|
|
|
|
# azure\_resource\_group\_resource\_counts
|
|
|
|
Use the `azure_resource_group_resource_counts` InSpec audit resource to check the number of Azure resources in a resource group
|
|
|
|
## Syntax
|
|
|
|
The name of the resource group is specified as a parameter on the resource:
|
|
|
|
```ruby
|
|
describe azure_resource_group(name: 'MyResourceGroup') do
|
|
its('property') { should eq 'value' }
|
|
end
|
|
```
|
|
|
|
where
|
|
|
|
* Resource Parameters
|
|
* `MyResourceGroup` is the name of the resource group being interrogated
|
|
* `property` is one a resource property
|
|
* `value` is the expected output from the matcher
|
|
|
|
The options that can be passed to the resource are as follows.
|
|
|
|
## Examples
|
|
|
|
The following examples show how to use this InSpec audit resource
|
|
|
|
Please refer the integration tests for more in depth examples:
|
|
|
|
- [Resource Group](../../test/integration/verify/controls/resource_group.rb)
|
|
|
|
### Test Resource Group has the correct number of resources
|
|
|
|
```ruby
|
|
describe azure_resource_group_resource_counts(name: 'Inspec-Azure') do
|
|
its('total') { should eq 7}
|
|
```
|
|
|
|
### Ensure that the Resource Group contains the correct resources
|
|
|
|
```ruby
|
|
describe azure_resource_group_resource_counts(name: 'Inspec-Azure') do
|
|
its('total') { should eq 7 }
|
|
its('vm_count') { should eq 2 }
|
|
its('nic_count') { should eq 2 }
|
|
its('public_ip_count') { should eq 1 }
|
|
its('sa_count') { should eq 1 }
|
|
its('vnet_count') { should eq 1 }
|
|
end
|
|
```
|
|
|
|
<br>
|
|
|
|
## Resource Parameters
|
|
|
|
The options that can be passed to the resource are as follows.
|
|
|
|
### `group_name` (required)
|
|
|
|
Use this parameter to define the Azure Resource Group to be tested.
|
|
|
|
example: MyResourceGroup
|
|
|
|
### name
|
|
|
|
Use this parameter to define the name of the Azure resource to test
|
|
|
|
example: MyVM
|
|
|
|
If both `group_name` and `name` is set then `name` will take priority
|
|
|
|
These options can also be set using the environment variables:
|
|
|
|
- `AZURE_RESOURCE_GROUP_NAME`
|
|
- `AZURE_RESOURCE_NAME`
|
|
|
|
When the options have been set as well as the environment variables, the environment variables take priority.
|
|
|
|
### Parameter Example
|
|
|
|
```ruby
|
|
describe azure_resource_group_resource_counts(name: 'ChefAutomate') do
|
|
its('total') { should eq 7}
|
|
its('nic_count') { should eq 1 }
|
|
its('vm_count') { should eq 1 }
|
|
end
|
|
```
|
|
|
|
<br>
|
|
|
|
## Properties
|
|
|
|
* `name`, `location` ,`id`, `provisioning_state`, `subscription_id`, `total`, `nic_count`, `vm_count`, `extension_count`, `vnet_count`, `sa_count`, `public_ip_count`,`managed_disk_image_count`, `managed_disk_count`, `tag_count`
|
|
|
|
<br>
|
|
|
|
## Property Examples
|
|
|
|
This InSpec audit resource has the following properties:
|
|
|
|
### name
|
|
|
|
Returns the name of the resource group.
|
|
|
|
```ruby
|
|
its(name) { should cmp 'nugget' }
|
|
```
|
|
|
|
### location
|
|
|
|
Returns where in Azure the resource group is located.
|
|
|
|
```ruby
|
|
its(location) { should cmp 'us-west' }
|
|
```
|
|
|
|
### id
|
|
|
|
Returns the full qualified ID of the resource group.
|
|
|
|
This is in the format `/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>`.
|
|
|
|
```ruby
|
|
its(id) { should cmp 'FQDN' }
|
|
```
|
|
|
|
### provisioning_state
|
|
|
|
The provisioning state of the resource group.
|
|
|
|
```ruby
|
|
its(provisioning_state) { should cmp '????' }
|
|
```
|
|
|
|
### subscription_id
|
|
|
|
Returns the subscription ID which contains the resource group.
|
|
|
|
This is derived from the `id`.
|
|
|
|
```ruby
|
|
its(subscription_id) { should cmp '????' }
|
|
```
|
|
|
|
### total
|
|
|
|
The total number of resources in the resource group
|
|
|
|
```ruby
|
|
its(total) { should eq 5 }
|
|
```
|
|
|
|
### nic_count
|
|
|
|
The number of network interface cards in the resource group
|
|
|
|
```ruby
|
|
its(nic_count) { should eq 2 }
|
|
```
|
|
|
|
### vm_count
|
|
|
|
The number of virtual machines in the resource group
|
|
|
|
```ruby
|
|
its(vm_count) { should eq 5 }
|
|
```
|
|
|
|
### vnet_count
|
|
|
|
The number of virtual networks in the resource group
|
|
|
|
```ruby
|
|
its(vnet_count) { should eq 5 }
|
|
```
|
|
|
|
### sa_count
|
|
|
|
The number of storage accounts in the resource group
|
|
|
|
```ruby
|
|
its(sa_count) { should eq 5 }
|
|
```
|
|
|
|
### public_ip_count
|
|
|
|
The number of Public IP Addresses in the resource group
|
|
|
|
```ruby
|
|
its(public_ip_count) { should eq 5 }
|
|
```
|
|
|
|
### managed_disk_image_count
|
|
|
|
The number of managed disk images that are in the resource group.
|
|
|
|
These are the items from which managed disks are created which are attached to machines. Generally the images are created from a base image or a custom image (e.g. Packer)
|
|
|
|
```ruby
|
|
its(managed_disk_image_count) { should eq 5 }
|
|
```
|
|
|
|
### managed_disk_count
|
|
|
|
The number of managed disks in the resource group.
|
|
|
|
If a resource group contains one virtual machine with an OS disk and 2 data disks that are all Managed Disks, then the count would be 3.
|
|
|
|
```ruby
|
|
its(managed_disk_count) { should eq 3 }
|
|
```
|
|
|
|
<br>
|
|
|
|
## Matchers
|
|
|
|
This resource has a number of `have_xxxx` matchers that provide a simple way to test of a specific Azure Resoure Type exists in the resource group.
|
|
|
|
### `have_nics`
|
|
|
|
Use this resource to test `
|
|
Microsoft.Network/networkInterfaces`
|
|
|
|
### `have_vms`
|
|
|
|
Use this resource to test `Microsoft.Compute/virtualMachines`
|
|
|
|
### `have_extensions`
|
|
|
|
Use this resource to test `Microsoft.Compute/virtualMachines/extensions``
|
|
|
|
### `have_nsgs`
|
|
|
|
Use this resource to test `Microsoft.Network/networkSecurityGroups`
|
|
|
|
### `have_vnets`
|
|
|
|
Use this resource to test `Microsoft.Network/virtualNetworks`
|
|
|
|
### `have_managed_disks`
|
|
|
|
Use this resource to test `Microsoft.Compute/disks`
|
|
|
|
### `have_managed_disk_images`
|
|
|
|
Use this resource to test `Microsoft.Compute/images`
|
|
|
|
### `have_sas`
|
|
|
|
Use this resource to test `Microsoft.Storage/storageAccounts`
|
|
|
|
### `have_public_ips`
|
|
|
|
Use this resource to test `Microsoft.Network/publicIPAddresses`
|
|
|
|
With these methods the following tests are possible
|
|
|
|
```ruby
|
|
it { should have_nics }
|
|
it { should_not have_extensions }
|
|
```
|
|
## Tags
|
|
|
|
It is possible to test the tags that have been assigned to the resource. There are a number of properties that can be called to check that it has tags, that it has the correct number and that the correct ones are assigned.
|
|
|
|
### have\_tags
|
|
|
|
This is a simple test to see if the machine has tags assigned to it or not.
|
|
|
|
```ruby
|
|
it { should have_tags }
|
|
```
|
|
|
|
### tag\_count
|
|
|
|
Returns the number of tags that are assigned to the resource
|
|
|
|
```ruby
|
|
its ('tag_count') { should eq 2 }
|
|
```
|
|
|
|
### tags
|
|
|
|
It is possible to check if a specific tag has been set on the resource.
|
|
|
|
```ruby
|
|
its('tags') { should include 'Owner' }
|
|
```
|
|
|
|
### xxx\_tag
|
|
|
|
To get the value of the tag, a number of preoprties have been created from the tags that are set.
|
|
|
|
For example, if the following tag is set on a resource:
|
|
|
|
| Tag Name | Value |
|
|
|----------|-------|
|
|
| Owner | Russell Seymour |
|
|
|
|
Then a property is available called `Owner_tag`.
|
|
|
|
```ruby
|
|
its('Owner_tag') { should cmp 'Russell Seymour' }
|
|
```
|
|
|
|
Note: The tag name is case sensitive which makes the test case sensitive. E.g. `owner_tag` does not equal `Owner_tag`.
|
|
|
|
## Examples
|
|
|
|
The following examples show how to use this InSpec audit resource
|
|
|
|
Please refer the integration tests for more in depth examples:
|
|
|
|
- [Resource Group](../../test/integration/verify/controls/resource_group.rb)
|
|
|
|
### Test Resource Group has the correct number of resources
|
|
|
|
```ruby
|
|
describe azure_resource_group_resource_counts(name: 'Inspec-Azure') do
|
|
its('total') { should eq 7}
|
|
```
|
|
|
|
### Ensure that the Resource Group contains the correct resources
|
|
|
|
```ruby
|
|
describe azure_resource_group_resource_counts(name: 'Inspec-Azure') do
|
|
its('total') { should eq 7 }
|
|
its('vm_count') { should eq 2 }
|
|
its('nic_count') { should eq 2 }
|
|
its('public_ip_count') { should eq 1 }
|
|
its('sa_count') { should eq 1 }
|
|
its('vnet_count') { should eq 1 }
|
|
end
|
|
```
|
|
|
|
## References
|
|
|
|
- [Azure Ruby SDK - Resources](https://github.com/Azure/azure-sdk-for-ruby/tree/master/management/azure_mgmt_resources) |