aws_ebs_volume Resource
Use the aws_ebs_volume
InSpec audit resource to test the properties of a single AWS EBS volume.
For additional information, including details on parameters and properties, see the AWS documentation on EBS.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
Ensure an EBS exists
describe aws_ebs_volume('VOLUME-01a2349e94458a507') do
it { should exist }
end
You may also use hash syntax to pass the EBS volume name.
describe aws_ebs_volume(name: 'DATA-VOLUME') do
it { should exist }
end
Parameters
This resource accepts a single parameter, either the EBS volume name or ID. mandatory
volume_id
(required ifname
not provided)The EBS volume ID which uniquely identifies the volume. This can be passed as either a string or an
volume_id: 'value'
key-value entry in a hash.name
(required ifvolume_id
not provided)The EBS volume name which uniquely identifies the volume. This must be passed as a
name: 'value'
key-value entry in a hash.
Properties
availability_zone
- The availability zone for the volume.
encrypted
- Indicates whether the volume is encrypted.
iops
- The number of I/O operations per second (IOPS) that the volume supports.
kms_key_id
- The full ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) is used to protect the encryption key for the volume.
size
- The size of the volume in GiBs.
snapshot_id
- The snapshot from which the volume is created, if applicable.
status
- The volume state.
volume_type
- The volume type.
Examples
Test that an EBS Volume does not exist.
describe aws_ebs_volume(name: 'DATA-VOLUME') do
it { should_not exist }
end
Test that an EBS Volume is encrypted.
describe aws_ebs_volume(name: 'SECURE_DATA-VOLUME') do
it { should be_encrypted }
end
Test that an EBS Volume has the correct size.
describe aws_ebs_volume(name: 'DATA-VOLUME') do
its('size') { should cmp 32 }
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exist
The control will pass if the describe returns at least one result.
Use should_not
to test the entity should not exist.
describe aws_ebs_volume(name: 'DATA-VOLUME') do
it { should exist }
end
describe aws_ebs_volume(name: 'DATA-VOLUME') do
it { should_not exist }
end
be_encrypted
The be_encrypted
matcher tests if the described EBS volume is encrypted.
it { should be_encrypted }
AWS Permissions
Your Principal will need the EC2:Client:DescribeVolumesResult
action with Effect
set to Allow
.
You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2, and Actions, Resources, and Condition Keys for Identity And Access Management.