aws_flow_log Resource
Use the aws_flow_log
InSpec audit resource to test properties of a single Flow Log.
For additional information, including details on parameters and properties, see the AWS documentation on Flow Logs.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
describe aws_flow_log(flow_log_id: 'fl-9c718cf5') do
it { should exist }
end
Parameters
This resource requires at least one of the following parameters to be provided: flow_log_id
, subnet_id
, vpc_id
.
flow_log_id
(required if no other parameters provided)The Flow Log ID which uniquely identifies the Flow Log. This can be passed either as a string or as a
flow_log_id: 'value'
key-value entry in a hash.subnet_id
(required if no other parameters provided)The subnet associated with the Flow Log, if applicable. This must be passed as a
subnet_id: 'value'
key-value entry in a hash.vpc_id
(required if no other parameters provided)The VPC associated with the Flow Log, if applicable. This must be passed as a
vpc_id: 'value'
key-value entry in a hash.
Properties
flow_log_id
- The ID of the Flow Log.
log_group_name
- The name of the associated log group.
resource_id
- The ID of the assosiated resource, e.g. VPC, Subnet or Network Interface.
Examples
Search for a flow log by the associated subnet id.
describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
it { should exist }
end
Search for a flow log by the associated VPC id.
describe aws_flow_log(vpc_id: 'vpc-96cabaef') do
it { should exist }
end
Ensure the correct Flow Log is associated with a Subnet.
describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
its('flow_log_id') { should cmp 'fl-9c718cf5' }
end
Ensure the Flow Log is associated with the correct resource type.
describe aws_flow_log('fl-9c718cf5') do
its('resource_type') { should cmp 'subnet' }
end
Matchers
For a full list of available matchers, visit the InSpec matchers page.
exist
The control will pass if the describe returns at least one result.
Use should_not
to test the entity should not exist.
describe aws_flow_log('AnExistingFlowLog') do
it { should exist }
end
describe aws_flow_log('ANonExistentFlowLog') do
it { should_not exist }
end
be_attached_to_eni
Indicates that the Flow Log is attached to a ENI resource.
describe aws_flow_log('fl-9c718cf5') do
it { should be_attached_to_eni }
end
be_attached_to_subnet
Indicates that the Flow Log is attached to a subnet resource.
describe aws_flow_log('fl-9c718cf5') do
it { should be_attached_to_subnet }
end
be_attached_to_vpc
Indicates that the Flow Log is attached to a vpc resource.
describe aws_flow_log('fl-9c718cf5') do
it { should be_attached_to_vpc }
end
AWS Permissions
Your Principal will need the EC2:Client:DescribeFlowLogsResult
action with Effect
set to Allow
.