aws_internet_gateways Resource
Use the aws_internet_gateways
InSpec audit resource to test the properties of all AWS internet gateways owned by the AWS account.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
An aws_internet_gateways
resource block collects all of the internet gateways and then tests that group.
describe aws_internet_gateways do
it { should exist }
end
Parameters
This resource does not require any parameters.
Properties
ids
- The ID of the internet gateway.
Field:
id
names
- The value of the
Name
tag. It isnil
if not defined. Field:
name
vpc_ids
- The ID of the attached VPC. It is
nil
if the resource is in adetached
state. Field:
vpc_id
tags
- A hash, with each key-value pair corresponding to an internet gateway tag.
Field:
tags
attachment_states
- Indicates whether the internet gateway is attached to a VPC (
attached
ordetached
). Field:
attachment_state
owner_ids
- The ID of the AWS account that owns the internet gateway.
Field:
owner_id
Examples
Test that there are exactly 3 internet gateways.
describe aws_internet_gateway do
its('count') { should cmp 3 }
end
Use this InSpec resource to request the ids of all internet gateways, then test in-depth using aws_internet_gateway
.
aws_internet_gateways.ids.each do |id|
describe aws_internet_gateway(id: id) do
it { should be_attached }
end
end
Matchers
For a full list of available matchers, see our Universal Matchers page.exist
The control will pass if the describe returns at least one result.
The field names described in the properties table should be used for the <property>
in the where
clause.
Use should_not
to test the entity should not exist.
describe aws_internet_gateways.where( <property>: <value>) do
it { should exist }
end
describe aws_internet_gateways.where( <property>: <value>) do
it { should_not exist }
end
AWS Permissions
Your Principal will need the EC2:Client:DescribeInternetGatewaysResult
action with Effect
set to Allow
.
You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2, and Actions, Resources, and Condition Keys for Identity And Access Management.