aws_regions Resource
Use the aws_regions
InSpec audit resource to test properties of some or all AWS regions in bulk.
Note that this resource lists all AWS regions that are currently available to the caller.
For additional information, including details on parameters and properties, see the AWS documentation on Regions.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
An aws_regions
resource block uses an optional filter to select a group of regions and then tests that group.
describe aws_regions.where { region_name: 'us-not-there-1' } do
it { should_not exist }
end
Parameters
name
(required)This resource does not expect any parameters.
Properties
region_names
- The Names of the regions.
endpoints
- The resolved endpoints of the regions.
Examples
The following examples show how to use this InSpec audit resource.
Check for a Particular Region.
describe aws_regions do
its('region_names') { should include 'eu-west-2' }
end
Check an endpoint exists.
describe aws_regions do
its('endpoints') { should include 'ec2.eu-west-2.amazonaws.com' }
end
Use the regions resource to check single regions in more detail.
aws_regions.region_names.each do |aws_region_name|
describe aws_region(region_name: aws_region_name) do
it { should exist }
end
end
Matchers
For a full list of available matchers, visit the InSpec matchers page.
exist
The control will pass if the describe returns at least one result.
it { should exist }
AWS Permissions
Your Principal will need the EC2:Client:DescribeRegionsResult
action with Effect
set to Allow
.
You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2.