aws_vpc_endpoint_connection_notification Resource
Use the aws_vpc_endpoint_connection_notification
Inspec audit resource to test the properties of a single specific AWS VPC endpoint connection notification.
For additional information, including details on parameters and properties, see the AWS VPC endpoint connection notification documentation.
Install
This resource is available in the Chef InSpec AWS resource pack.
For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.
Syntax
Ensure that an AWS VPC endpoint connection notification exists.
# Find a AWS VPC endpoint connection notification by ID
describe aws_vpc_endpoint_connection_notification('VPCE-NFN-12345678987654321') do
it { should exist }
end
# Hash syntax for ID
describe aws_vpc_endpoint_connection_notification(connection-notification-id: 'VPCE-NFN-12345678987654321') do
it { should exist }
end
Parameters
connection_notification_id
(required)This resource expects the AWS VPC endpoint connection notification ID as a parameter. This can be passed either as a string or as a
connection_notification_id: 'VALUE'
key-value entry in a hash.
Properties
vpc_endpoint_id
- The ID of the endpoint.
connection_notification_id
- The ID of the AWS VPC endpoint connection notification.
service_id
- The ID of the endpoint service.
connection_notification_type
- The type of notification.
connection_notification_arn
- The ARN of the SNS topic for the notifications.
connection_events
- The endpoint events to receive a notification about. Valid values:
Accept
,Connect
,Delete
, andReject
. connection_notification_state
- The state of the AWS VPC endpoint connection notification. Valid values:
Enabled
,Disabled
.
Examples
Ensure an AWS VPC endpoint connection notification’s ARN is available.
describe aws_vpc_endpoint_connection_notification(connection_notification_id: 'VPCE-NFN-12345678987654321') do
its('CONNECTION_NOTIFICATION_ARN') { should eq 'ARN:AWS:SNS:US-EAST-2:112758395563:AWS-SNS-TOPIC-ENCRYPTION-BLOIXLVRSNFYBLZXNBGCBVHJU' }
end
Ensure that the VPC endpoint connection notification has a type using a key-value hash.
describe aws_vpc_endpoint_connection_notification(connection_notification_id: 'VPCE-NFN-12345678987654321') do
its('connection_notification_type') { should eq 'TOPIC' }
end
Verify the ARN of a VPC endpoint connection notification.
describe aws_vpc_endpoint_connection_notification('VPCE-NFN-12345678987654321') do
its('CONNECTION_NOTIFICATION_ARN') { should eq 'ARN:AWS:SNS:US-EAST-2:112758395563:AWS-SNS-TOPIC-ENCRYPTION-BLOIXLVRSNFYBLZXNBGCBVHJU' }
end
Matchers
This InSpec audit resource has the following special matchers. For the complete list of the available matchers, please visit our Universal Matchers page.
The controls will pass if the describe
returns at least one result.
exist
Use should_not
to test the entity should not exist.
describe aws_vpc_endpoint_connection_notification(connection-notification-id: 'VPCE-NFN-12345678987654321') do
it { should exist }
end
Use should
to test the entity should not exists.
describe aws_vpc_endpoint_connection_notification(connection-notification-id: 'VPCE-NFN-12345678987654321') do
it { should_not exist }
end
AWS Permissions
Your Principal will need the EC2:Client:DescribeVpcEndpointConnectionNotificationsResult
action with Effect
set to Allow
.
You can find the detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2.