azure_subscription Resource
Use the azure_subscription
InSpec audit resource to test the properties of the current subscription.
Azure REST API Version, Endpoint, and HTTP Client Parameters
This resource interacts with API versions supported by the resource provider.
The api_version
can be defined as a resource parameter.
If not provided, this resource uses the latest version.
For more information, refer to the azure_generic_resource
document.
Unless defined, this resource uses the azure_cloud
global endpoint and default values for the HTTP client.
For more information, refer to the resource pack README.
Install
This resource is available in the Chef InSpec Azure resource pack.
For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.
Syntax
This resource will retrieve the current subscription ID that InSpec uses unless it is provided via id
or resource_id
parameters.
describe azure_subscription do
it { should exist }
end
Or
describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
it { should exist }
end
Or
describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
it { should exist }
end
Parameters
id
- The ID of the target subscription.
2e0b423p-aaaa-bbbb-1111-ee558463aabbd
. resource_id
- The fully qualified ID for the subscription.
/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd
. locations_api_version
- The endpoint API version for the
locations
property. Optional. The latest version will be used unless provided.
Properties
name
- The subscription display name.
id
- The subscription ID.
2e0b423p-aaaa-bbbb-1111-ee558463aabbd
. locations
- The list of all available geo-location names that have the
metadata.physicalLocation
is set. all_locations
- The list of all available geo-location names. This includes physical and logical locations.
physical_locations<superscript>*</superscript>
- The list of all available geo-location names with the
metadata.regionType
is set toPhysical
. logical_locations
- The list of all available geo-location names with the
metadata.regionType
is set toLogical
. locations_list
- The list of all available geo-location objects in this format.
managedByTenants
- An array containing the tenants managing the subscription.
diagnostic_settings
- The diagnostic settings set at a subscription level.
diagnostic_settings_enabled_logging
- The enabled logging types from diagnostic settings set at a subscription level.
diagnostic_settings_disabled_logging
- The disabled logging types from diagnostic settings set at a subscription level.
physical_locations
might be different than the locations
property depending on the API version.
This is because of the change in the Azure API terminology. It is advised to see the official documentation for more information.
For properties applicable to all resources, such as type
and properties
, refer to azure_generic_resource
.
Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.
). For example, properties.<attribute>
.
Examples
Test subscription`s display name
describe azure_subscription do
its('name') { should cmp 'Demo Resources' }
end
Test subscription`s authorization source
describe azure_subscription do
its('authorizationSource') { should cmp 'RoleBased' }
end
Test subscription`s locations
describe azure_subscription do
its('locations') { should include('eastus') }
end
Test subscription`s enabled logging types (via diagnostic settings)
describe azure_subscription do
its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end
Test subscription`s disabled logging types (via diagnostic settings)
describe azure_subscription do
its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
exists
# If we expect a resource to always exist.
describe azure_subscription do
it { should exist }
end
not_exists
# If we expect a resource to never exist.
describe azure_subscription(id: 'fake_id') do
it { should_not exist }
end
Azure Permissions
Your Service Principal must be set up with at least a contributor
role on the subscription you wish to test.