基于Chef InSpec的基础设施测试

rpm -ivh inspec-<version>.x86_64.rpm

examples/profile├── README.md├── controls│   ├── example.rb├── libraries│   └── extension.rb└── inspec.yml

# cat .aws/credentials [default]aws_access_key_id = <Access Key>aws_secret_access_key = <Secret Access Key>
# cat ~/.aws/config [default]region = cn-north-1output = json
[profile usecase]role_arn = <UseCase Account IAM Role Arn>

# inspec init profile --platform aws example
 ─────────────────────────── InSpec Code Generator ─────────────────────────── 
Creating new profile at /root/example • Creating file README.md • Creating file attributes.yml • Creating directory controls • Creating file controls/example.rb • Creating file inspec.yml

# copyright: 2018, The Authors
title "Sample Section"
aws_vpc_id = attribute("aws_vpc_id", value: "", description: "Optional AWS VPC identifier.")
# You add controls herecontrol "aws-single-vpc-exists-check" do # A unique ID for this control.  only_if { aws_vpc_id != "" } # Only run this control if the `aws_vpc_id` attribute is provided.  impact 1.0                                                                # The criticality, if this control fails.  title "Check to see if custom VPC exists."                                # A human-readable title.  describe aws_vpc(aws_vpc_id) do                                           # The test itself.    it { should exist }  endend
# Plural resources can be inspected to check for specific resource details.control "aws-vpcs-check" do  impact 1.0  title "Check in all the VPCs for default sg not allowing 22 inwards"  aws_vpcs.vpc_ids.each do |vpc_id|    describe aws_security_group(vpc_id: vpc_id, group_name: "default") do      it { should allow_in(port: 22) }    end  endend
control "aws-vpcs-multi-region-status-check" do                             # A unique ID for this control.  impact 1.0                                                                # The criticality, if this control fails.  title 'Check AWS VPCs in all regions have status "available"'             # A human-readable title.  aws_regions.region_names.each do |region|                                 # Loop over all available AWS regions    aws_vpcs(aws_region: region).vpc_ids.each do |vpc|                      # Find all VPCs in a single AWS region      describe aws_vpc(aws_region: region, vpc_id: vpc) do                  # The test itself.        it { should exist }                                                 # Confirms AWS VPC exists        it { should be_available }                                          # Confirms AWS VPC has status "available"      end    end  endend

# inspec exec example -t aws://cn-north-1/usecase
Profile: AWS InSpec Profile (example)Version: 0.1.0Target:  aws://cn-north-1
  ↺  aws-single-vpc-exists-check: Check to see if custom VPC exists.     ↺  Skipped control due to only_if condition.  ✔  aws-vpcs-check: Check in all the VPCs for default sg not allowing 22 inwards     ✔  EC2 Security Group ID: sg-01d67dds39bcffe17 Name: default VPC ID: vpc-032cdd155d561c7bf  is expected to allow in {:port=>22}  ✔  aws-vpcs-multi-region-status-check: Check AWS VPCs in all regions have status "available"     ✔  VPC vpc-032cdd155d561c7bf in cn-north-1 is expected to exist     ✔  VPC vpc-032cdd155d561c7bf in cn-north-1 is expected to be available
Profile: Amazon Web Services  Resource Pack (inspec-aws)Version: 1.31.0Target:  aws://cn-north-1
     No tests executed.
Profile Summary: 2 successful controls, 0 control failures, 1 control skippedTest Summary: 3 successful, 0 failures, 1 skipped