{"id":19594,"date":"2023-09-07T10:43:22","date_gmt":"2023-09-07T14:43:22","guid":{"rendered":"https:\/\/qxf2.com\/blog\/?p=19594"},"modified":"2023-09-07T10:43:22","modified_gmt":"2023-09-07T14:43:22","slug":"chef-inspec-aws-resources","status":"publish","type":"post","link":"https:\/\/qxf2.com\/blog\/chef-inspec-aws-resources\/","title":{"rendered":"Auditing AWS cloud resources with Chef InSpec"},"content":{"rendered":"

Continuing from the preceding blog, \u2018Auditing OS Level Resources with Chef InSpec<\/a>\u2019 which delved into utilizing the Chef InSpec<\/a> open-source tool for testing individual servers via OS level resources. Now, we embark into the domain of Chef InSpec\u2019s facility in cloud environments. Chef InSpec extends its support to cloud platforms like AWS<\/a>, Azure<\/a>, and GCP<\/a>. Referring to insights shared in our earlier blog, Qxf2<\/a>\u2019s clients predominantly embrace Infrastructure as Code and heavily lean towards the AWS cloud platform for deployments. A few of our clients also opt for the Azure cloud platform. This post takes through the capabilities of Chef InSpec tailored to the AWS cloud platform.<\/p>\n

\n

1.Prerequisites<\/h4>\n

To allow InSpec to talk AWS
\n-> InSpec installed.
\n-> AWS console access.
\n-> AWS IAM user with “ReadOnlyAccess” is all you need to execute tests.
\n-> Configure your AWS CLI<\/a><\/p>\n

2.Profile for AWS<\/h4>\n

To verify the configuration of AWS resources<\/a>, initialize an inspec profile with target platform as AWS:<\/p>\n

\r\ninspec init profile --platform aws blog_profile\r\n<\/pre>\n
The above command creates standalone structure with “controls” and “inspec.yml” file. You can verify inspec.yml for platform support ‘AWS’ under supports section. <\/p>\n
Command to verify AWS profile<\/h6>\n
\r\ninspec detect -t aws:\/\/\/\r\n<\/pre>\n
Output of the Platform details<\/h6>\n
\"inspec<\/p>\n
\n
3.Tests to verify AWS resources<\/h4>\n
3.1. AWS S3 Resource:<\/h5>\n
Amazon S3 bucket<\/a> is object storage service used to store and retrieve the data. This audit resource 'aws_s3_bucket'<\/code> tests properties of a single AWS S3 bucket.
\nExample: The below provided code tests S3 bucket existence, access and the tags attached to the S3 bucket.
\nBefore writing test add the below steps to “inspec.yml”<\/strong><\/p>\n
\r\natrribute:\r\n- name: bucketname\r\n  description: 's3 bucket name'\r\n  required: true\r\n  value: $TEST_BUCKET\r\n  type: string\r\n<\/pre>\n
In this YAML block, you’re defining an attribute named ‘bucketname’, this attribute used to pass the information to your Chef InSpec profile during runtime. The YAML file describes an S3 bucket name and  the attribute marked as required (required: true). The attribute type set to of type string (type: string). The value for this attribute set to a variable named $TEST_BUCKET.<\/p>\n
\r\nbucketname = attribute('bucketname')\r\n\r\ncontrol \"AWS S3\" do\r\n  impact 0.7\r\n  title \"Check AWS Backend S3 Buckets\"\r\n\r\n  describe aws_s3_bucket(bucket_name: bucketname) do\r\n    it { should exist }\r\n    it { should_not be_public }\r\n    its('tags') { should include(\"Name\" => \"InSpec\")}\r\n  end\r\nend\r\n<\/pre>\n
This bucketname = attribute('bucketname')<\/code> retrieves the value of the bucket name. The be_public matcher tests if the bucket has potentially insecure access controls. In summary, the code snippet sets up an attribute in inspec.yml to dynamically provide an S3 bucket name and verifies the existence, not accessible to public and attached tags information.<\/p>\n
Command to execute:<\/h6>\n
\r\ninspec exec blog_profile -t aws:\/\/\/ --input bucketname=\"\"\r\n<\/pre>\n
Sample run of s3 bucket resource test:
\n\"S3_bucket_output_new\"<\/p>\n
\n
3.2. AWS SNS:<\/h5>\n
An Amazon SNS<\/a> is managed service for communication. SNS(Simple Notification Service) used to allow messaging between decoupled microservices applications.
\nExample: Verify the configuration of an AWS SNS (Simple Notification Service) topic and its associated subscription.<\/p>\n
\r\ndescribe aws_sns_topic('arn:aws:sns:us-east-1:121777381368:my-topic-name') do\r\n    it { should exist }\r\nend\r\ndescribe aws_sns_subscription(subscription_arn: 'arn:aws:sns:us-east-1:121777381368:my-topic-name:ef2ddf44-bd3c-41dd-a750-72380deba2a2') do\r\n    its('endpoint') { should cmp 'test@gmail.com' }\r\nend\r\n<\/pre>\n
The code validates the existence of an SNS topic and then verifies the attributes of a specific subscription associated with that topic. This helps ensure that the SNS configuration aligns with the expected values and settings.<\/p>\n
\n
3.3. AWS SQS Resource:<\/h5>\n
AWS SQS<\/a> queue service used to send, store and receive messages between components. Use aws_sqs_queue<\/code> audit resource for testing its properties of single SQS queue service.
\nExample: Test the SQS queue exists, delay time, queue is a FIFO queue and  has a visibility timeout of 300 seconds.  <\/p>\n
\r\ndescribe aws_sqs_queue(queue_url: 'https:\/\/sqs.ap-southeast-2.amazonaws.com\/1212121\/MyQueue') do\r\n  it { should exist }\r\n  its('delay_seconds') { should be 0 }\r\n  its('is_fifo_queue') { should be false }\r\n  its('visibility_timeout') { should be 300 }\r\nend\r\n<\/pre>\n
The aws_sqs_queue<\/code> resource validates the presence of SQS queue using its URL. The it { should exist }<\/code> assertion confirms its existence, while its('delay_seconds') { should eq 0 }<\/code> test the delay time a specific attribute.The its('is_fifo_queue') { should be false }<\/code> tests if queue is fifo and its('visibility_timeout') { should be 300 } <\/code> tests visibility timeout of the message in seconds.<\/p>\n
\n
3.4. AWS Security Groups Resource:<\/h5>\n
Security Groups<\/a> acts like firewall that controls the traffic allowed to and from in your “Virtual Private Network(VPN)”<\/strong>
\nExample: The test verifies the existence of Security Group, tests specific incoming ports (such as 80, 443, 22, 7687, and 7474) are allowed, validates that the security group is associated with a designated VPC (Virtual Private Cloud).<\/p>\n
\r\ndescribe aws_security_group(group_id: 'sg-12345678') do\r\n  it { should exist }\r\n  it { should allow_in(port: 80) }\r\n  it { should allow_in(port: 443) }\r\n  it { should allow_in(port: 22) }\r\n  it { should allow_in(port: 7687) }\r\n  it { should allow_in(port: 7474) }\r\n  its ('vpc_id') { should eq 'vpc-12345678' }\r\nend\r\n<\/pre>\n
\n
3.5. AWS Lambda Resource:<\/h5>\n
AWS Lambda<\/a> function event-driven, serverless provided as part of Amazon Web Services.
\nExample: The test verifies the existence of Lambda, tests handler, Lambda version, runtime version and last modified. Please add the below lines to the ‘inspec.yml’.<\/p>\n
\r\nInputs:\r\n- name: lambdaname\r\n  description:  'lambda name'\r\n  type: string\r\n<\/pre>\n
In this inspec.yml block, you’re defining an input (attribute) named ‘lambdaname’. This attribute is used to pass the Lambda function name to your Chef InSpec profile during runtime. It is described with a description stating that it represents a Lambda function name. Its type is specified as a string.<\/p>\n
\r\n# Set a for an input.\r\nlambdaname =  input('lambdaname')\r\n\r\n# verify AWS Lambda Configuration\r\ntitle \"lambda config test\"\r\n \r\n# you add controls here\r\ncontrol \"aws-lambda-config\" do                      \r\n  impact 1.0                               \r\n  title \"verify lambda configuration\"                                       \r\n  describe aws_lambda(lambdaname) do\r\n    it { should exist}\r\n    its ('handler') { should eq 'main.on_event' }\r\n    its ('version') { should eq '$LATEST' }\r\n    its ('runtime') { should eq 'python3.9' }\r\n    its('last_modified') { should_not be_nil }\r\n  end\r\nend\r\n<\/pre>\n
The lambdaname = input('lambdaname')<\/code> this line assigns the value of the lambdaname attribute from the input (attribute) defined in the inspec.yml file to the local variable lambdaname. The impact 1.0<\/code> Specifies the impact level of the control. Here, an impact of 1.0 indicates high importance.
\nIn summary, this code dynamically fetches the Lambda function name using the input function, allowing you to provide the value during runtime. The Chef InSpec control then tests the configuration aspects of the specified AWS Lambda function using the aws_lambda<\/code> resource and various assertions. The “title” and “impact” attributes provide additional context about the purpose and importance of the tests being performed.<\/p>\n
Command to execute tests under blog_profile:<\/h6>\n
\r\ninspec exec blog_profile -t aws:\/\/\/ --input bucketname=\"\" lambdaname=<\"LAMBDA_FUNCTION_NAME\">\r\n<\/pre>\n
Note: This command will execute the S3 bucket and Lambda tests.<\/p>\n
\n
3.6. AWS EBS Volume Resource:<\/h5>\n
An Amazon EBS<\/a>(Elastic block-level Storage) Volume that can attach your instance is a durable, block-level storage device.
\nExample: The tests verifies existence, confirms that it is encrypted, checks that its size is greater than 50 GB, and ensures that the volume’s input\/output operations per second (IOPS) is set to exactly 300.<\/p>\n
\r\ndescribe aws_ebs_volume('vol-055a1d9e9b5619d78') do\r\n    it { should exist }\r\n    it { should be_encrypted }\r\n    its('size') { should be > 50 }\r\n    its('iops') { should cmp 300 }\r\nend\r\n<\/pre>\n
\n
3.7. AWS EC2 Instance Resource:<\/h5>\n
An Amazon EC2<\/a> is virtual service in Amazon web services terminology which can be used to provision a computer server within the AWS cloud.
\nExample: Test the instance is running, verifying image id, testing tags and the availability zone of an EC2 instance for the provided EC2 instance named ‘my-instance’.<\/p>\n
\r\ndescribe aws_ec2_instances(name: 'my-instance') do\r\n    it { should be_running }\r\n    its('image_id') { should eq 'ami-033a6e7ae709da8ad' }\r\n    its('tags') { should include( \"Name\"=>\"test\",\"Name1\"=>\"test-1\",\"Name2\"=>\"test-2\",\"Name3\"=>\"test-3\") }\r\n    its('availability_zone') { should eq 'us-east-1' }\r\nend\r\n<\/pre>\n
\n
3.8. AWS VPC Resource:<\/h5>\n
Use aws_vpc audit resource to test the properties of single VPC<\/a> and the CIDR Block that is used within the VPC.
\nExample: Verify that a VPC with ID “vpc-0123456789abcdef0” exists and has specific CIDR blocks.<\/p>\n
\r\ndescribe aws_vpc(vpc_id: 'vpc-0123456789abcdef0') do\r\n  it { should exist }\r\n  its('cidr_block') { should cmp '10.0.0.0\/16' }\r\nend\r\n<\/pre>\n
\n
3.9. AWS Elastic IP (EIP) Resource:<\/h5>\n
An Elastic IP<\/a> address is a static IPv4 address designed for dynamic cloud computing.
\nExample: Test whether an Elastic IP exists and is correctly associated with the expected EC2 instance.<\/p>\n
\r\nelastic_ip = ENV['ELASTIC_IP']\r\ninstance_id = ENV['INSTANCE_ID']\r\n\r\ncontrol 'Test AWS EC2 instance by providing elastic ip' do\r\n        impact 1.0\r\n        title 'Verify Elastic IP and associated instance ID'\r\n        desc 'Ensure Elastic IP exists and it is associated with the instance ID'\r\n        describe aws_ec2_eip(public_ip: elastic_ip) do\r\n                it { should exist }\r\n                its('instance_id') { should eq instance_id }\r\n        end\r\nend\r\n<\/pre>\n
The “elastic_ip” and “instance_id” retrieve the values of environment variables named ‘ELASTIC_IP’ and ‘INSTANCE_ID’ during the runtime. The use of environment variables allows flexibility in testing different instances and Elastic IPs.<\/p>\n
\n
3.10.AWS IAM User:<\/h5>\n
An IAM<\/a> user is an entity in AWS. IAM user is used to interact with AWS console access provided depends on the user permissions.
\nExample: Test the IAM user ‘johny’ exists and don’t have access key and inline policies attached to the IAM user. <\/p>\n
\r\ndescribe aws_iam_user('johny') do\r\n  it                         { should exist }\r\n  its('access_keys')         { should be_empty }\r\n  its('inline_policy_names') { should be_empty }\r\nend\r\n<\/pre>\n
\n
4.Conclusion<\/h4>\n
Infrastructure, especially incorrectly configured infrastructure, is a source of problems. With tools like Chef InSpec, testers now have a way to test for bugs and misconfigurations. I hope the examples in this post help you write tests for your infrastructure hosted on AWS. <\/p>\n
Hire Qxf2 testers for your infrastructure testing<\/h4>\n
Hiring Qxf2 for testing infrastructure brings you skilled experts who make sure your systems work smoothly and securely. We find issues before they become problems, ensuring your tech setup is dependable. Contact us<\/a> to know more.<\/p>\n
\n
References:<\/h4>\n
https:\/\/qxf2.com\/blog\/auditing-os-level-resources-with-chef-inspec-beginners-guide\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Continuing from the preceding blog, \u2018Auditing OS Level Resources with Chef InSpec\u2019 which delved into utilizing the Chef InSpec open-source tool for testing individual servers via OS level resources. Now, we embark into the domain of Chef InSpec\u2019s facility in cloud environments. Chef InSpec extends its support to cloud platforms like AWS, Azure, and GCP. Referring to insights shared in […]<\/p>\n","protected":false},"author":37,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[177,367,380,316],"tags":[],"class_list":["post-19594","post","type-post","status-publish","format-standard","hentry","category-aws","category-chef-inspec","category-iac","category-infrastructure"],"_links":{"self":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/comments?post=19594"}],"version-history":[{"count":88,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19594\/revisions"}],"predecessor-version":[{"id":21248,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19594\/revisions\/21248"}],"wp:attachment":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/media?parent=19594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/categories?post=19594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/tags?post=19594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}