aws_ebs_volume Resource

Use the aws_ebs_volume InSpec audit resource to test the properties of a single AWS EBS volume.

For additional information, including details on parameters and properties, see the AWS documentation on EBS.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

Ensure an EBS exists

describe aws_ebs_volume('VOLUME-01a2349e94458a507') do
  it { should exist }
end

You may also use hash syntax to pass the EBS volume name.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should exist }
end

This resource accepts a single parameter, either the EBS volume name or ID. mandatory

volume_id (required if name not provided): The EBS volume ID which uniquely identifies the volume. This can be passed as either a string or an volume_id: 'value' key-value entry in a hash.
name (required if volume_id not provided): The EBS volume name which uniquely identifies the volume. This must be passed as a name: 'value' key-value entry in a hash.

availability_zone: The availability zone for the volume.
encrypted: Indicates whether the volume is encrypted.
iops: The number of I/O operations per second (IOPS) that the volume supports.
kms_key_id: The full ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) is used to protect the encryption key for the volume.
size: The size of the volume in GiBs.
snapshot_id: The snapshot from which the volume is created, if applicable.
status: The volume state.
volume_type: The volume type.

Test that an EBS Volume does not exist.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should_not exist }
end

Test that an EBS Volume is encrypted.

describe aws_ebs_volume(name: 'SECURE_DATA-VOLUME') do
  it { should be_encrypted }
end

Test that an EBS Volume has the correct size.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  its('size') { should cmp 32 }
end

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should exist }
end

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should_not exist }
end

The be_encrypted matcher tests if the described EBS volume is encrypted.

it { should be_encrypted }

Your Principal will need the EC2:Client:DescribeVolumesResult action with Effect set to Allow.