Skip to main content

aws_flow_log Resource

Use the aws_flow_log InSpec audit resource to test properties of a single Flow Log.

For additional information, including details on parameters and properties, see the AWS documentation on Flow Logs.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

Syntax

describe aws_flow_log(flow_log_id: 'fl-9c718cf5') do
  it { should exist }
end

Parameters

This resource requires at least one of the following parameters to be provided: flow_log_id, subnet_id, vpc_id.

flow_log_id (required if no other parameters provided)

The Flow Log ID which uniquely identifies the Flow Log. This can be passed either as a string or as a flow_log_id: 'value' key-value entry in a hash.

subnet_id (required if no other parameters provided)

The subnet associated with the Flow Log, if applicable. This must be passed as a subnet_id: 'value' key-value entry in a hash.

vpc_id (required if no other parameters provided)

The VPC associated with the Flow Log, if applicable. This must be passed as a vpc_id: 'value' key-value entry in a hash.

Properties

flow_log_id
The ID of the Flow Log.
log_group_name
The name of the associated log group.
resource_id
The ID of the assosiated resource, e.g. VPC, Subnet or Network Interface.

Examples

Search for a flow log by the associated subnet id.

describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
  it { should exist }
end

Search for a flow log by the associated VPC id.

describe aws_flow_log(vpc_id: 'vpc-96cabaef') do
  it { should exist }
end

Ensure the correct Flow Log is associated with a Subnet.

describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
  its('flow_log_id') { should cmp 'fl-9c718cf5' }
end

Ensure the Flow Log is associated with the correct resource type.

describe aws_flow_log('fl-9c718cf5') do
  its('resource_type') { should cmp 'subnet' }
end

Matchers

For a full list of available matchers, visit the InSpec matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_flow_log('AnExistingFlowLog') do
  it { should exist }
end
describe aws_flow_log('ANonExistentFlowLog') do
  it { should_not exist }
end

be_attached_to_eni

Indicates that the Flow Log is attached to a ENI resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_eni }
end

be_attached_to_subnet

Indicates that the Flow Log is attached to a subnet resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_subnet }
end

be_attached_to_vpc

Indicates that the Flow Log is attached to a vpc resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_vpc }
end

AWS Permissions

Your Principal will need the EC2:Client:DescribeFlowLogsResult action with Effect set to Allow.

Edit this page on GitHub

Thank you for your feedback!

×










Search Results