Bump Inspec, Adds Azurerm Disks Plural resource

.travis.yml

@@ -3,7 +3,6 @@ branches:
   only:
   - master
 rvm:
-  - 2.3
   - 2.4.4
   - 2.5
   - 2.6

Gemfile

@@ -5,7 +5,7 @@ source 'https://rubygems.org'
 gem 'activesupport',       '~> 5.2.3'
 gem 'faraday',             '~> 0.15.0'
 gem 'faraday_middleware',  '~> 0.12.2'
-gem 'inspec',              '~> 3.0', '>= 3.0.9'
+gem 'inspec-bin'
 gem 'rake',                '~> 12.3', '>= 12.3.1'
 
 group :development do

README.md

@@ -42,7 +42,8 @@ To create your account Service Principal Account:
 14. Select the `contributor` role.
 15. Select the application you just created and save.
 
-These must be stored in a environment variables prefaced with `AZURE_`.  If you use Dotenv then you may save these values in your own `.envrc` file. Either source it or run `direnv allow`. If you don't use Dotenv then you may just create environment variables in the way that your prefer.
+These must be stored in a environment variables prefaced with `AZURE_`.  If you use Dotenv then you may save these values in your own `.envrc` file. 
+Either source it or run `direnv allow`. If you don't use Dotenv then you may just create environment variables in the way that your prefer.
 
 ### Use the Resources
 
@@ -113,7 +114,7 @@ The following resources are available in the InSpec Azure Resource Pack
 - [azurerm_key_vault_key](docs/resources/azurerm_key_vault_key.md.erb)
 - [azurerm_key_vault_keys](docs/resources/azurerm_key_vault_keys.md.erb)
 - [azurerm_key_vault_secret](docs/resources/azurerm_key_vault_secret.md.erb)
-- [azurerm_key_vault_secrets](docs/resources/azurerm_key_vault_secrets.md)
+- [azurerm_key_vault_secrets](docs/resources/azurerm_key_vault_secrets.md.erb)
 - [azurerm_key_vaults](docs/resources/azurerm_key_vaults.md.erb)
 - [azurerm_locks](docs/resources/azurerm_locks.md.erb)
 - [azurerm_management_group](docs/resources/azurerm_management_group.md.erb)
@@ -130,6 +131,10 @@ The following resources are available in the InSpec Azure Resource Pack
 - [azurerm_network_security_groups](docs/resources/azurerm_network_security_groups.md.erb)
 - [azurerm_network_watcher](docs/resources/azurerm_network_watcher.md.erb)
 - [azurerm_network_watchers](docs/resources/azurerm_network_watchers.md.erb)
+- [azurerm_postgresql_database](docs/resources/azurerm_postgresql_database.md.erb)
+- [azurerm_postgresql_databases](docs/resources/azurerm_postgresql_databases.md.erb)
+- [azurerm_postgresql_server](docs/resources/azurerm_postgresql_server.md.erb)
+- [azurerm_postgresql_servers](docs/resources/azurerm_postgresql_servers.md.erb)
 - [azurerm_resource_groups](docs/resources/azurerm_resource_groups.md.erb)
 - [azurerm_role_definition](docs/resources/azurerm_role_definition.md.erb)
 - [azurerm_role_definitions](docs/resources/azurerm_role_definitions.md.erb)
@@ -143,8 +148,10 @@ The following resources are available in the InSpec Azure Resource Pack
 - [azurerm_storage_account_blob_containers](docs/resources/azurerm_storage_account_blob_containers.md.erb)
 - [azurerm_subnet](docs/resources/azurerm_subnet.md.erb)
 - [azurerm_subnets](docs/resources/azurerm_subnets.md.erb)
+- [azurerm_subscription](docs/resources/azurerm_subscription.md.erb)
 - [azurerm_virtual_machine](docs/resources/azurerm_virtual_machine.md.erb)
 - [azurerm_virtual_machine_disk](docs/resources/azurerm_virtual_machine_disk.md.erb)
+- [azurerm_virtual_machine_disks](docs/resources/azurerm_virtual_machine_disks.md.erb)
 - [azurerm_virtual_machines](docs/resources/azurerm_virtual_machines.md.erb)
 - [azurerm_virtual_network](docs/resources/azurerm_virtual_network.md.erb)
 - [azurerm_virtual_networks](docs/resources/azurerm_virtual_networks.md.erb)

Rakefile

@@ -101,14 +101,15 @@ end
 namespace :test do
 
   Rake::TestTask.new(:unit) do |t|
+    puts '-> Running Unit Tests'
     t.libs << 'test/unit'
     t.libs << 'libraries'
     t.test_files = FileList['test/unit/**/*_test.rb']
   end
 
-  task :integration, [:controls] => ['attributes:write', :lint, :setup_env] do |_t, args|
+  task :integration, [:controls] => [:lint, :unit, 'attributes:write', :setup_env] do |_t, args|
     cmd = %W( bin/inspec exec test/integration/verify
-              --attrs terraform/#{ENV['ATTRIBUTES_FILE']}
+              --input-file terraform/#{ENV['ATTRIBUTES_FILE']}
               --reporter progress
               --no-distinct-exit
               -t azure://#{ENV['AZURE_SUBSCRIPTION_ID']} )

docs/resource_creation_guide.md

@@ -65,7 +65,7 @@ Consider the following:
   - At the top attributes are defined for each property that will be tested.
   - The control is the InSpec control that will be tested when the integration test is run.
 - The attributes at the top associate an InSpec variable with an attribute as defined in Terraform.
-  - The attribute statements take the form of `var = attribute('tf_output', default: nil)`.
+  - The attribute statements take the form of `var = input('tf_output', value: nil)`.
   - Attributes' default statements should, for the most part, be nil.
 - Within the control, there should be three describe statements:
   - A `describe` statement that includes all of the available properties to be tested
@@ -77,11 +77,11 @@ Consider the following:
 - Update variables and Terraform outputs as needed.
 
 ```
-resource_group = attribute('resource_group',  default: nil)
-subnet         = attribute('subnet_name',     default: nil)
-tags           = attribute('subnet_tags',     default: nil)
-id             = attribute('subnet_id',       default: nil)
-location       = attribute('subnet_location', default: nil)
+resource_group = input('resource_group',  value: nil)
+subnet         = input('subnet_name',     value: nil)
+tags           = input('subnet_tags',     value: nil)
+id             = input('subnet_id',       value: nil)
+location       = input('subnet_location', value: nil)
 
 control 'azurerm_subnet' do
   describe azurerm_subnet(resource_group: resource_group, name: subnet) do

docs/resources/azurerm_ad_users.md.erb

@@ -73,7 +73,7 @@ The following examples show how to use this InSpec audit resource.
 
 ### names
 
-Filters the results to include only those resource groups that match the given
+Filters the results to include only those Users that match the given
 name. This is a string value.
 
     describe azurerm_ad_users.where{ displayName.eql?('Joe Bloggs') } do

docs/resources/azurerm_virtual_machine_disks.md.erb

@@ -0,0 +1,98 @@
+---
+title: About the azurerm_virtual_machine_disks Resource
+platform: azure
+---
+
+# azurerm_virtual_machine_disks
+
+Use the `azurerm_virtual_machine_disks` InSpec audit resource to test properties of
+some or all Azure Disks within a subscription.
+
+<br />
+
+## Azure REST API version
+
+This resource interacts with version `2019-03-01` of the Azure
+Management API. For more information see the [official Azure documentation](https://docs.microsoft.com/en-us/rest/api/compute/disks/list).
+
+At the moment, there doesn't appear to be a way to select the version of the
+Azure API docs. If you notice a newer version being referenced in the official
+documentation please open an issue or submit a pull request using the updated
+version.
+
+## Availability
+
+### Installation
+
+This resource is available in the `inspec-azure` [resource
+pack](https://www.inspec.io/docs/reference/glossary/#resource-pack). To use it, add the
+following to your `inspec.yml` in your top-level profile:
+
+    depends:
+      - name: inspec-azure
+        git: https://github.com/inspec/inspec-azure.git
+
+You'll also need to setup your Azure credentials; see the resource pack
+[README](https://github.com/inspec/inspec-azure#inspec-for-azure).
+
+### Version
+
+This resource first became available in 1.8.0 of the inspec-azure resource pack.
+
+## Syntax
+
+An `azurerm_virtual_machine_disks` resource block returns all Azure Disks in a subscription.
+
+    describe azurerm_virtual_machine_disks do
+      ...
+    end
+
+<br />
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Check a Disk exists
+
+    describe azurerm_virtual_machine_disks do
+      it('names') { should include 'app-server-disk' }
+    end
+
+### Ensure there are no detached disks
+
+    describe azurerm_virtual_machine_disks.where { attached == true } do
+      it { should_not exist }
+    end
+
+<br />
+
+## Filter Criteria
+
+* `ids`
+* `names`
+* `properties`
+* `tags`
+* `locations`
+* `attached`
+* `resource_groups`
+
+## Matchers
+
+This InSpec audit resource has the following special matchers. For a full list of available matchers,
+please visit our [Universal Matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### exists
+
+The control will pass if the filter returns at least one result. Use
+`should_not` if you expect zero matches.
+
+    describe azurerm_virtual_machine_disks.where { <filter> == <criteria> } do
+      it { should exist }
+    end
+
+## Azure Permissions
+
+Your [Service
+Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal)
+must be setup with a `contributor` role on the subscription you wish to test.

libraries/azurerm_monitor_activity_log_alert.rb

@@ -17,6 +17,7 @@ class AzurermMonitorActivityLogAlert < AzurermSingularResource
     id
     conditions
     operations
+    scopes
   ).freeze
 
   attr_reader(*ATTRS)
@@ -28,11 +29,16 @@ def initialize(resource_group: nil, name: nil)
     @name       = resp.name
     @id         = resp.id
     @conditions = resp.properties.condition.allOf
+    @scopes     = resp.properties.scopes
+    @enabled    = resp.properties.enabled
     @operations = collect_operations(@conditions)
-
     @exists = true
   end
 
+  def enabled?
+    @enabled
+  end
+
   def to_s
     "#{name} Activity Log Alert"
   end

libraries/azurerm_monitor_activity_log_alerts.rb

@@ -16,6 +16,7 @@ class AzurermMonitorActivityLogAlerts < AzurermPluralResource
   FilterTable.create
              .register_column(:names, field: 'name')
              .register_column(:resource_group, field: 'resource_group')
+             .register_column(:location, field: 'location')
              .register_column(:operations, field: 'operations')
              .install_filter_methods_on_resource(self, :table)
 
@@ -36,7 +37,7 @@ def to_s
   def with_resource_group
     lambda do |group|
       # Get resource group from ID string
-      name = group.id.split('/')[4]
+      name = id_to_h(group.id)[:resource_groups]
       Azure::Response.create(group.members << :resource_group, group.values << name)
     end
   end

libraries/azurerm_monitor_log_profile.rb

@@ -35,10 +35,9 @@ def initialize(options = { name: 'default' })
     @retention_days    = resp.properties.retentionPolicy.days
     @retention_enabled = resp.properties.retentionPolicy.enabled
     @properties        = resp.properties
-    @storage_account   = {
-      name: resp.properties.storageAccountId.split('/')[-1],
-        resource_group: resp.properties.storageAccountId.split('/')[-5],
-    }
+
+    sa = id_to_h(resp.properties.storageAccountId)
+    @storage_account = { name: sa[:storage_accounts], resource_group: sa[:resource_groups] }
     @exists = true
   end
 

libraries/azurerm_resource.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'support/azure'
+require 'active_support/core_ext/string/inflections'
 
 class AzurermResource < Inspec.resource(1)
   name 'azurerm_resource'
@@ -44,6 +45,32 @@ def assign_fields_with_map(map, struct)
       instance_variable_set("@#{name}", struct.key?(api_name) ? struct[api_name] : nil)
     end
   end
+
+  # Converts the given Azure ID to a hash representation such that:
+  # "/subscriptions/xxx/resourceGroups/my-rg/providers/Microsoft.Compute/disks/my-disk"
+  # becomes {:subscriptions => 'xxx', :resource_groups => 'my-rg', :providers => 'Microsoft.Compute', :disks => 'my-disk'}
+  def id_to_h(azure_id)
+    raise ArgumentError, "`#{azure_id}` is not a valid Azure ID." unless !azure_id.nil? && azure_id.start_with?('/subscriptions')
+
+    begin
+      split = azure_id.split('/').reject!(&:empty?)
+      raise unless !split.empty? && split.length.even?
+      hash = {}
+
+      i = 0
+      counter = 0
+      while counter < split.length/2
+        k = split[i].underscore.to_sym
+        v = split[i+1]
+        hash[k] = v
+        i += 2
+        counter += 1
+      end
+      hash
+    rescue StandardError => e
+      raise ArgumentError, "Unable to convert Azure ID `#{azure_id}` to hash: \n #{e.message}"
+    end
+  end
 end
 
 class AzurermPluralResource < AzurermResource

libraries/azurerm_subnet.rb

@@ -34,7 +34,8 @@ def address_prefix
   end
 
   def nsg
-    properties.networkSecurityGroup.id.split('/')[-1]
+    return nil unless properties.respond_to?(:networkSecurityGroup)
+    @nsg ||= id_to_h(properties.networkSecurityGroup.id)[:network_security_groups]
   end
 
   def to_s

libraries/azurerm_virtual_machine_disks.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'azurerm_resource'
+require 'json'
+
+class AzurermVirtualMachineDisks < AzurermPluralResource
+  name 'azurerm_virtual_machine_disks'
+  desc 'Verifies settings for a collection of Azure VM Disks'
+  example <<-EXAMPLE
+    describe azurerm_virtual_machine_disks do
+        it  { should exist }
+    end
+  EXAMPLE
+
+  attr_reader :table
+
+  FilterTable.create
+             .register_column(:ids,            field: :id)
+             .register_column(:names,          field: :name)
+             .register_column(:properties,     field: :properties)
+             .register_column(:tags,           field: :tags)
+             .register_column(:locations,      field: :location)
+             .register_column(:attached,       field: :attached)
+             .register_column(:resource_group, field: :resource_group)
+             .install_filter_methods_on_resource(self, :table)
+
+  def initialize
+    resp = management.virtual_machine_disks
+    return if has_error?(resp)
+
+    resp.map!(&:to_h).each do |disk|
+      disk[:attached]       = disk[:properties][:diskState].eql?('Attached')
+      disk[:resource_group] = id_to_h(disk[:id])[:resource_groups]
+    end
+
+    @table = resp
+  end
+
+  def to_s
+    'Azure VM Disks'
+  end
+end

libraries/support/azure/management.rb

@@ -480,6 +480,13 @@ def virtual_machine_disk(resource_group, id)
       )
     end
 
+    def virtual_machine_disks
+      get(
+        url: link(location: 'Microsoft.Compute/disks'),
+        api_version: '2019-03-01',
+      )
+    end
+
     def webapp(resource_group, webapp_name)
       get(
         url: link(location: "Microsoft.Web/sites/#{webapp_name}",

test/integration/verify/controls/azurerm_ad_users.rb

@@ -1,4 +1,4 @@
-guest_accounts = attribute('guest_accounts', default: nil)
+guest_accounts = input('guest_accounts', value: nil)
 
 control 'azurerm_ad_users' do
   only_if { ENV['GRAPH'] }

test/integration/verify/controls/azurerm_aks_cluster.rb

@@ -1,5 +1,5 @@
-resource_group = attribute('resource_group', default: nil)
-cluster_fqdn   = attribute('cluster_fqdn',   default: nil)
+resource_group = input('resource_group', value: nil)
+cluster_fqdn   = input('cluster_fqdn',   value: nil)
 
 control 'azurerm_aks_cluster' do
   describe azurerm_aks_cluster(resource_group: resource_group, name: 'inspecakstest') do

test/integration/verify/controls/azurerm_aks_clusters.rb

@@ -1,4 +1,4 @@
-resource_group = attribute('resource_group', default: nil)
+resource_group = input('resource_group', value: nil)
 
 control 'azurerm_aks_clusters' do
   describe azurerm_aks_clusters(resource_group: resource_group) do