aws_ebs_volume Resource

[edit on GitHub]

Use the aws_ebs_volume InSpec audit resource to test the properties of a single AWS EBS volume.

For additional information, including details on parameters and properties, see the AWS documentation on EBS.

Installation

This resource is available in the Chef InSpec AWS resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your AWS environment for InSpec and creating an InSpec profile that uses the InSpec AWS resource pack.

Syntax

Ensure an EBS exists

describe aws_ebs_volume('VOLUME-01a2349e94458a507') do
  it { should exist }
end

You may also use hash syntax to pass the EBS volume name.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should exist }
end

Parameters

This resource accepts a single parameter, either the EBS volume name or ID. mandatory

volume_id (required if name not provided)

The EBS volume ID which uniquely identifies the volume. This can be passed as either a string or an volume_id: 'value' key-value entry in a hash.

name (required if volume_id not provided)

The EBS volume name which uniquely identifies the volume. This must be passed as a name: 'value' key-value entry in a hash.

Properties

availability_zone

The availability zone for the volume.

encrypted

Indicates whether the volume is encrypted.

iops

The number of I/O operations per second (IOPS) that the volume supports.

kms_key_id

The full ARN of the AWS Key Management Service (AWS KMS) customer master key (CMK) is used to protect the encryption key for the volume.

size

The size of the volume in GiBs.

snapshot_id

The snapshot from which the volume is created, if applicable.

status

The volume state.

volume_type

The volume type.

Examples

Test that an EBS Volume does not exist.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should_not exist }
end

Test that an EBS Volume is encrypted.

describe aws_ebs_volume(name: 'SECURE_DATA-VOLUME') do
  it { should be_encrypted }
end

Test that an EBS Volume has the correct size.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  its('size') { should cmp 32 }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should exist }
end

describe aws_ebs_volume(name: 'DATA-VOLUME') do
  it { should_not exist }
end

be_encrypted

The be_encrypted matcher tests if the described EBS volume is encrypted.

it { should be_encrypted }

AWS Permissions

Your Principal will need the EC2:Client:DescribeVolumesResult action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2, and Actions, Resources, and Condition Keys for Identity And Access Management.