Did you Know this About Chef Compliance and Chef Cloud Security - Part 3

Here is another snippet showing the usage of Chef InSpec input.

control 'bike_color_test' do
  impact 0.1
  title 'Our bike should match the specified color'
  # Set the Input value
  input('bike_color', value: 'blue’)
  describe('blue') do
    it { should cmp input('bike_color') }
  end
  describe input('bike_color') do
    it { should cmp 'blue’ }
  end
end 

Input values can be specified at multiple locations within a profile. The precedence of the input is determined by the place where it is set. If there are conflicting values, the value with the highest priority is used. The following table lists the default priority for input methods in order from lowest priority (20) to highest priority (50).

Additional information on input is available under the Chef InSpec section of this document.

InSpec and Cloud Resources

Chef InSpec includes several cloud providers with platform support and native InSpec resources.

Additional custom or community cloud resource packs can be used by specifying a dependency in the profile’s inspec.yml file, indicating the source location for the custom provider.

Now that we have covered the basics, we can look at creating profiles for AWS and writing controls for these. For each, we will:

1. Create a profile
2. Review profile
3. Add control
4. Execute profile

InSpec and AWS Cloud Resource

The first step is to create a profile that makes use of cloud resources. The process is similar to creating an OS InSpec profile. Command line support with pre-configured information and example resources are available for InSpec profiles for GCP, AWS and Azure.

The code below creates a profile to be used as a starting point for AWS scanning.

●      Name: The name of the InSpec profile that we will create (my-aws-profile).

●      Platform: The name of the platform we will use for this profile. Options are aws, azure, gcp and os (default).

# switch to a working directory to use for example creation
mkdir ~/inspec_cloud_resource_examples
cd ~/inspec_cloud_resource_examples
$ inspec init profile my-aws-profile --platform=aws

Output:

The newly created Chef InSpec profile has the baseline configuration which is required to start scanning against an AWS target defined in the “inspec.yml” file. The “depends” object identifies a reliance on the “inspec-aws” profile from GitHub which contains the resource pack contents.

# my-aws-profile/inspec.yml

name: my-aws-profile

title: AWS inspec Profile

maintainer: The Authors

copyright: The Authors

copyright_email: you@example.com

license: Apache-2.0

summary: An inspec Compliance Profile For AWS

version: 0.1.0

inspec_version: '~> 4’

inputs:

- name: aws_vpc_id

  required: false

  # Below is deliberately left as a default empty string to allow the profile to run when this is not provided.

  # Please see the README for more details.

  value: ''

  description: 'Optional Custom AWS VPC Id'

  type: string

depends:

  - name: inspec-aws

    url: https://github.com/inspec/inspec-aws/archive/master.tar.gz

supports:

  - platform: aws

Next, review the profile.

An example control file is created when generating the profile, it has a sample resource to help you get started. The controls created will perform checks to see if VPC objects exist and then checks to verify that the default security groups do not allow port 22 inbound (SSH).

Many of the Chef InSpec resources available in cloud resource packs have both a singular and plural version of the resources. In addition to the pre-generated controls, we can create additional controls.

In this example, let’s create a control to validate “multi-factor authentication is enabled for all user accounts.” This can be accomplished by using the plural aws_iam_users resource which allows testing for criteria against all discovered IAM user objects. This new control will be appended to our controls/example.rb file.

Additional information for this resource.

Testing profiles is an important step in the development process, as it helps provide insight to what controls are currently working. With Chef Workstation installed, testing can be performed locally (if credential access is available) to execute the new profile with InSpec exec:

This profile will be scanned against an AWS backend target so the option “-t aws://” is added to the Chef InSpec command. Adding the target option specifies what back-end type (using Train) should be used (default is the local OS). You will also need to provide the AWS credential information to Chef InSpec for scanning.

In the following example, AWS_REGION and AWS_PROFILE will be exported to the environment of the running shell. You can reference the AWS resource pack documentation for more details.

Summary

This blog series showcases the multitude of options available to you with Chef InSpec. In this post, we highlighted how Chef InSpec can be used to create cloud resource packs—specifically for AWS. The ability to write custom controls, create your own controls and use resource packs to obtain pre-defined controls, are several advantages of using Chef InSpec.

Dig deeper into the features and functionality of Chef InSpec by exploring the resources on Chef Docs and Learn Chef.