aws_flow_log Resource

Use the aws_flow_log InSpec audit resource to test properties of a single Flow Log.

For additional information, including details on parameters and properties, see the AWS documentation on Flow Logs.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

describe aws_flow_log(flow_log_id: 'fl-9c718cf5') do
  it { should exist }
end

This resource requires at least one of the following parameters to be provided: flow_log_id, subnet_id, vpc_id.

flow_log_id (required if no other parameters provided): The Flow Log ID which uniquely identifies the Flow Log. This can be passed either as a string or as a flow_log_id: 'value' key-value entry in a hash.
subnet_id (required if no other parameters provided): The subnet associated with the Flow Log, if applicable. This must be passed as a subnet_id: 'value' key-value entry in a hash.
vpc_id (required if no other parameters provided): The VPC associated with the Flow Log, if applicable. This must be passed as a vpc_id: 'value' key-value entry in a hash.

flow_log_id: The ID of the Flow Log.
log_group_name: The name of the associated log group.
resource_id: The ID of the assosiated resource, e.g. VPC, Subnet or Network Interface.

Search for a flow log by the associated subnet id.

describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
  it { should exist }
end

Search for a flow log by the associated VPC id.

describe aws_flow_log(vpc_id: 'vpc-96cabaef') do
  it { should exist }
end

Ensure the correct Flow Log is associated with a Subnet.

describe aws_flow_log(subnet_id: 'subnet-c6a4319c') do
  its('flow_log_id') { should cmp 'fl-9c718cf5' }
end

Ensure the Flow Log is associated with the correct resource type.

describe aws_flow_log('fl-9c718cf5') do
  its('resource_type') { should cmp 'subnet' }
end

For a full list of available matchers, visit the InSpec matchers page.

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_flow_log('AnExistingFlowLog') do
  it { should exist }
end

describe aws_flow_log('ANonExistentFlowLog') do
  it { should_not exist }
end

Indicates that the Flow Log is attached to a ENI resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_eni }
end

Indicates that the Flow Log is attached to a subnet resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_subnet }
end

Indicates that the Flow Log is attached to a vpc resource.

describe aws_flow_log('fl-9c718cf5') do
  it { should be_attached_to_vpc }
end

Your Principal will need the EC2:Client:DescribeFlowLogsResult action with Effect set to Allow.