azure_ddos_protection_resources Resource

[edit on GitHub]

Use the azure_ddos_protection_resources InSpec audit resource to test properties of DDoS protection plans in a resource group.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Installation

This resource is available in the Chef InSpec Azure resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your Azure environment for InSpec and creating an InSpec profile that uses the InSpec Azure resource pack.

Syntax

An azure_ddos_protection_resources resource block returns all Azure bastion hosts, either within a Resource Group (if provided)

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
   #....
end

Parameters

resource_group

Azure resource group that the targeted resource resides in.

Properties

names

A list of the unique resource names.

Field: name

ids

A list of DDoS protection plan IDs.

Field: id

virtual_networks

The list of virtual networks associated with the DDoS protection plan resource.

Field: virtual_networks

provisioning_states

The provisioning states of the DDoS protection plans.

Field: provisioning_state

types

The types of all the DDoS protection plans.

Field: type

resource_guids

The resource GUID property of the DDoS protection plan resource. It uniquely identifies the resource, even if the user changes its name or migrate the resource across subscriptions or resource groups.

Field: resource_guid

Also, refer to the Azure documentation for all available properties. Access any attribute in the response by separating the key names with a period (.).

Examples

Ensure that the DDoS protection plan resource is in successful state.

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  its('provisioning_states') { should include('Succeeded') }
end

Ensure that a DDoS protection plan resource is from a location.

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  its('location') { should include `RESOURCE_LOCATION` }
end

Test if any DDoS protection plan exists in the resource group.

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  it { should exist }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exists

# Should not exist if no bastion hots are in the resource group

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.