Skip to content

Latest commit

 

History

History
128 lines (107 loc) · 5.7 KB

azure_subscription.md

File metadata and controls

128 lines (107 loc) · 5.7 KB
Raw
title platform
About the azure_subscription Resource
azure

azure_subscription

Use the azure_subscription InSpec audit resource to test properties of the current subscription.

Azure REST API version, endpoint and http client parameters

This resource interacts with api versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, the latest version will be used. For more information, refer to azure_generic_resource.

Unless defined, azure_cloud global endpoint, and default values for the http client will be used. For more information, refer to the resource pack README.

Availability

Installation

This resource is available in the InSpec Azure resource pack. For an example inspec.yml file and how to set up your Azure credentials, refer to resource pack README.

Syntax

This resource will retrieve the current subscription id that InSpec uses unless it is provided via id or resource_id parameters.

describe azure_subscription do
  it { should exist }
end

or

describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

or

describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Parameters

Name Description
id The ID of the target subscription. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd
resource_id The fully qualified ID for the subscription. /subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd
locations_api_version The endpoint api version for the locations property. Optional. The latest version will be used unless provided.

Properties

Property Description
name The subscription display name.
id The subscription ID. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd
locations The list of all available geo-location names that have the metadata.physicalLocation is set.
all_locations The list of all available geo-location names. This includes physical and logical locations.
physical_locations* The list of all available geo-location names that have the metadata.regionType is set to Physical.
logical_locations The list of all available geo-location names that have the metadata.regionType is set to Logical.
locations_list The list of all available geo-location objects in this format.
managedByTenants An array containing the tenants managing the subscription.
diagnostic_settings The diagnostic settings set at a subcription level.
diagnostic_settings_enabled_logging The enabled logging types from diagnostic settings set at a subcription level.
diagnostic_settings_disabled_logging The disabled logging types from diagnostic settings set at a subcription level.

* physical_locations might be different than the locations property depending on the api version. This is because of the change in the Azure API terminology. It is advised to see the official documentation for more info.

For properties applicable to all resources, such as type, properties, refer to azure_generic_resource.

Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.), eg. properties.<attribute>.

Examples

Test Your Subscription`s Display Name

describe azure_subscription do
  its('name') { should cmp 'Demo Resources' }
end

Test Your Subscription`s Authorization Source

describe azure_subscription do
  its('authorizationSource') { should cmp 'RoleBased' }
end

Test Your Subscription`s Locations

describe azure_subscription do
  its('locations') { should include('eastus') }
end

Test Your Subscription`s enabled logging types (via diagnostic settings)

describe azure_subscription do
  its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end

Test Your Subscription`s disabled logging types (via diagnostic settings)

describe azure_subscription do
  its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exists

# If we expect a resource to always exist
describe azure_subscription do
  it { should exist }
end
# If we expect a resource to never exist
describe azure_subscription(id: 'fake_id') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be setup with a contributor role on the subscription you wish to test.