azure_subscription Resource

[edit on GitHub]

Use the azure_subscription InSpec audit resource to test properties of the current subscription.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Installation

This resource is available in the Chef InSpec Azure resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your Azure environment for InSpec and creating an InSpec profile that uses the InSpec Azure resource pack.

Syntax

This resource will retrieve the current subscription id that InSpec uses unless it is provided via id or resource_id parameters.

describe azure_subscription do
  it { should exist }
end

or

describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

or

describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Parameters

id

The ID of the target subscription. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

resource_id

The fully qualified ID for the subscription. /subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations_api_version

The endpoint api version for the locations property. Optional. The latest version will be used unless provided.

Properties

name

The subscription display name.

id

The subscription ID. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations

The list of all available geo-location names that have the metadata.physicalLocation is set.

all_locations

The list of all available geo-location names. This includes physical and logical locations.

physical_locations<superscript>*</superscript>

The list of all available geo-location names that have the metadata.regionType is set to Physical.

logical_locations

The list of all available geo-location names that have the metadata.regionType is set to Logical.

locations_list

The list of all available geo-location objects in this format.

managedByTenants

An array containing the tenants managing the subscription.

diagnostic_settings

The diagnostic settings set at a subcription level.

diagnostic_settings_enabled_logging

The enabled logging types from diagnostic settings set at a subcription level.

diagnostic_settings_disabled_logging

The disabled logging types from diagnostic settings set at a subcription level.

* physical_locations might be different than the locations property depending on the api version. This is because of the change in the Azure API terminology. It is advised to see the official documentation for more info.

For properties applicable to all resources, such as type, properties, refer to azure_generic_resource.

Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.), eg. properties.<attribute>.

Examples

Test Your Subscription`s Display Name.

describe azure_subscription do
  its('name') { should cmp 'Demo Resources' }
end

Test Your Subscription`s Authorization Source.

describe azure_subscription do
  its('authorizationSource') { should cmp 'RoleBased' }
end

Test Your Subscription`s Locations.

describe azure_subscription do
  its('locations') { should include('eastus') }
end

Test Your Subscription`s enabled logging types (via diagnostic settings).

describe azure_subscription do
  its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end

Test Your Subscription`s disabled logging types (via diagnostic settings).

describe azure_subscription do
  its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exists

# If we expect a resource to always exist

describe azure_subscription do
  it { should exist }
end
# If we expect a resource to never exist

describe azure_subscription(id: 'fake_id') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.