aws_launch_configuration resource

[edit on GitHub]

Use the aws_launch_configuration InSpec audit resource to test properties of a single AWS Launch Configuration.

Syntax

# Ensure that a launch configuration exists and has the correct key name
describe aws_launch_configuration('my-config') do
  it              { should exist }
  its('key_name') { should be 'my-key-name' }
end

# You may also use hash syntax to pass the launch configuration name
describe aws_launch_configuration(launch_configuration_name: 'my-config') do
  it              { should exist }
end

Parameters

launch_configuration_name (required)

This resource expects a single parameter, the launch_configuration_name which uniquely identifies the of a Launch Configuration.

See also the AWS documentation on Launch Configurations.

Properties

Examples

Ensure a Launch Config is using the correct AMI

describe aws_launch_configuration('my-config') do
  its('image_id') { should eq 'ami-012345'}
end

Test the instance type used in a Launch Config

describe aws_launch_configuration('my-config') do
  its('instance_type') { should eq 't3.micro'}
end

Ensure a Launch Config is associated with the right IAM Profile

describe aws_launch_configuration('my-config') do
  its('iam_instance_profile') { should eq 'iam-profile' }
end

Ensure the Launch Config does not set a public IP

describe aws_launch_configuration('my-config') do
  its('associate_public_ip_address') { should be false }
end

Ensure the correct UserData is set on launched instances

describe aws_launch_configuration('my-config') do
  its('user_data') { should include 'user-data' }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_launch_configuration('AnExistingLC') do
  it { should exist }
end

describe aws_launch_configuration('ANonExistentLC') do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the autoscaling:Describe* action with Effect set to Allow. You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon Auto Scaling Groups and launch configurations.