aws_launch_configuration Resource

Use the aws_launch_configuration InSpec audit resource to test properties of a single AWS Launch Configuration.

For additional information, including details on parameters and properties, see the AWS documentation on Launch Configurations.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

# Ensure that a launch configuration exists and has the correct key name

describe aws_launch_configuration('my-config') do
  it              { should exist }
  its('key_name') { should be 'my-key-name' }
end

# You may also use hash syntax to pass the launch configuration name

describe aws_launch_configuration(launch_configuration_name: 'my-config') do
  it              { should exist }
end

launch_configuration_name (required): This resource expects a single parameter, the launch_configuration_name which uniquely identifies the of a Launch Configuration.

arn: An string indicating the ARN of the launch configuration.
image_id: An string indicating the AMI of the launch configuration.
instance_type: A string indicating the instance type of the launch configuration.
iam_instance_profile: A string indicating the IAM profile for the launch configuration.
key_name: A string indicating the AWS key pair for the launch configuration.
security_groups: An array of strings of the security group IDs associated with the launch configuration.
associate_public_ip_address: A boolean indicating if the launch configuration is configured to set a public IP address.
user_data: A string containing the user data configured for the launch configuration.
ebs_optimized: A boolean indicating if the launch configuration is optimized for Amazon EBS.
instance_monitoring: A string indicating if instance monitoring is set to detailed or basic.
spot_price: A floating point number indicating the spot price configured.

Ensure a Launch Config is using the correct AMI .

describe aws_launch_configuration('my-config') do
  its('image_id') { should eq 'ami-012345'}
end

Test the instance type used in a Launch Config.

describe aws_launch_configuration('my-config') do
  its('instance_type') { should eq 't3.micro'}
end

Ensure a Launch Config is associated with the right IAM Profile.

describe aws_launch_configuration('my-config') do
  its('iam_instance_profile') { should eq 'iam-profile' }
end

Ensure the Launch Config does not set a public IP.

describe aws_launch_configuration('my-config') do
  its('associate_public_ip_address') { should be false }
end

Ensure the correct UserData is set on launched instances.

describe aws_launch_configuration('my-config') do
  its('user_data') { should include 'user-data' }
end

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_launch_configuration('AnExistingLC') do
  it { should exist }
end

describe aws_launch_configuration('ANonExistentLC') do
  it { should_not exist }
end

Your Principal will need the AutoScaling:Client:LaunchConfigurationsType action with Effect set to Allow.