aws_network_acls Resource

Use the aws_network_acls InSpec audit resource to test the properties of all Amazon network ACLs. To audit a single network ACL, use the aws_network_acl (singular) resource.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

Syntax

An aws_network_acls resource block collects a group of network ACL descriptions and then tests that group.

describe aws_network_acls
  it { should exist }
end

Parameters

This resource does not require any parameters.

Properties

network_acl_ids: The IDs of all network ACLs.; Field: network_acl_id
vpc_ids: The IDs of all the VPCs of the network ACLs.; Field: vpc_id
default: The boolean flag to say whether the network ACL is default or not.; Field: default
default_network_acl_ids: The default network ACL IDs for all the VPCs.; Field: default_network_acl_ids
associated_subnet_ids: The ID of the associated subnets to all the network ACLs.; Field: associated_subnet_ids
network_acl_association_ids: The ID of the association between the subnets and the network ACLs.; Field: network_acl_association_ids
entries_cidr_blocks: The IPv4 network range to allow or deny, in CIDR notation of all the network ACLs.; Field: entries_cidr_blocks
entries_icmp_type_codes: The ICMP code specified in the entry for all the network ACLs.; Field: entries_icmp_type_codes
entries_icmp_type_code_types: The ICMP type specified in the entry for all the network ACLs.; Field: entries_icmp_type_code_types
entries_ipv_6_cidr_blocks: The IPv6 network range to allow or deny, in CIDR notation of all the network ACLs.; Field: entries_ipv_6_cidr_blocks
entries_port_ranges: The ports specified in the entry for all the network ACLs.; Field: entries_port_ranges
entries_protocols: The protocol specified in the entry for all the network ACLs.; Field: entries_protocols
entries_rule_actions: The rule to allow or deny the matching traffic for all the network ACLs.; Field: entries_rule_actions
entries_rule_numbers: The rule number of all ACL entries.; Field: entries_rule_numbers
egress_rule_numbers: The rule number of all egress ACL entries.; Field: egress_rule_numbers
ingress_rule_numbers: The rule number of all ingress ACL entries.; Field: ingress_rule_numbers
owner_ids: The ID of all the AWS accounts that owns all the network ACLs.; Field: owner_ids
tags: A hash, with each key-value pair corresponding to a network ACL tag.; Field: tags

Examples

Ensure that exactly three network ACLs exist.

describe aws_network_acls do
  its('count') { should eq 3 }
end

Filter all network ACLs whose entries have rule number equal to 100.

describe aws_network_acls.where { entries_rule_numbers.include?(100) } do
    it { should exist }
end

Filter all default network ACLs.

describe aws_network_acls.where(default: true) do
    it { should exist }
end

Filter all network ACLs with associated subnet IDs matching subnet-07a323891825bc312.

describe aws_network_acls.where { associated_subnet_ids.include?('subnet-07a323891825bc312') } do
    it { should exist }
end

Filter all network ACLs with entries CIDR blocks matching 10.3.0.0/18.

describe aws_network_acls.where { entries_cidr_blocks.include?('10.3.0.0/18') } do
    it { should exist }
end

Request the IDs of all network ACLs, then test in-depth using aws_network_acl.

aws_network_acls.network_acl_ids.each do |network_acl_id|
  describe aws_network_acl(network_acl_id) do
    it { should be_default }
  end
end

Request the IDs of all network ACLs for rule number 100, then test in-depth using aws_network_acl.

aws_network_acls.where{ ingress_rule_numbers.include?(100) }.network_acl_ids.each do |network_acl_id|
  describe aws_network_acl(network_acl_id) do
    its('egress_rule_number_100.cidr_block') { should eq '10.3.0.0/18' }
    its('egress_rule_number_100.protocol') { should eq '6' }
    its('egress_rule_number_100.rule_action') { should eq 'allow' }
  end
end

Matchers

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

exist

The control will pass if the ‘describe’ method returns at least one result.

describe aws_network_acls.where( <property>: <value>) do
  it { should exist }
end

Use should_not to test an entity that should not exist.

describe aws_network_acls.where( <property>: <value>) do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the EC2:Client:DescribeNetworkAclsResult action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon ElastiCache, and Actions, Resources, and Condition Keys for Identity And Access Management.