Class: Awspec::Generator::Spec::SecurityGroup

Inherits:
Object
  • Object
show all
Includes:
Helper::Finder
Defined in:
lib/awspec/generator/spec/security_group.rb

Instance Attribute Summary

Attributes included from Helper::Finder

#ec2_client

Instance Method Summary collapse

Methods included from Helper::Finder

#initialize

Methods included from Helper::Finder::Cloudwatch

#find_cloudwatch_alarm

Methods included from Helper::Finder::Elasticache

#find_cache_cluster, #find_cache_subnet_group

Methods included from Helper::Finder::Iam

#select_all_attached_policies, #select_attached_entities, #select_attached_groups, #select_attached_roles, #select_attached_users, #select_iam_group_by_user_name, #select_iam_policy_by_group_name, #select_iam_policy_by_role_name, #select_iam_policy_by_user_name, #select_policy_evaluation_results

Methods included from Helper::Finder::Lambda

#find_lambda, #select_event_source_by_function_arn

Methods included from Helper::Finder::Elb

#find_elb, #select_elb_by_vpc_id

Methods included from Helper::Finder::Ebs

#find_ebs, #select_ebs_by_instance_id

Methods included from Helper::Finder::AutoScaling

#find_auto_scaling_group

Methods included from Helper::Finder::S3

#find_bucket

Methods included from Helper::Finder::Route53

#find_hosted_zone

Methods included from Helper::Finder::Rds

#find_rds, #select_rds_by_vpc_id

Methods included from Helper::Finder::SecurityGroup

#find_security_group, #select_security_group_by_vpc_id

Methods included from Helper::Finder::Ec2

#find_ec2, #find_ec2_attribute, #find_internet_gateway, #find_security_group, #find_subnet, #select_ec2_by_vpc_id, #select_eip_by_instance_id

Methods included from Helper::Finder::Vpc

#find_network_acl, #find_route_table, #find_vpc, #select_network_acl_by_vpc_id, #select_route_table_by_vpc_id

Instance Method Details

#generate_by_vpc_id(vpc_id) ⇒ Object 



5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 
# File 'lib/awspec/generator/spec/security_group.rb', line 5

def generate_by_vpc_id(vpc_id)
  describes = %w(
    group_id group_name
  )
  vpc = find_vpc(vpc_id)
  fail 'Not Found VPC' unless vpc
  @vpc_id = vpc[:vpc_id]
  @vpc_tag_name = vpc.tag_name
  sgs = select_security_group_by_vpc_id(@vpc_id)

  specs = sgs.map do |sg|
    linespecs = generate_linespecs(sg)
    content = ERB.new(security_group_spec_template, nil, '-').result(binding).gsub(/^\n/, '')
  end
  specs.join("\n")
end

#generate_linespecs(sg) ⇒ Object 



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/awspec/generator/spec/security_group.rb', line 22

def generate_linespecs(sg)
  linespecs = []
  permissions = { 'inbound' => sg.ip_permissions, 'outbound' => sg.ip_permissions_egress }
  %w(inbound outbound).each do |inout|
    permissions[inout].each do |permission|
      if permission.ip_protocol.to_i < 0 || permission.from_port.nil?
        linespecs.push('its(:' + inout + ') { should be_opened }')
        next
      end
      port = permission.from_port
      protocol = permission.ip_protocol
      permission.ip_ranges.each do |ip_range|
        target = ip_range.cidr_ip
        linespecs.push(ERB.new(security_group_spec_linetemplate, nil, '-').result(binding))
      end
      permission.user_id_group_pairs.each do |group|
        target = group.group_name
        target = group.group_id unless group.group_name
        linespecs.push(ERB.new(security_group_spec_linetemplate, nil, '-').result(binding))
      end
    end
  end
  linespecs
end

#security_group_spec_linetemplate ⇒ Object 



47
48
49
50
51
52
 
# File 'lib/awspec/generator/spec/security_group.rb', line 47

def security_group_spec_linetemplate
  template = <<-'EOF'
its(:<%= inout %>) { should be_opened(<%= port %>).protocol('<%= protocol %>').for('<%= target %>') }
EOF
  template
end

#security_group_spec_template ⇒ Object 



54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/awspec/generator/spec/security_group.rb', line 54

def security_group_spec_template
  template = <<-'EOF'
describe security_group('<%= sg.group_id %>') do
  it { should exist }
<% describes.each do |describe| %>
<%- if sg.key?(describe) -%>
  its(:<%= describe %>) { should eq '<%= sg[describe] %>' }
<%- end -%>
<% end %>
<% linespecs.each do |line| %>
  <%= line %>
<% end %>
  its(:inbound_permissions_count) { should eq <%= sg.ip_permissions.count %> }
  its(:outbound_permissions_count) { should eq <%= sg.ip_permissions_egress.count %> }
<%- if @vpc_tag_name -%>
  it { should belong_to_vpc('<%= @vpc_tag_name %>') }
<%- else -%>
  it { should belong_to_vpc('<%= @vpc_id %>') }
<%- end -%>
end
EOF
  template
end