inital terraform example

README.md

@@ -0,0 +1,34 @@
+# Inspec for provising testing
+
+This repository demonstrates how to use InSpec with provising tools. Recent additions to InSpec 2.0 allow us to verify not only machines, but also any infrastructure provisioned in AWS or Azure cloud. This repository is providing guidance on the use of provising tools in conjunction with InSpec.
+
+- [Terraform](terraform/README.md)
+- AWS CloudFormation (planned)
+- Azure Resource Manager Templates (planned)
+
+## Getting Started
+
+The following example will provision a two-tier terraform architecture on AWS. It assumes that you have AWS credentials properly configured.
+
+```
+cd terraform
+terraform init
+terraform apply -var 'key_name=terraform' -var 'public_key_path=/Users/chris/.ssh/id_rsa.pub'
+terraform output --json > test/verify/files/terraform.json
+inspec exec test/verify -t aws://
+```
+
+![InSpec Test Result](docs/terraform.png)
+
+## License
+
+|  |  |
+| ------ | --- |
+| **Author:** | Christoph Hartmann (<chris@lollyrock.com>) |
+| **Author:** | Dominik Richter (<dominik.richter@gmail.com>) |
+| **Copyright:** | Christoph Hartmann (<chris@lollyrock.com>) |
+| **Copyright:** | Dominik Richter (<dominik.richter@gmail.com>) |
+| **License:** | Mozilla Public License Version 2.0 |
+
+The terraform aws example is based on their [two-tier example](https://github.com/terraform-providers/terraform-provider-aws/tree/master/examples/two-tier) which is also MPL-2.0 licensed.
+

terraform/.gitignore

@@ -0,0 +1 @@
+.terraofrm*

terraform/README.md

@@ -0,0 +1,95 @@
+# Basic Two-Tier AWS Architecture
+
+## Overview Terraform
+
+This provides a template for running a simple two-tier architecture on Amazon Web services. The premise is that you have stateless app servers running behind an ELB serving traffic.
+
+To simplify the example, this intentionally ignores deploying and getting your application onto the servers. However, you could do so either via
+[provisioners](https://www.terraform.io/docs/provisioners/) and a configuration management tool, or by pre-baking configured AMIs with
+[Packer](http://www.packer.io).
+
+This example will also create a new EC2 Key Pair in the specified AWS Region. The key name and path to the public key must be specified via the  
+terraform command vars.
+
+After you run `terraform apply` on this configuration, it will automatically output the DNS address of the ELB. After your instance registers, this should respond with the default nginx web page.
+
+To run, configure your AWS provider as described in 
+
+https://www.terraform.io/docs/providers/aws/index.html
+
+Run with a command like this:
+
+```
+terraform apply -var 'key_name={your_aws_key_name}' \
+   -var 'public_key_path={location_of_your_key_in_your_local_machine}'
+```
+
+## Overview InSpec
+
+This template provides an InSpec profile inside of the test/verify profile. InSpec ships with [built-in AWS resources](https://www.inspec.io/docs/reference/resources/#aws-resources). 
+
+For some resources you need to information from terraform available. The best hand-over is the use of [terraform output](https://www.terraform.io/intro/getting-started/outputs.html) variables. Define every variable similar to:
+
+```
+output "vpc_id" {
+  value = "${aws_vpc.default.id}"
+}
+```
+
+Terraform allows the output of the variables as json file. InSpec is able to [load files from profiles](https://github.com/chef/inspec/issues/1396). 
+
+
+```
+terraform output --json > test/verify/files/terraform.json
+```
+
+Since InSpec is able to load files from the `files` directory directly, you can load the content via:
+
+```
+# load data from terraform output
+content = inspec.profile.file("terraform.json")
+params = JSON.parse(content)
+
+# store vpc in variable
+VPC_ID = params['vpc_id']['value']
+```
+
+Now, you can use the variable in various spaces
+
+```
+describe aws_vpc(vpc_id: VPC_ID) do
+  its('cidr_block') { should cmp '10.0.0.0/16' }
+end
+
+describe aws_security_group(group_name: 'terraform_example') do
+  it { should exist }
+  its('group_name') { should eq 'terraform_example' }
+  its('description') { should eq 'Used in the terraform' }
+  its('vpc_id') { should eq VPC_ID }  
+end
+```
+
+
+## Apply & Verify Cycle
+
+To combine Terraform with InSpec just execute the following:
+
+```
+cd terraform
+# download the required plugins
+terraform init
+
+# run terraform to apply the changes
+terraform apply -var 'key_name=terraform' -var 'public_key_path=/Users/chris/.ssh/id_rsa.pub'
+
+# make terraform variables available to inspec
+terraform output --json > test/verify/files/terraform.json
+
+# run the inspec profile to verify the setup
+inspec exec test/verify -t aws://
+```
+
+
+
+
+

terraform/main.tf

@@ -0,0 +1,144 @@
+# Two-Tier example from https://github.com/terraform-providers/terraform-provider-aws
+
+# Specify the provider and access details
+provider "aws" {
+  region = "${var.aws_region}"
+}
+
+# Create a VPC to launch our instances into
+resource "aws_vpc" "default" {
+  cidr_block = "10.0.0.0/16"
+}
+
+# Create an internet gateway to give our subnet access to the outside world
+resource "aws_internet_gateway" "default" {
+  vpc_id = "${aws_vpc.default.id}"
+}
+
+# Grant the VPC internet access on its main route table
+resource "aws_route" "internet_access" {
+  route_table_id         = "${aws_vpc.default.main_route_table_id}"
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = "${aws_internet_gateway.default.id}"
+}
+
+# Create a subnet to launch our instances into
+resource "aws_subnet" "default" {
+  vpc_id                  = "${aws_vpc.default.id}"
+  cidr_block              = "10.0.1.0/24"
+  map_public_ip_on_launch = true
+}
+
+# A security group for the ELB so it is accessible via the web
+resource "aws_security_group" "elb" {
+  name        = "terraform_example_elb"
+  description = "Used in the terraform"
+  vpc_id      = "${aws_vpc.default.id}"
+
+  # HTTP access from anywhere
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  # outbound internet access
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# Our default security group to access
+# the instances over SSH and HTTP
+resource "aws_security_group" "default" {
+  name        = "terraform_example"
+  description = "Used in the terraform"
+  vpc_id      = "${aws_vpc.default.id}"
+
+  # SSH access from anywhere
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  # HTTP access from the VPC
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/16"]
+  }
+
+  # outbound internet access
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_elb" "web" {
+  name = "terraform-example-elb"
+
+  subnets         = ["${aws_subnet.default.id}"]
+  security_groups = ["${aws_security_group.elb.id}"]
+  instances       = ["${aws_instance.web.id}"]
+
+  listener {
+    instance_port     = 80
+    instance_protocol = "http"
+    lb_port           = 80
+    lb_protocol       = "http"
+  }
+}
+
+resource "aws_key_pair" "auth" {
+  key_name   = "${var.key_name}"
+  public_key = "${file(var.public_key_path)}"
+}
+
+resource "aws_instance" "web" {
+  # The connection block tells our provisioner how to
+  # communicate with the resource (instance)
+  connection {
+    # The default username for our AMI
+    user = "ubuntu"
+
+    # The connection will use the local SSH agent for authentication.
+  }
+
+  instance_type = "t2.micro"
+
+  # Lookup the correct AMI based on the region
+  # we specified
+  ami = "${lookup(var.aws_amis, var.aws_region)}"
+
+  # The name of our SSH keypair we created above.
+  key_name = "${aws_key_pair.auth.id}"
+
+  # Our Security group to allow HTTP and SSH access
+  vpc_security_group_ids = ["${aws_security_group.default.id}"]
+
+  # We're going to launch into the same subnet as our ELB. In a production
+  # environment it's more common to have a separate private subnet for
+  # backend instances.
+  subnet_id = "${aws_subnet.default.id}"
+
+  # We run a remote provisioner on the instance after creating it.
+  # In this case, we just install nginx and start it. By default,
+  # this should be on port 80
+  provisioner "remote-exec" {
+    inline = [
+      "sudo apt-get -y update",
+      "sudo apt-get -y install nginx",
+      "sudo service nginx start",
+    ]
+  }
+}

terraform/outputs.tf

@@ -0,0 +1,11 @@
+output "address" {
+  value = "${aws_elb.web.dns_name}"
+}
+
+output "instance_id" {
+  value = "${aws_instance.web.id}"
+}
+
+output "vpc_id" {
+  value = "${aws_vpc.default.id}"
+}

terraform/test/verify/controls/twotier.rb

@@ -0,0 +1,36 @@
+# encoding: utf-8
+# copyright: 2017, Christoph Hartmann
+
+title 'two tier setups'
+
+# load data from terraform output
+content = inspec.profile.file("terraform.json")
+params = JSON.parse(content)
+
+INTANCE_ID = params['instance_id']['value']
+VPC_ID = params['vpc_id']['value']
+
+# execute test
+describe aws_vpc(vpc_id: VPC_ID) do
+  its('cidr_block') { should cmp '10.0.0.0/16' }
+end
+
+describe aws_security_group(group_name: 'terraform_example') do
+  it { should exist }
+  its('group_name') { should eq 'terraform_example' }
+  its('description') { should eq 'Used in the terraform' }
+  its('vpc_id') { should eq VPC_ID }  
+end
+
+describe aws_security_group(group_name: 'terraform_example_elb') do
+  it { should exist }
+  its('group_name') { should eq 'terraform_example_elb' }
+  its('description') { should eq 'Used in the terraform' }
+  its('vpc_id') { should eq VPC_ID }  
+end
+
+describe aws_ec2_instance(INTANCE_ID) do
+  it { should be_running }
+  its('instance_type') { should eq 't2.micro' }
+  its('image_id') { should eq 'ami-fa2fb595' }
+end

terraform/test/verify/files/terraform.json

@@ -0,0 +1,17 @@
+{
+    "address": {
+        "sensitive": false,
+        "type": "string",
+        "value": "terraform-example-elb-1855342650.eu-central-1.elb.amazonaws.com"
+    },
+    "instance_id": {
+        "sensitive": false,
+        "type": "string",
+        "value": "i-0ff54fc6cbee5c449"
+    },
+    "vpc_id": {
+        "sensitive": false,
+        "type": "string",
+        "value": "vpc-eda80386"
+    }
+}

terraform/test/verify/inspec.yml

@@ -0,0 +1,8 @@
+name: verify
+title: InSpec Profile to verify Terraform provisioning
+maintainer: Christoph Hartmann
+copyright: Christoph Hartmann
+copyright_email: chris@lollyrock.com
+license: Apache-2.0
+summary: An InSpec test profile to verify terrafrom setups
+version: 0.1.0

terraform/variables.tf

@@ -0,0 +1,31 @@
+# Two-Tier example from https://github.com/terraform-providers/terraform-provider-aws
+
+variable "public_key_path" {
+  description = <<DESCRIPTION
+Path to the SSH public key to be used for authentication.
+Ensure this keypair is added to your local SSH agent so provisioners can
+connect.
+
+Example: ~/.ssh/terraform.pub
+DESCRIPTION
+}
+
+variable "key_name" {
+  description = "Desired name of AWS key pair"
+}
+
+variable "aws_region" {
+  description = "AWS region to launch servers."
+  default     = "eu-central-1"
+}
+
+# Ubuntu Precise 12.04 LTS (x64)
+variable "aws_amis" {
+  default = {
+    eu-central-1 = "ami-fa2fb595"
+    eu-west-1 = "ami-674cbc1e"
+    us-east-1 = "ami-1d4e7a66"
+    us-west-1 = "ami-969ab1f6"
+    us-west-2 = "ami-8803e0f0"
+  }
+}