InSpec: Auditing and Testing Framework
Branch: master
Clone or download
chef-ci Bump version to 3.6.10 by Chef Expeditor
Obvious fix; these changes are the result of automation not creative thinking.
Latest commit f3f50c1 Feb 14, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.expeditor Note the correct expeditor URL in the config comment Feb 13, 2019
.github rename stale -> Stale label Aug 9, 2018
bin Satisfy RuboCop by adding `x` bit to `bin/inspec` (#3249) Jul 25, 2018
ci Updated omnibus `postinst` script to symlink to appbundle created bin… Feb 28, 2018
contrib Add GCP and Azure to the docs list (#3460) Oct 2, 2018
docs Merge pull request #3778 from inspec/team/filesystem-free-percent Feb 6, 2019
etc Add deprecation group for renaming attributes Feb 14, 2019
examples Update docs Jan 28, 2019
habitat Make gems not world writable Jan 18, 2019
lib Bump version to 3.6.10 by Chef Expeditor Feb 14, 2019
omnibus Update Ruby versions used for testing; fix Travis CI issues (#3678) Dec 21, 2018
support Plugins Installer API (#3352) Sep 19, 2018
tasks Update list of SPDX licenses (#3677) Dec 20, 2018
test Fix typo in require Feb 14, 2019
www www: remove jquery sticky on the sidebar (#3623) Nov 26, 2018
.gitignore Ability to render contrib resource pack docs on main website (#3184) Aug 2, 2018
.kitchen.chef.yml Change Atlas to VagrantCloud (#2372) Dec 5, 2017
.kitchen.ec2.yml call ssh cookbook from prepare cookbook Jan 3, 2017
.kitchen.vagrant.yml Add wildcard support to `Utils::FindFiles` (#2159) Sep 23, 2017
.kitchen.yml Backport compliance namespace and add testing for A2 audit report. (#… Oct 11, 2018
.rubocop.yml Exempt inspec-init template file from rubocop, and enable DisplayCopN… Feb 6, 2019
.travis.yml Update Ruby versions used for testing; fix Travis CI issues (#3678) Dec 21, 2018
Berksfile Pin postgres to a lower cb version. (#3449) Sep 27, 2018 Bump version to 3.6.10 by Chef Expeditor Feb 14, 2019 Correct `whom` usage in (#3256) Jul 26, 2018 Minor tweaks to CONTRIBUTING to clarify Feb 12, 2019
Dockerfile Executed '.expeditor/' Feb 12, 2019 Change `Inspec ` to `InSpec ` where appropriate (#3494) Oct 15, 2018
Gemfile Remove temporary reliance on Train branch Feb 1, 2019 Add a (#3212) Jul 17, 2018
LICENSE license belongs in LICENSE Nov 3, 2015 Update maintainers file. (#2728) Feb 22, 2018
MAINTAINERS.toml Update maintainers file. (#2728) Feb 22, 2018 Update support platforms in the readme Feb 13, 2019
Rakefile Create appvayor workers for Windows functional tests. (#3397) Nov 8, 2018
VERSION Bump version to 3.6.10 by Chef Expeditor Feb 14, 2019
appveyor.yml Disable RDP login for appveyor Feb 6, 2019
inspec-core.gemspec Relax pin on train in inspec-core Feb 6, 2019
inspec.gemspec Remove temporary reliance on Train branch Feb 1, 2019
netlify.toml move /tutorial to /demo (#2700) Feb 20, 2018

InSpec: Inspect Your Infrastructure

Slack Build Status Master Build Status Master

InSpec is an open-source testing framework for infrastructure with a human- and machine-readable language for specifying compliance, security and policy requirements.

# Disallow insecure protocols by testing

describe package('telnetd') do
  it { should_not be_installed }

describe inetd_conf do
  its("telnet") { should eq nil }

InSpec makes it easy to run your tests wherever you need. More options are found in our CLI docs.

# run test locally
inspec exec test.rb

# run test on remote host on SSH
inspec exec test.rb -t ssh://user@hostname -i /path/to/key

# run test on remote host using SSH agent private key authentication. Requires InSpec 1.7.1
inspec exec test.rb -t ssh://user@hostname

# run test on remote windows host on WinRM
inspec exec test.rb -t winrm://Administrator@windowshost --password 'your-password'

# run test on docker container
inspec exec test.rb -t docker://container_id


  • Built-in Compliance: Compliance no longer occurs at the end of the release cycle
  • Targeted Tests: InSpec writes tests that specifically target compliance issues
  • Metadata: Includes the metadata required by security and compliance pros
  • Easy Testing: Includes a command-line interface to run tests quickly


InSpec requires Ruby ( >2.3 ).

Install as package

The InSpec package is available for MacOS, RedHat, Ubuntu and Windows. Download the latest package at InSpec Downloads or install InSpec via script:

# RedHat, Ubuntu, and macOS
curl | sudo bash -s -- -P inspec

# Windows
. { iwr -useb } | iex; install -project inspec

Install it via

When installing from source, gem dependencies may require ruby build tools to be installed.

For CentOS/RedHat/Fedora:

yum -y install ruby ruby-devel make gcc gcc-c++

For Ubuntu:

apt-get -y install ruby ruby-dev gcc g++ make

To install inspec from rubygems:

gem install inspec

Usage via Docker

Download the image and define a function for convenience:

For Linux:

docker pull chef/inspec
function inspec { docker run -it --rm -v $(pwd):/share chef/inspec "$@"; }

For Windows (PowerShell):

docker pull chef/inspec
function inspec { docker run -it --rm -v "$(pwd):/share" chef/inspec $args; }

If you call inspec from your shell, it automatically mounts the current directory into the Docker container. Therefore you can easily use local tests and key files. Note: Only files in the current directory and sub-directories are available within the container.

$ ls -1

$ inspec exec test.rb -t ssh://root@ -i vagrant

Finished in 0.04321 seconds (files took 0.54917 seconds to load)
2 examples, 0 failures

Install it from source

Note that installing from OS packages from the download page is the preferred method.

That requires bundler:

bundle install
bundle exec bin/inspec help

To install it as a gem locally, run:

gem build inspec.gemspec
gem install inspec-*.gem

On Windows, you need to install Ruby with Ruby Development Kit to build dependencies with its native extensions.

Install via Habitat

Currently, this method of installation only supports Linux. See the Habitat site for more information.

Download the hab binary from the Habitat site.

hab pkg install chef/inspec --binlink


Run InSpec

You should now be able to run:

$ inspec --help
  inspec archive PATH                # archive a profile to tar.gz (default) ...
  inspec check PATH                  # verify all tests at the specified PATH
  inspec compliance SUBCOMMAND ...   # Chef Compliance commands
  inspec detect                      # detect the target OS
  inspec exec PATH(S)                # run all test files at the specified PATH.
  inspec help [COMMAND]              # Describe available commands or one spe...
  inspec init TEMPLATE ...           # Scaffolds a new project
  inspec json PATH                   # read all tests in PATH and generate a ...
  inspec shell                       # open an interactive debugging shell
  inspec supermarket SUBCOMMAND ...  # Supermarket commands
  inspec version                     # prints the version of this tool

  [--diagnose], [--no-diagnose]  # Show diagnostics (versions, configurations)


  • Only accept requests on secure ports - This test ensures that a web server is only listening on well-secured ports.
describe port(80) do
  it { should_not be_listening }

describe port(443) do
  it { should be_listening }
  its('protocols') {should include 'tcp'}
  • Use approved strong ciphers - This test ensures that only enterprise-compliant ciphers are used for SSH servers.
describe sshd_config do
   its('Ciphers') { should eq(',aes256-ctr,aes192-ctr,aes128-ctr') }
  • Test your kitchen.yml file to verify that only Vagrant is configured as the driver. The %w() formatting will pass rubocop linting and allow you to access nested mappings.
describe yaml('.kitchen.yml') do
  its(%w(driver name)) { should eq('vagrant') }

Also have a look at our examples for:

Or tests: Testing for a OR b

  • Using, you can test for a or b. The control will be marked as passing if EITHER condition is met.
control 'or-test' do
  impact 1.0
  title 'This is a OR test' do
    describe ssh_config do
      its('Protocol') { should eq('3') }
    describe ssh_config do
      its('Protocol') { should eq('2') }

Command Line Usage


Run tests against different targets:

# run test locally
inspec exec test.rb

# run test on remote host on SSH
inspec exec test.rb -t ssh://user@hostname

# run test on remote windows host on WinRM
inspec exec test.rb -t winrm://Administrator@windowshost --password 'your-password'

# run test on docker container
inspec exec test.rb -t docker://container_id

# run with sudo
inspec exec test.rb --sudo [--sudo-password ...] [--sudo-options ...] [--sudo_command ...]

# run in a subshell
inspec exec test.rb --shell [--shell-options ...] [--shell-command ...]

# run a profile targeting AWS using env vars
inspec exec test.rb -t aws://

# or store your AWS credentials in your ~/.aws/credentials profiles file
inspec exec test.rb -t aws://us-east-2/my-profile

# run a profile targeting Azure using env vars
inspec exec test.rb -t azure://

# or store your Azure credentials in your ~/.azure/credentials profiles file
inspec exec test.rb -t azure://subscription_id


Verify your configuration and detect

id=$( docker run -dti ubuntu:14.04 /bin/bash )
inspec detect -t docker://$id

Which will provide you with:


Supported OS

Remote Targets

Platform Versions Architectures
AIX 6.1, 7.1, 7.2 ppc64
CentOS 5, 6, 7 i386, x86_64
Debian 7, 8, 9 i386, x86_64
FreeBSD 9, 10, 11 i386, amd64
Mac OS X 10.9, 10.10, 10.11, 10.12, 10.13, 10.14 x86_64
Oracle Enterprise Linux 5, 6, 7 i386, x86_64
Red Hat Enterprise Linux 5, 6, 7 i386, x86_64
Solaris 10, 11 sparc, x86
Windows* 7, 8, 8.1, 10, 2008, 2008R2 , 2012, 2012R2, 2016 x86, x86_64
Ubuntu Linux x86, x86_64
SUSE Linux Enterprise Server 11, 12 x86_64
Scientific Linux 5.x, 6.x and 7.x i386, x86_64
Fedora x86_64
OpenSUSE 13, 42 x86_64
OmniOS x86_64
Gentoo Linux x86_64
Arch Linux x86_64
HP-UX 11.31 ia64

*For Windows, PowerShell 5.0 or above is required.

In addition, runtime support is provided for:

Platform Versions
Debian 8, 9
RHEL 6, 7
Ubuntu 12.04+
Windows 7+
Windows 2012+




Relationship to other tools (RSpec, Serverspec):

Share your Profiles

You may share your InSpec Profiles in the Tools & Plugins section of the Chef Supermarket. Sign in and add the details of your profile.

You may also browse the Supermarket for shared Compliance Profiles.


InSpec is inspired by the wonderful Serverspec project. Kudos to mizzy and all contributors!

The AWS resources were inspired by inspec-aws from arothian.


  1. Fork it
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Add some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create new Pull Request

The InSpec community and maintainers are very active and helpful. This project benefits greatly from this activity.

If you'd like to chat with the community and maintainers directly join us in the #inspec channel on the Chef Community Slack.

As a reminder, all participants are expected to follow the Code of Conduct.


Testing InSpec

We offer unit, integration, and aws tests.

  • unit tests ensure the intended behaviour of the implementation
  • integration tests run against Docker-based VMs via test-kitchen and kitchen-inspec
  • aws tests exercise the AWS resources against real AWS accounts

Unit tests

bundle exec rake test

If you like to run only one test file:

bundle exec m test/unit/resources/user_test.rb

You may also run a single test within a file by line number:

bundle exec m test/unit/resources/user_test.rb -l 123

Integration tests

These tests download various virtual machines, to ensure InSpec is working as expected across different operating systems.

These tests require the following gems:

  • test-kitchen
  • kitchen-dokken
  • kitchen-inspec

These gems are provided via the integration group in the project's Gemfile.

In addition, these test require Docker to be available on your machine or a remote Docker machine configured via the standard Docker environment variables.

Running Integration tests

List the various test instances available:

bundle exec kitchen list

The platforms and test suites are configured in the .kitchen.yml file. Once you know which instance you wish to test, test that instance:

bundle exec kitchen test <INSTANCE_NAME>

You may test all instances in parallel with:

bundle exec kitchen test -c

AWS Tests

Use the rake task bundle exec rake test:aws to test the AWS resources against a pair of real AWS accounts.

Please see for details on how to setup the needed AWS accounts to perform testing.

Azure Tests

Use the rake task bundle exec rake test:azure to test the Azure resources against an Azure account.

Please see for details on how to setup the needed Azure accounts to perform testing.


Author: Dominik Richter (
Author: Christoph Hartmann (
Copyright: Copyright (c) 2015 Vulcano Security GmbH.
Copyright: Copyright (c) 2017-2018 Chef Software Inc.
License: Apache License, Version 2.0

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.