azure_subscription Resource

Use the azure_subscription InSpec audit resource to test the properties of the current subscription.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Install

This resource is available in the Chef InSpec Azure resource pack.

For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.

Syntax

This resource will retrieve the current subscription ID that InSpec uses unless it is provided via id or resource_id parameters.

describe azure_subscription do
  it { should exist }
end

Or

describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Or

describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Parameters

id

The ID of the target subscription. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

resource_id

The fully qualified ID for the subscription. /subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations_api_version

The endpoint API version for the locations property. Optional. The latest version will be used unless provided.

Properties

name

The subscription display name.

id

The subscription ID. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations

The list of all available geo-location names that have the metadata.physicalLocation is set.

all_locations

The list of all available geo-location names. This includes physical and logical locations.

physical_locations<superscript>*</superscript>

The list of all available geo-location names with the metadata.regionType is set to Physical.

logical_locations

The list of all available geo-location names with the metadata.regionType is set to Logical.

locations_list

The list of all available geo-location objects in this format.

managedByTenants

An array containing the tenants managing the subscription.

diagnostic_settings

The diagnostic settings set at a subscription level.

diagnostic_settings_enabled_logging

The enabled logging types from diagnostic settings set at a subscription level.

diagnostic_settings_disabled_logging

The disabled logging types from diagnostic settings set at a subscription level.

* physical_locations might be different than the locations property depending on the API version. This is because of the change in the Azure API terminology. It is advised to see the official documentation for more information.

For properties applicable to all resources, such as type and properties, refer to azure_generic_resource.

Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.). For example, properties.<attribute>.

Examples

Test subscription`s display name

describe azure_subscription do
  its('name') { should cmp 'Demo Resources' }
end

Test subscription`s authorization source

describe azure_subscription do
  its('authorizationSource') { should cmp 'RoleBased' }
end

Test subscription`s locations

describe azure_subscription do
  its('locations') { should include('eastus') }
end

Test subscription`s enabled logging types (via diagnostic settings)

describe azure_subscription do
  its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end

Test subscription`s disabled logging types (via diagnostic settings)

describe azure_subscription do
  its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end

Matchers

This resource has the following special matchers.

exists

# If we expect a resource to always exist.

describe azure_subscription do
  it { should exist }
end

not_exists

# If we expect a resource to never exist.

describe azure_subscription(id: 'fake_id') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.