aws_dynamodb_tables Resource

[edit on GitHub]

Use the aws_dynamodb_table InSpec audit resource to test properties of a collection of AWS DynamoDB Table.

Installation

This resource is available in the Chef InSpec AWS resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your AWS environment for InSpec and creating an InSpec profile that uses the InSpec AWS resource pack.

Syntax

Ensure exactly 3 DynamoDB Tables exist.

describe aws_dynamodb_tables do
  its('names.count') { should cmp 3 }
end

Parameters

This resource does not require any parameters.

Properties

table_names

The names of the tables associated with the current account at the current endpoint.

For a comprehensive list of properties available, see the API reference documentation

Examples

Ensure DynamoDB Tables are encrypted.

aws_dynamodb_tables.table_names.each do |table|
  describe aws_dynamodb_table(table_name: table) do
    it { should exist }
    it { should be_encrypted}
  end
end

Ensure the DynamoDB Tables exists and encrypted.

aws_dynamodb_tables.where(table_names: 'table_name').table_names.each do |table|
    describe aws_dynamodb_table(table_name: table) do
        it { should exist }
        it { should be_encrypted }
    end
end

Ensure the DynamoDB table exist.

describe aws_dynamodb_tables do
    its('table_names') { should include 'table_name'}
end

Matchers

For a full list of available matchers, please visit our Universal Matchers page.

exist

The control will pass if the describe returns at least one result.

Use should to test the entity should exist.

describe aws_dynamodb_tables.where( <property>: <value> ) do
  it { should exist }
end

Use should_not to test the entity should not exist.

describe aws_dynamodb_tables.where( <property>: <value> ) do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the DynamoDB:Client:ListTablesOutput action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon Dynamodb.