aws_ec2_egress_only_internet

Use the aws_ec2_egress_only_internet_gateways InSpec audit resource to test properties of multiple AWS EC2 egress-only internet gateways.

The AWS::EC2::EgressOnlyInternetGateway specifies an egress-only internet gateway for your VPC.

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

Ensure that the egress-only internet gateway Id exists.

describe aws_ec2_egress_only_internet_gateways do
  it { should exist }
end

attachments: Information about the attachment of the egress-only internet gateway.; Field: attachments
attachments_states: The current state of the attachment.; Field: state
attachments_vpc_ids: The ID of the VPC.; Field: vpc_id
egress_only_internet_gateway_id: The ID of the egress-only internet gateway.; Field: egress_only_internet_gateway_id
tags: The tags assigned to the egress-only internet gateway.; Field: tags

Ensure an egress-only internet gateway ID is available.

describe aws_ec2_egress_only_internet_gateways do
  its('egress_only_internet_gateway_ids') { should include 'EgressOnlyInternetGatewayId' }
end

Ensure that the attachments states is attached.

describe aws_ec2_egress_only_internet_gateways do
    its('attachments_states') { should include 'attached' }
end

For a full list of available matchers, see our Universal Matchers page.

The controls will pass if the describe method returns at least one result.

Use should to test that the entity exists.

describe aws_ec2_egress_only_internet_gateways do
  it { should exist }
end

Use should_not to test that an entity does not exist.

describe aws_ec2_egress_only_internet_gateways do
  it { should_not exist }
end

Use should to check if the entity is available.

describe aws_ec2_egress_only_internet_gateways do
  it { should be_available }
end

Your Principal will need the EC2:Client:DescribeEgressOnlyInternetGatewaysResult action with Effect set to Allow.