aws_ec2_vpc_peering_connection Resource

Use the aws_ec2_vpc_peering_connection InSpec audit resource to test properties of a single specific AWS EC2 VPC Peering Connection.

The AWS::EC2::VPCPeeringConnection resource requests a VPC peering connection between two VPCs: a requester VPC that you own and an accepter VPC with which to create the connection.

For additional information, including details on parameters and properties, see the AWS documentation on AWS EC2 VPC Peering Connection..

Install

This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.

Syntax

Ensure that VPC Peering Connection ID exists.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'VPCPeeringConnectionID') do
  it { should exist }
end

Parameters

vpc_peering_connection_id (required): The ID of the VPC peering connection.

Properties

accepter_vpc_info.cidr_block: The IPv4 CIDR block for the VPC.; Field: accepter_vpc_info.cidr_block
accepter_vpc_info.ipv_6_cidr_block_set: The IPv6 CIDR block for the VPC.; Field: accepter_vpc_info.ipv_6_cidr_block_set
accepter_vpc_info.ipv_6_cidr_block_set.first.ipv_6_cidr_block: The IPv6 CIDR block.; Field: accepter_vpc_info.ipv_6_cidr_block_set[0].ipv_6_cidr_block
accepter_vpc_info.cidr_block_set: The IPv4 CIDR block for the VPC.; Field: accepter_vpc_info.cidr_block_set
accepter_vpc_info.cidr_block_set.first.cidr_block: The IPv4 CIDR block.; Field: accepter_vpc_info.cidr_block_set[0].cidr_block
accepter_vpc_info.owner_id: The ID of the Amazon Web Services account that owns the VPC.; Field: accepter_vpc_info.owner_id
accepter_vpc_info.peering_options.allow_dns_resolution_from_remote_vpc: Indicates whether a local VPC can resolve public DNS hostnames to private IP addresses when queried from instances in a peer VPC.; Field: accepter_vpc_info.peering_options.allow_dns_resolution_from_remote_vpc
accepter_vpc_info.peering_options.allow_egress_from_local_classic_link_to_remote_vpc: Indicates whether a local ClassicLink connection can communicate with the peer VPC over the VPC peering connection.; Field: accepter_vpc_info.peering_options.allow_egress_from_local_classic_link_to_remote_vpc
accepter_vpc_info.peering_options.allow_egress_from_local_vpc_to_remote_classic_link: Indicates whether a local VPC can communicate with a ClassicLink connection in the peer VPC over the VPC peering connection.; Field: accepter_vpc_info.peering_options.allow_egress_from_local_vpc_to_remote_classic_link
accepter_vpc_info.vpc_id: The ID of the VPC.; Field: accepter_vpc_info.vpc_id
accepter_vpc_info.region: The Region in which the VPC is located.; Field: accepter_vpc_info.region
expiration_time: The time that an unaccepted VPC peering connection will expire.; Field: expiration_time
requester_vpc_info.cidr_block: The IPv4 CIDR block for the VPC.; Field: requester_vpc_info.cidr_block
requester_vpc_info.ipv_6_cidr_block_set: The IPv6 CIDR block for the VPC.; Field: requester_vpc_info.ipv_6_cidr_block_set
requester_vpc_info.ipv_6_cidr_block_set.first.ipv_6_cidr_block: The IPv6 CIDR block.; Field: requester_vpc_info.ipv_6_cidr_block_set[0].ipv_6_cidr_block
requester_vpc_info.cidr_block_set: The IPv4 CIDR block for the VPC.; Field: requester_vpc_info.cidr_block_set
requester_vpc_info.cidr_block_set.first.cidr_block: The IPv4 CIDR block.; Field: requester_vpc_info.cidr_block_set[0].cidr_block
requester_vpc_info.owner_id: The ID of the Amazon Web Services account that owns the VPC.; Field: requester_vpc_info.owner_id
requester_vpc_info.peering_options.allow_dns_resolution_from_remote_vpc: Indicates whether a local VPC can resolve public DNS hostnames to private IP addresses when queried from instances in a peer VPC.; Field: requester_vpc_info.peering_options.allow_dns_resolution_from_remote_vpc
requester_vpc_info.peering_options.allow_egress_from_local_classic_link_to_remote_vpc: Indicates whether a local ClassicLink connection can communicate with the peer VPC over the VPC peering connection.; Field: requester_vpc_info.peering_options.allow_egress_from_local_classic_link_to_remote_vpc
requester_vpc_info.peering_options.allow_egress_from_local_vpc_to_remote_classic_link: Indicates whether a local VPC can communicate with a ClassicLink connection in the peer VPC over the VPC peering connection.; Field: requester_vpc_info.peering_options.allow_egress_from_local_vpc_to_remote_classic_link
requester_vpc_info.vpc_id: The ID of the VPC.; Field: requester_vpc_info.vpc_id
requester_vpc_info.region: The Region in which the VPC is located.; Field: requester_vpc_info.region
status.code: The status of the VPC peering connection.; Field: status.code
status.message: A message that provides more information about the status, if applicable.; Field: status.message
tags: Any tags assigned to the resource.; Field: tags
vpc_peering_connection_id: The ID of the VPC peering connection.; Field: vpc_peering_connection_id

Examples

Ensure a VPC Peering Connection ID is available.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'VPCPeeringConnectionID') do
  its('vpc_peering_connection_id') { should eq 'VPCPeeringConnectionID' }
end

Ensure that the status is available.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'VPCPeeringConnectionID') do
    its('status.code') { should eq 'available' }
end

Matchers

For a full list of available matchers, see our Universal Matchers page.

The controls will pass if the describe method returns at least one result.

exist

Use should to test that the entity exists.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'VPCPeeringConnectionID') do
  it { should exist }
end

Use should_not to test the entity does not exist.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'dummy') do
  it { should_not exist }
end

be_available

Use should to check if the entity is available.

describe aws_ec2_vpc_peering_connection(vpc_peering_connection_id: 'VPCPeeringConnectionID') do
  it { should be_available }
end

AWS Permissions

Your Principal will need the EC2:Client:DescribeVpcPeeringConnectionsResult action with Effect set to Allow.