Skip to main content

aws_vpc resource

[edit on GitHub]

Use the aws_vpc InSpec audit resource to test properties of a single AWS Virtual Private Cloud (VPC).

Each VPC is uniquely identified by its VPC ID. In addition, each VPC has a non-unique CIDR IP Address range (such as which it manages.

Every AWS account has at least one VPC, the “default” VPC, in every region.


An aws_vpc resource block identifies a VPC by id. If no VPC ID is provided, the default VPC is used.

# Find the default VPC
describe aws_vpc do
  it { should exist }

# Find a VPC by ID
describe aws_vpc('vpc-12345678987654321') do
  it { should exist }

# Hash syntax for ID
describe aws_vpc(vpc_id: 'vpc-12345678') do
  it { should exist }


If no parameter is provided, the subscription’s default VPC will be returned.

vpc_id (optional)

This resource accepts a single parameter, the VPC ID. This can be passed either as a string or as a vpc_id: 'value' key-value entry in a hash.

See also the AWS documentation on VPCs.


cidr_blockThe IPv4 address range that is managed by the VPC.
dhcp_options_idThe ID of the set of DHCP options associated with the VPC (or default if the default options are associated with the VPC).
instance_tenancyThe allowed tenancy of instances launched into the VPC.
stateThe state of the VPC (pending
vpc_idThe ID of the VPC.
tagsThe tags of the VPC.


The following examples show how to use this InSpec audit resource.

Test the CIDR of a named VPC

describe aws_vpc('vpc-87654321') do
  its('cidr_block') { should cmp '' }

Test the state of the VPC

describe aws_vpc do
  its ('state') { should eq 'available' }
  # or equivalently
  it { should be_available }

Test the allowed tenancy of instances launched into the VPC

describe aws_vpc do
  its ('instance_tenancy') { should eq 'default' }

Test tags on the VPC

describe aws_vpc do
  its('tags') { should include(:Environment => 'env-name',
                               :Name => 'vpc-name')}


This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our matchers page.


The test will pass if the identified VPC is the default VPC for the region.

describe aws_vpc('vpc-87654321') do
  it { should be_default }

AWS Permissions

Your Principal will need the ec2:DescribeVpcs action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon EC2.