Skip to main content

azure_ddos_protection_resources Resource

Use the azure_ddos_protection_resources InSpec audit resource to test the properties of DDoS protection plans in a resource group.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.


This resource is available in the Chef InSpec Azure resource pack.

For information on configuring your Azure environment for Chef InSpec and creating an InSpec profile that uses the InSpec Azure resource pack, see the Chef InSpec documentation for the Azure cloud platform.


An azure_ddos_protection_resources resource block returns all Azure bastion hosts, within a resource group (if provided).

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do


Azure resource group where the targeted resource resides.


A list of the unique resource names.

Field: name

A list of DDoS protection plan IDs.

Field: id

The list of virtual networks associated with the DDoS protection plan resource.

Field: virtual_networks

The provisioning states of the DDoS protection plans.

Field: provisioning_state

The types of all the DDoS protection plans.

Field: type

The resource GUID property of the DDoS protection plan resource. It uniquely identifies the resource, even if the user changes its name or migrates the resource across subscriptions or resource groups.

Field: resource_guid


For information on using filter criteria on plural resources, see the documentation on FilterTable

Also, refer to the Azure documentation for all available properties. Access any attribute in the response by separating the key names with a period (.).


Test to ensure that the DDoS protection plan resource is in a successful state

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  its('provisioning_states') { should include('Succeeded') }

Test to ensure that a DDoS protection plan resource is from a location

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  its('location') { should include `RESOURCE_LOCATION` }

Test if any DDoS protection plan exists in the resource group

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  it { should exist }


For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.


# Should not exist if no bastion hots are in the resource group.

describe azure_ddos_protection_resources(resource_group: 'RESOURCE_GROUP') do
  it { should_not exist }

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.

Edit this page on GitHub

Thank you for your feedback!


Search Results