aws_regions resource

Use the aws_regions InSpec audit resource to test properties of some or all AWS regions in bulk.

Note that this resource lists all AWS regions that are currently available to the caller.

For additional information, including details on parameters and properties, see the AWS documentation on Regions.

Syntax

An aws_regions resource block uses an optional filter to select a group of regions and then tests that group.

describe aws_regions.where { region_name: 'us-not-there-1' } do
  it { should_not exist }
end

The following examples show how to use this InSpec audit resource.

Check for a Particular Region:

describe aws_regions do
  its('region_names') { should include 'eu-west-2' }
end

Check an endpoint exists:

describe aws_regions do
  its('endpoints') { should include 'ec2.eu-west-2.amazonaws.com' }
end

Use the regions resource to check single regions in more detail:

aws_regions.region_names.each do |aws_region_name|
  describe aws_region(region_name: aws_region_name) do
    it { should exist }
  end
end

For a full list of available matchers, visit the InSpec matchers page.

The control will pass if the describe returns at least one result.

it { should exist }

Your AWS principal will need the EC2:Client:DescribeRegionsResult action with Effect set to Allow.