azure_subscription Resource

Use the azure_subscription InSpec audit resource to test properties of the current subscription.

Azure REST API Version, Endpoint, and HTTP Client Parameters

This resource interacts with API versions supported by the resource provider. The api_version can be defined as a resource parameter. If not provided, this resource uses the latest version. For more information, refer to the azure_generic_resource document.

Unless defined, this resource uses the azure_cloud global endpoint and default values for the HTTP client. For more information, refer to the resource pack README.

Installation

This resource is available in the Chef InSpec Azure resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your Azure environment for InSpec and creating an InSpec profile that uses the InSpec Azure resource pack.

Syntax

This resource will retrieve the current subscription id that InSpec uses unless it is provided via id or resource_id parameters.

describe azure_subscription do
  it { should exist }
end

describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Parameters

id: The ID of the target subscription. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.
resource_id: The fully qualified ID for the subscription. /subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd.
locations_api_version: The endpoint api version for the locations property. Optional. The latest version will be used unless provided.

Properties

name: The subscription display name.
id: The subscription ID. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.
locations: The list of all available geo-location names that have the metadata.physicalLocation is set.
all_locations: The list of all available geo-location names. This includes physical and logical locations.
physical_locations<superscript>*</superscript>: The list of all available geo-location names that have the metadata.regionType is set to Physical.
logical_locations: The list of all available geo-location names that have the metadata.regionType is set to Logical.
locations_list: The list of all available geo-location objects in this format.
managedByTenants: An array containing the tenants managing the subscription.
diagnostic_settings: The diagnostic settings set at a subcription level.
diagnostic_settings_enabled_logging: The enabled logging types from diagnostic settings set at a subcription level.
diagnostic_settings_disabled_logging: The disabled logging types from diagnostic settings set at a subcription level.

* physical_locations might be different than the locations property depending on the api version. This is because of the change in the Azure API terminology. It is advised to see the official documentation for more info.

For properties applicable to all resources, such as type, properties, refer to azure_generic_resource.

Also, refer to Azure documentation for other properties available. Any attribute in the response may be accessed with the key names separated by dots (.), eg. properties.<attribute>.

Examples

Test Your Subscription`s Display Name.

describe azure_subscription do
  its('name') { should cmp 'Demo Resources' }
end

Test Your Subscription`s Authorization Source.

describe azure_subscription do
  its('authorizationSource') { should cmp 'RoleBased' }
end

Test Your Subscription`s Locations.

describe azure_subscription do
  its('locations') { should include('eastus') }
end

Test Your Subscription`s enabled logging types (via diagnostic settings).

describe azure_subscription do
  its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end

Test Your Subscription`s disabled logging types (via diagnostic settings).

describe azure_subscription do
  its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exists

# If we expect a resource to always exist

describe azure_subscription do
  it { should exist }
end
# If we expect a resource to never exist

describe azure_subscription(id: 'fake_id') do
  it { should_not exist }
end

Azure Permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.