aws_cloudformation_stack Resource

Use the aws_cloudformation_stack InSpec audit resource to test properties of a single AWS Cloud Formation Stack.

For additional information, including details on parameters and properties, see the AWS documentation on Cloud Formation.

Installation

This resource is available in the Chef InSpec AWS resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your AWS environment for InSpec and creating an InSpec profile that uses the InSpec AWS resource pack.

Syntax

Ensure that an aws_cloudformation_stack exists

describe aws_cloudformation_stack('stack-name') do
  it { should exist }
end

describe aws_cloudformation_stack(stack_name: 'stack-name') do
  it { should exist }
end

Parameters

stack_name (required): This resource accepts a single parameter, the CloudFormation Stack name which uniquely identifies the stack. This can be passed either as a string or as a stack_name: 'value' key-value entry in a hash.

Properties

stack_id: Unique identifier of the stack.
stack_name: The name associated with the stack.
change_set_id: The unique ID of the change set.
description: A user-defined description associated with the stack.
parameters: A list of Parameter structures.
creation_time: The time at which the stack was created.
deletion_time: The time the stack was deleted.
last_updated_time: The time the stack was last updated.
rollback_configuration: The rollback triggers for AWS CloudFormation to monitor during stack creation and updating operations, and for the specified monitoring period afterwards.
stack_status: Current status of the stack.
stack_status_reason: Success/failure message associated with the stack status.
drift_information: Information on whether a stack’s actual configuration differs, or has drifted, from it’s expected configuration, as defined in the stack template and any values specified as template parameters.
disable_rollback: Boolean to enable or disable rollback on stack creation failures:.
notification_arns: SNS topic ARNs to which stack related events are published.
timeout_in_minutes: The amount of time within which stack creation should complete.
capabilities: The capabilities allowed in the stack.
outputs: A list of output structures.
role_arn: The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that is associated with the stack.
tags: A list of Tags that specify information about the stack.
enable_termination_protection: Whether termination protection is enabled for the stack.
parent_id: For nested stacks–stacks created as resources for another stack–the stack ID of the direct parent of this stack.
root_id: For nested stacks–stacks created as resources for another stack–the stack ID of the the top-level stack to which the nested stack ultimately belongs.

Examples

Test that a CloudFormation Stack has its stack_status configured correctly.

describe aws_cloudformation_stack('stack_name') do
its ('stack_status')  { should eq 'CREATE_COMPLETE' }
end

Matchers

This InSpec audit resource has no special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_cloudformation_stack('AnExistingStack') do
  it { should exist }
end

describe aws_cloudformation_stack('ANonExistentStack') do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the CloudFormation:Client:DescribeStacksOutput action with Effect set to Allow.

You can find detailed documentation at Authentication and Access Control for CloudFormation