aws_eks_cluster resource

[edit on GitHub]

Use the aws_eks_cluster InSpec audit resource to test properties of a single AWS Elastic Container Service for Kubernetes.

Syntax

An aws_eks_cluster resource block declares the tests for a single EKS Cluster by Cluster name.

describe aws_eks_cluster('my-eks') do
  it { should exist }
end

describe aws_eks_cluster(cluster_name: 'my-eks') do
  it { should exist }
end

Parameters

cluster_name (required)

This resource requires a single parameter, the EKS Cluster Name. This can be passed either as a string or as a cluster_name: 'value' key-value entry in a hash.

See also the AWS documentation on EKS Clusters.

Properties

Examples

Test that an EKS Cluster has at least 2 subnets

describe aws_eks_cluster('my-cluster') do
  its('subnets_count') { should be > 1 }
end

Ensure a Cluster has the correct status.

describe aws_eks_cluster(cluster_name: 'my-eks') do
  its('status') { should eq 'ACTIVE' }
end

Ensure that the EKS Cluster is on the correct VPC

describe aws_eks_cluster('my-cluster') do
  its('vpc_id') { should eq 'vpc-12345678' }
end

Ensure the EKS Cluster is using the correct IAM Role.

describe aws_eks_cluster('my-cluster') do
  its('role_arn') { should cmp 'rn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-J7ONKE3BQ4PI' }
end

Integrate with other resources

Use a combination of InSpec AWS resources to ensure your EKS Cluster does not use the Default VPC.

# Find the default Security Group for our VPC
cluster_vpc = aws_eks_cluster(cluster_name: 'my-cluster').vpc_id
default_sg  = aws_security_group(group_name: 'default', vpc_id: cluster_vpc)

# Ensure we are not using the default Security Group
describe aws_eks_cluster(cluster_name: 'my-cluster') do
  its('security_group_ids') { should_not include default_security_group.group_id }
end

Matchers

This InSpec audit resource has no special matchers. For a full list of available matchers, please visit our Universal Matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_eks_cluster('AnExistingCluster') do
  it { should exist }
end

describe aws_eks_cluster('ANonExistentCluster') do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the eks:DescribeCluster action set to Allow.

You can find detailed documentation at Amazon EKS IAM Policies, Roles, and Permissions The documentation for EKS actions is at Policy Structure