alicloud_ram_users Resource

[edit on GitHub]

Use the alicloud_ram_users InSpec audit resource to test properties of some or all Alicloud RAM users.

Syntax

An alicloud_ram_users resource block returns all RAM users and allows the testing of that group of RAM users.

describe alicloud_ram_users do
  its('user_names') { should include 'payroll-admin' }
end

Parameters

This resource does not require any parameters.

Properties

user_names

The user names of the returned RAM users.

user_ids

The unique IDs of the returned RAM users.

display_names

Display names of the returned RAM users.

comments

Comments about the returned RAM users.

create_dates

The times when the returned RAM users were created.

update_dates

The times when the information about the returned RAM users was last updated.

access_keys

An array of hashes each containing metadata about a user’s access keys (active and inactive).

active_access_keys

An array of hashes each containing metadata about a user’s active access keys.

has_access_key

Boolean indicating whether each user has any access keys or not.

has_active_access_key

Boolean indicating whether each user has any active access keys or not.

has_console_access

Boolean indicating whether each user has console access.

has_console_and_key_access

Boolean indicating whether each user has both console access as well as one or more active access keys.

has_mfa_enabled

Boolean indicating whether each user has MFA enabled or not.

entries

Provides access to the raw results of the query, which can be treated as an array of hashes.

Examples

Ensure there are no RAM users who do not have MFA enabled.

describe alicloud_ram_users.where(has_mfa_enabled: false) do
  it { should_not exist }
**less readable test, but it gives better output.**

end

Ensure there are no RAM users who have console access and do not have MFA enabled.

alicloud_ram_users.where(has_console_access: true).user_names.each do |u|
  describe alicloud_ram_user_mfa(u) do
    it { should exist }
  end
end

Ensure there are no RAM users with console access and one or more active access keys.

describe alicloud_ram_users.where(has_console_and_key_access: true) do
  its('user_names') { should be_empty }
end

or

alicloud_ram_users.where { active_access_keys.count > 0 }.user_names.each do |u|
  describe alicloud_ram_user(u) do
    its('has_console_access') { should be false }
  end
end

Matchers

For a full list of available matchers, please visit our matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe alicloud_ram_users.where( <property>: <value>) do
  it { should exist }
end

describe alicloud_ram_users.where( <property>: <value>) do
  it { should_not exist }
end

Alicloud Permissions

Your Principal will need the following permissions action with Effect set to Allow: ram:Listusers, ram:GetLoginProfile, ram:ListAccessKeys, ram:GetUserMFAInfo

See the Alibaba Cloud Resource Access Management documentation and documentation on authentication to RAM APIs.