Adds azurerm_locks

docs/resources/azurerm_locks.md.erb

@@ -0,0 +1,82 @@
+---
+title: About the azurerm_locks Resource
+platform: azure
+---
+
+# azurerm\_locks
+
+Use the `azurerm_locks` InSpec audit resource to test properties of
+some or all Azure Resource Locks.
+
+<br />
+
+## Azure REST API version
+
+This resource interacts with version `2016-09-01` of the Azure
+Management API. For more information see the [official Azure documentation](https://docs.microsoft.com/en-us/rest/api/resources/managementlocks/listatresourcelevel).
+
+At the moment, there doesn't appear to be a way to select the version of the
+Azure API docs. If you notice a newer version being referenced in the official
+documentation please open an issue or submit a pull request using the updated
+version.
+
+## Availability
+
+### Installation
+
+This resource is available in the `inspec-azure` [resource
+pack](https://www.inspec.io/docs/reference/glossary/#resource-pack). To use it, add the
+following to your `inspec.yml` in your top-level profile:
+
+    depends:
+      - name: inspec-azure
+        git: https://github.com/inspec/inspec-azure.git
+
+You'll also need to setup your Azure credentials; see the resource pack
+[README](https://github.com/inspec/inspec-azure#inspec-for-azure).
+
+### Version
+
+This resource first became available in 1.3.8 of the inspec-azure resource pack.
+
+## Syntax
+
+An `azurerm_locks` resource block returns all Locks on a given Resource.
+
+    describe azurerm_locks(resource_group: 'rg', resource_name: 'my-vm', resource_type: 'Microsoft.Compute/virtualMachines') do
+      ...
+    end
+
+<br />
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Ensure a Lock exists
+
+    describe azurerm_locks(resource_group: 'my-rg', resource_name: 'my-vm', resource_type: 'Microsoft.Compute/virtualMachines') do
+      it { should exist }
+    end
+
+## Filter Criteria
+
+* `ids`
+* `names`
+* `properties`
+
+## Matchers
+
+This InSpec audit resource has the following special matchers. For a full list of available matchers,
+please visit our [Universal Matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### exists
+
+The control will pass if the filter returns at least one result. Use
+`should_not` if you expect zero matches.
+
+## Azure Permissions
+
+Your [Service
+Principal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal)
+must be setup with a `contributor` role on the subscription you wish to test.

libraries/azurerm_locks.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require 'azurerm_resource'
+
+class AzurermLocks < AzurermPluralResource
+  name 'azurerm_locks'
+  desc 'Verifies settings for an Azure Lock on a Resource'
+  example <<-EXAMPLE
+    describe azurerm_locks(resource_group: 'my-rg', resource_name: 'my-vm', resource_type: 'Microsoft.Compute/virtualMachines') do
+      it { should exist }
+    end
+  EXAMPLE
+
+  attr_reader :table
+
+  FilterTable.create
+             .register_column(:ids,        field: :id)
+             .register_column(:names,      field: :name)
+             .register_column(:properties, field: :properties)
+             .install_filter_methods_on_resource(self, :table)
+
+  def initialize(resource_group: nil, resource_name: nil, resource_type: nil)
+    resp = management.locks(resource_group, resource_name, resource_type)
+    return if has_error?(resp)
+
+    @table = resp
+  end
+
+  def to_s
+    'Azure Locks'
+  end
+end

libraries/support/azure/management.rb

@@ -34,6 +34,14 @@ def activity_log_alert_filtered(filter)
       )
     end
 
+    def locks(resource_group, resource_name, resource_type)
+      get(
+        url: link(location: "#{resource_type}/#{resource_name}",
+                  resource_group: resource_group) + 'providers/Microsoft.Authorization/locks',
+        api_version: '2016-09-01',
+      )
+    end
+
     def log_profile(id)
       get(
         url: link(location: 'Microsoft.Insights/logProfiles') + id,

libraries/support/azure/service.rb

@@ -102,13 +102,13 @@ def get(url:, api_version:, error_handler: nil, unwrap: nil, use_cache: true, pa
       end
     end
 
-    def post(url:, api_version:, error_handler: nil, unwrap: nil, use_cache: true)
+    def post(url:, api_version:, error_handler: nil, unwrap: nil, use_cache: true, params: {}) # rubocop:disable Metrics/ParameterLists
       confirm_configured!
 
       body = cache.fetch(url) if use_cache
 
       body ||= rest_client.post(url,
-                                params:  { 'api-version' => api_version },
+                                params:  { 'api-version' => api_version }.merge(params),
                                 headers: { Accept: 'application/json' }).body
 
       error_handler&.(body)

test/integration/verify/controls/azurerm_locks.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+resource_group = attribute('resource_group', default: nil)
+resource_name = attribute('windows_vm_name', default: nil)
+resource_type = 'Microsoft.Compute/virtualMachines'
+
+control 'azurerm_locks' do
+  describe azurerm_locks(resource_group: resource_group, resource_name: resource_name, resource_type: resource_type) do
+    it { should_not exist }
+  end
+end