azure_subscription resource

Use the azure_subscription InSpec audit resource to test the properties of the current subscription.

Azure REST API version, endpoint, and HTTP client parameters

This resource interacts with API versions supported by the resource provider. You can specify the api_version as a resource parameter to use a specific version of the Azure REST API. If you don’t specify an API version, this resource uses the latest version available. For more information about API versioning, see the azure_generic_resource.

By default, this resource uses the azure_cloud global endpoint and default HTTP client settings. You can override these settings if you need to connect to a different Azure environment (such as Azure Government or Azure China). For more information about configuration options, see the resource pack README.

Syntax

This resource will retrieve the current subscription ID that InSpec uses unless it is provided via id or resource_id parameters.

describe azure_subscription do
  it { should exist }
end

Or

describe azure_subscription(id: '2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Or

describe azure_subscription(resource_id: '/subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd') do
  it { should exist }
end

Parameters

id

The ID of the target subscription. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

resource_id

The fully qualified ID for the subscription. /subscriptions/2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations_api_version

The endpoint API version for the locations property. Optional. The latest version will be used unless provided.

Properties

name

The subscription display name.

id

The subscription ID. 2e0b423p-aaaa-bbbb-1111-ee558463aabbd.

locations

The list of all available geo-location names that have the metadata.physicalLocation is set.

all_locations

The list of all available geo-location names. This includes physical and logical locations.

physical_locations<superscript>*</superscript>

The list of all available geo-location names with the metadata.regionType is set to Physical.

logical_locations

The list of all available geo-location names with the metadata.regionType is set to Logical.

locations_list

The list of all available geo-location objects in this format.

managedByTenants

An array containing the tenants managing the subscription.

diagnostic_settings

The diagnostic settings set at a subscription level.

diagnostic_settings_enabled_logging

The enabled logging types from diagnostic settings set at a subscription level.

diagnostic_settings_disabled_logging

The disabled logging types from diagnostic settings set at a subscription level.

* physical_locations might be different than the locations property depending on the API version. This is because of the change in the Azure API terminology. It is advised to see the official documentation for more information.

For properties applicable to all resources, such as type and properties, refer to azure_generic_resource.

Also, see the Azure documentation for other available properties. You can access any attribute in the response with the key names separated by dots (.). For example, properties.<attribute>.

Examples

Test subscription`s display name:

describe azure_subscription do
  its('name') { should cmp 'Demo Resources' }
end

Test subscription`s authorization source:

describe azure_subscription do
  its('authorizationSource') { should cmp 'RoleBased' }
end

Test subscription`s locations:

describe azure_subscription do
  its('locations') { should include('eastus') }
end

Test subscription`s enabled logging types (via diagnostic settings):

describe azure_subscription do
  its('diagnostic_settings_enabled_logging_types') { should include('ResourceHealth') }
end

Test subscription`s disabled logging types (via diagnostic settings):

describe azure_subscription do
  its('diagnostic_settings_disabled_logging_types') { should include('Recommendation') }
end

Matchers

This resource has the following special matchers.

exists

# If we expect a resource to always exist.

describe azure_subscription do
  it { should exist }
end

not_exists

# If we expect a resource to never exist.

describe azure_subscription(id: 'fake_id') do
  it { should_not exist }
end

Azure permissions

Your Service Principal must be set up with at least a contributor role on the subscription you wish to test.