aws_dms_endpoint Resource

Use the aws_dms_endpoint InSpec audit resource to test properties of a single specific AWS Database Migration Service (DMS) endpoint.

For additional information, including details on parameters and properties, see the AWS documentation on DMS endpoints.

Installation

This resource is available in the Chef InSpec AWS resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your AWS environment for InSpec and creating an InSpec profile that uses the InSpec AWS resource pack.

Syntax

Ensure that an arn exists.

describe aws_dms_endpoint(endpoint_arn: 'test-arn') do
  it { should exist }
end

Parameters

endpoint_arn (required): The ARN of the DMS endpoint.

Properties

endpoint_identifier: The database endpoint identifier.
endpoint_type: The endpoint type.
engine_name: The type of engine for the endpoint. Valid values: mysql, oracle, postgres, mariadb, aurora, aurora-postgresql, redshift, s3, db2, azuredb, sybase, dynamodb, mongodb, kinesis, kafka, elasticsearch, docdb, sqlserver, and neptune.
engine_display_name: The expanded name for the engine name.
username: The user name used to connect to the endpoint.
server_name: The name of the server at the endpoint.
port: The port value used to access the endpoint.
database_name: The name of the database at the endpoint.
extra_connection_attributes: Additional connection attributes used to connect to the endpoint.
status: The status of the endpoint.
kms_key_id: An AWS KMS key identifier that is used to encrypt the connection parameters for the endpoint.
endpoint_arn: The ARN of the endpoint.
certificate_arn: The ARN used for SSL connection to the endpoint.
ssl_mode: The SSL mode used to connect to the endpoint.
service_access_role_arns: The ARN used by the service access IAM role.
external_table_definition: The external table definition.
external_id: Value returned by a call to CreateEndpoint that can be used for cross-account validation.
dynamo_db_settings: Settings in JSON format for the target Amazon DynamoDB endpoint.
s3_settings: Settings in JSON format for the target Amazon S3 endpoint.
dms_transfer_settings: The settings in JSON format for the DMS transfer type of source endpoint.
mongo_db_settings: The settings for the MongoDB source endpoint.
kinesis_settings: The settings for the Amazon Kinesis target endpoint.
kafka_settings: The settings for the Apache Kafka endpoint.
elasticsearch_settings: The settings for the Elasticsearch endpoint.
neptune_settings: The settings for the Amazon Neptune target endpoint.
redshift_settings: The settings for the Amazon Redshift endpoint.
postgre_sql_settings: The settings for the PostgreSQL source and target endpoint.
my_sql_settings: The settings for the MySQL source and target endpoint.
oracle_settings: The settings for the Oracle source and target endpoint.
sybase_settings: The settings for the SAP ASE source and target endpoint.
microsoft_sql_server_settings: The settings for the Microsoft SQL Server source and target endpoint.
ibm_db_2_settings: The settings for the IBM Db2 LUW source endpoint.
doc_db_settings: The settings for the DocumentDB endpoint.

Examples

Ensure an engine name is available.

describe aws_dms_endpoint(endpoint_arn: 'ENDPOINT_ARN') do
  its('engine_name') { should eq 'ENDPOINT_ENGINE_NAME' }
end

Ensure that the endpoint listens to a specific port.

describe aws_dms_endpoint(endpoint_arn: 'ENDPOINT_ARN') do
    its('port') { should eq 3306 }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

The controls will pass if the describe method returns at least one result.

exist

Use should to test that the entity exists.

describe aws_dms_endpoint(endpoint_arn: 'ENDPOINT_ARN') do
  it { should exist }
end

Use should_not to test the entity does not exist.

describe aws_dms_endpoint(endpoint_arn: 'ENDPOINT_ARN') do
  it { should_not exist }
end

be_available

Use should to check if the endpoint is available.

describe aws_dms_endpoint(endpoint_arn: 'ENDPOINT_ARN') do
  it { should be_available }
end

AWS Permissions

Your Principal will need the DatabaseMigrationService:Client:DescribeEndpointsResponse action with Effect set to Allow.