Delivered at ChefConf '21 Online. https://www.chef.io/chefconf

1. A Journey to Improve
Infrastructure Compliance
With InSpec
Cliffano Subagio | Shine Solutions Australia
ChefConf ‘21 - 7 to 9 September 2021

2. About
Cliffano Subagio
Principal Engineer at Shine Solutions Australia

3. Agenda
1. How the journey starte
d
2. InSpec to the rescu
e
3. Custom InSpec Profile
s
4. Chef Supermarke
t
5. Community InSpec Profile
s
6. How the journey continues

4. 1. How the journey started

5. Delivery pipeline
5
DEV TEST STAGE PROD
Compliance Review

6. Application (AEM on AWS)
6
Authoring Publishing Web
Publishing
Publishing
Web
Web
Private DMZ Public
!!!

7. Were we compliant?
7
Maybe

8. Four major problems
8
• Manual correctness checks
Once per application deployment
• Manual readiness checks
Once per environment creation
• Manual security checks
Once per release
• Manual compliance checks
Once per release

10. 2. InSpec to the rescue

11. What is InSpec?
11
• Open source testing framewor
k
• Checks actual state against a desired stat
e
• Useful for testing application and infrastructur
e
• Written in Ruby

12. How to use InSpec?
12
Step 1. Create the test

13. How to use InSpec?
13
Step 2. Run the test

14. How to use InSpec?
14
Step 3. View the report

15. What tests did we create?
15
• Application correctness checks
Testing AEM application installation, configuration, API
• Environment readiness checks
Testing all AWS EC2 servers readiness to serve content
• Application security checks
Testing AEM application security guideline
• Environment compliance checks
Testing application and servers setup against
organisation compliance requirements

16. When did we run those tests?
16
• On every server creation
Each AWS EC2 instance has a cloud-init script
which runs correctness, security, and compliance checks
against the applications
• On every environment creation
Each environment has an AWS Lambda function
which runs readiness and compliance checks against all
servers
• On-demand
Jenkins CI/CD pipelines which run all types of checks

17. 17
Authoring Publishing Web
Publishing
Publishing
Web
Web
Server
correctness,
readiness,
security
tests
Environment
correctness,
readiness,
security
tests

18. But wait, there were more problems
18
• Many standalone test files
• Different engineers structured the tests differently
• No clear grouping between tests
• We started writing some custom CIS Benchmarks
and AWS checks

19. 3.Custom InSpec Profiles

20. InSpec Profile structure
20

21. Controls
21

22. Libraries
22

23. InSpec exec
23

24. InSpec exec report
24

25. We created three InSpec Profiles
25
• InSpec AEM
Checks a single AEM application
https://github.com/shinesolutions/inspec-aem
• InSpec AEM Security
Checks AEM security guideline
https://github.com/shinesolutions/inspec-aem-security
• InSpec AEM AWS
Checks a single AEM on AWS environment
https://github.com/shinesolutions/inspec-aem-aws

26. Problems solved?
26
• Many standalone test files
Test files are now part of InSpec Profiles
• Different engineers structured the tests differently
Everyone follows InSpec Profile style guide
• No clear grouping between tests
Each InSpec Profile defines a domain

27. 4.Chef Supermarket

28. Adding InSpec Profile to Chef Supermarket
28

29. Vendoring InSpec Profiles via Chef Supermarket
29
Project A
Project B
Project C
InSpec AEM
InSpec AEM AWS
InSpec AEM Security

30. InSpec profiles as vendor dependencies
30

31. 5. Community InSpec profiles

32. One more problem
32
• We started writing some CIS Benchmarks and AWS
checks

33. CIS Benchmarks
33
• A set of guidelines and best practice secure
configuration of a system
• Created by Centre for Internet Security together with
tech communities

34. Community InSpec Profiles
34
• CIS Linux Benchmark (DevSec)
Used for securing RHEL7 on AWS EC2 instanc
e
• CIS Docker Benchmark (DevSec)
Used for securing Docker images used by CI/CD
Pipeline
s
• AWS Foundations CIS Baseline (Mitre)
Used for securing AEM on AWS environmen
t
• InSpec AWS (InSpec)
Used for checking AWS resource compliance
against organisation requirements

35. One last improvement
35
Infrastructure readiness and correctness
• If it’s not secure, it’s not correct
• If it’s not secure, it’s not ready

36. 6. How the journey continues

37. Delivery pipeline - before InSpec
37
DEV TEST STAGE PROD
Compliance Review

38. Delivery pipeline - after InSpec
38
DEV TEST STAGE PROD
Continuous Compliance Review

39. Application - before InSpec
39
Authoring Publishing Web
Publishing
Publishing
Web
Web
Private DMZ Public
!!!

40. Application - after InSpec
40
Authoring Publishing Web
Publishing
Publishing
Web
Web
Private DMZ Public

41. We were compliant
41
Definitely

42. Lessons learnt
42
• InSpec is your utility belt for testing anything that can be
coded
• Leverage InSpec Profiles from the community
• If you need to test something once,
you will likely need to test that something again
• Execute tests early in the delivery pipeline
Execute tests continuously along the delivery pipeline
• Never ever send a human to do a machine’s job

43. Thank you! Any questions?
cliff.subagio@shinesolutions.com
linkedin.com/in/cliffano/

44. Resources
https://www.chef.io/products/chef-inspec
https://github.com/shinesolutions/inspec-aem
https://github.com/shinesolutions/inspec-aem-aws
https://github.com/shinesolutions/inspec-aem-security
https://docs.chef.io/inspec/style/
https://supermarket.chef.io/tools?
utf8=%E2%9C%93&q=aem&platforms%5B%5D=
https://supermarket.chef.io/tools?
utf8=%E2%9C%93&q=cis&platforms%5B%5D=
https://www.cisecurity.org/cis-benchmarks/cis-benchmarks-faq/
https://dev-sec.io/

45. Resources
https://static.wikia.nocookie.net/matrix/images/1/1c/
Agent_Brown.gif/revision/latest/scale-to-width-down/640?
cb=20110811025959
https://escapematter.com/wp-content/uploads/2016/11/tm-2.jpg
https://thenounproject.com/search/?q=users&i=791122 - users
by Francisco Garcia Gallegos from the Noun Project
https://i.pinimg.com/originals/48/ed/
81/48ed81bdc641b829ee1e95e1e257db66.jpg