Cloud

Chef Premium Content has current coverage for 4 cloud benchmarks, with every audit version and remediation version currently available. See benchmark coverage for how audit and remediation coverage are tracked, and the Compliance solution overview for what each does.

For what each coverage term means, see how to read the coverage tables.

Inspect cloud configuration directly

The benchmarks above are prebuilt content. When your requirement isn’t covered by one — a provider service with no published benchmark, or a control specific to your organization — you can write your own Chef InSpec controls against the provider API.

Chef InSpec provides resource packs for the major cloud providers:

• AWS resource pack — inspect EC2, IAM, RDS, Lambda, VPC and networking, CloudFront, CloudWatch, and more
• Azure resource pack — inspect virtual machines, SQL, networking, Key Vault, policy, and Active Directory
• GCP resource pack — inspect Compute Engine, Cloud SQL, Cloud Storage, GKE, IAM, KMS, and more

A resource pack isn’t a benchmark and doesn’t assess anything on its own. It provides the resources you use to write your own controls.

For a worked example, The Chef way of AWS compliance builds a profile on the AWS pack that checks S3 buckets, IAM policies, and security groups across an account, then runs it and reads the findings.

Related

• Chef Premium Content
• Compliance solution overview
• Compliance audit
• Compliance remediation
• The Chef way of custom compliance checks
• Chef InSpec
• Compliance reporting in Chef Automate