InSpec

​

Overview

​

Capabilities

• Tests against live infrastructure (servers, containers, cloud resources)
• Rich resource library for AWS, Azure, GCP, and OS-level checks
• Compliance profiles map to regulatory frameworks
• Human-readable test output

​

Limitations

• Requires a running system or cloud API access
• Not applicable to source code analysis — check out Semgrep or CodeQL for source code checks
• Tests state at a point in time, not code patterns

​

Generated Format

• Language: Ruby
• Structure: InSpec control files with control, describe, and it blocks
• Execution: inspec exec profile/

​

Example Guardrail

control 's3-encryption' do
  impact 1.0
  title 'Ensure all S3 buckets have encryption enabled'

  aws_s3_buckets.bucket_names.each do |bucket|
    describe aws_s3_bucket(bucket) do
      it { should have_default_encryption_enabled }
    end
  end
end