aws_route53_record_set does not work

[mwiczynski-cartera]

aws_route53_record_set should check if a record exists. It does not. It will report true if any record exists in the zone.
It also cannot verify if the value for the record is correct.

Describe the problem

Say you have a zone home.com and a record like foo.home.com. It points to an aws load balancer: 123.us-west-2.elb.amazonaws.com

Both these tests will pass, 2nd one should not.

describe aws_route53_record_set(hosted_zone_id: 'zone-id', start_record_name: 'foo.home.com') do
  it { should exist }
end

describe aws_route53_record_set(hosted_zone_id: 'zone-id', start_record_name: 'bar.home.com') do
  it { should exist }
end

Testing for correct value in resource_records fails to work at all

describe aws_route53_record_set(hosted_zone_id: 'zone-id', start_record_name: 'foo.home.com') do
  its('resource_records.first.value') { should include '123.us-west-2.elb.amazonaws.com' }
end

Some suggestions how to fix this:

Change

inspec-aws/libraries/aws_route53_record_set.rb

Line 21 in ed08c42

resp = @aws.route53_client.list_resource_record_sets({ hosted_zone_id: opts[:hosted_zone_id], start_record_name: opts[:name] })

to

      resp = @aws.route53_client.list_resource_record_sets({ hosted_zone_id: opts[:hosted_zone_id], start_record_name: opts[:start_record_name], max_items: 1 })

There is a mistake in the code, opts[:name] does not exist, should be opts[:start_record_name]

By adding max_items: 1 you limit results returned which is more efficient than returning 100 records by default.

The api docs https://docs.aws.amazon.com/sdk-for-ruby/v2/api/Aws/Route53/Client.html#list_resource_record_sets-instance_method say

If you specify Name but not Type

    The results begin with the first resource record set in the list whose name is greater than or equal to Name.

This means you need to check the value of name in result, not just if response from AWS api call is empty or not.

https://github.com/inspec/inspec-aws/blob/ed08c422c0a8116e621986b192eba4194f1ba346/libraries/aws_route53_record_set.rb#L37C7-L37C7
should be something like:

    [email protected]? && [email protected]? && ( @res[:name] == @start_record_name || @res[:name] == @start_record_name + '.' )