kitchen.disa.ec2.yml

---
platforms:
  - name: rhel-8

driver:
  name: ec2
  subnet_id: <%= ENV['SAF_PIPELINE_SUBNET'] %>
  security_group_ids: <%= ENV['SAF_PIPELINE_SG'] %>
  metadata_options:
    http_tokens: required
    http_put_response_hop_limit: 1
    instance_metadata_tags: enabled
  instance_type: t2.small
  associate_public_ip: true
  interface: public
  skip_cost_warning: true
  privileged: true
  instance_initiated_shutdown_behavior: terminate

provisioner:
  name: ansible_playbook
  hosts: all
  require_chef_for_busser: false
  require_ruby_for_busser: false
  ansible_binary_path: /usr/local/bin
  # require_pip3: true
  ansible_verbose: true
  roles_path: spec/ansible/disa/roles
  galaxy_ignore_certs: true
  #requirements_path: spec/ansible/disa/roles/requirements.yml
  ansible_extra_flags: <%= ENV['ANSIBLE_EXTRA_FLAGS'] %>

suites:
  - name: disa-hardened
    provisioner:
      playbook: spec/ansible/disa/site.yml
    driver:
      tags:
        Name: Hardened-<%= ENV['USER'] %>
        CreatedBy: test-kitchen

lifecycle:
  pre_converge:
    - remote: |
        # echo "+++ Refreshing DNF package cache +++"
        # sudo dnf -y clean all
        echo ""
        echo "+++ Updating DNF Packages +++"
        sudo dnf -y update --nogpgcheck --nobest
        echo ""
        echo "+++ Installing needed packages for workflow and utility +++\n\n"
        sudo dnf -y install --nogpgcheck bc bind-utils redhat-lsb-core vim git wget gcc openssl-devel libffi-devel bzip2-devel
        echo ""
        echo "+++ Installing Python 3.9 and Ansible +++\n\n"
        export PATH=/usr/local/bin:$PATH
        sudo dnf -y install python3.9
        sudo dnf -y install python3-pip
        sudo update-alternatives --set python3 /usr/bin/python3.9
        sudo python3 -m pip install ansible jmespath
        echo ""
        echo "+++ Updating the ec2-user to keep sudo working after hardening phase +++\n\n"
        sudo chage -d $(( $( date +%s ) / 86400 )) ec2-user
        echo ""
        echo "+++ updating ec2-user sudo config for hardening phase +++\n\n"
        sudo chmod 600 /etc/sudoers && sudo sed -i'' "/ec2-user/d" /etc/sudoers && sudo chmod 400 /etc/sudoers

#https://github.com/neillturner/kitchen-ansible/issues/295
transport:
  name: ssh
  max_ssh_sessions: 2