iis_site resource

Use the iis_site Chef InSpec audit resource to test the state of IIS on Windows Server 2012 (and later).

Availability

Install

This resource is distributed with Chef InSpec and is automatically available for use.

Version

This resource first became available in v1.0.0 of InSpec.

Syntax

An iis_site resource block declares details about the named site:

describe iis_site('site_name') do
  it { should exist }
  it { should be_running }
  it { should have_app_pool('app_pool_name') }
  it { should have_binding('binding_details') }
  it { should have_path('path_to_site') }
end

where

• 'site_name' is the name of the site, such as 'Default Web Site'
• ('app_pool_name') is the name of the application pool in which the site’s root application is run, such as 'DefaultAppPool'
• ('binding_details') is a binding for the site, such as 'net.pipe *'. A site may have multiple bindings; therefore, use a have_binding matcher for each site binding to be tested
• ('path_to_site') is the path to the site, such as 'C:\\inetpub\\wwwroot'

For example:

describe iis_site('Default Web Site') do
  it { should exist }
  it { should be_running }
  it { should have_app_pool('DefaultAppPool') }
  it { should have_binding('https :443:www.contoso.com sslFlags=0') }
  it { should have_binding('net.pipe *') }
  it { should have_path('C:\\inetpub\\wwwroot') }
end

Properties

app_pool, bindings, path, state

Property Examples

The following examples show how to use this Chef InSpec audit resource.

Test a default IIS site

describe iis_site('Default Web Site') do
  it { should exist }
  it { should be_running }
  it { should have_app_pool('DefaultAppPool') }
  it { should have_binding('http *:80:') }
  it { should have_path('%SystemDrive%\\inetpub\\wwwroot') }
end

Test if IIS service is running

describe service('W3SVC') do
  it { should be_installed }
  it { should be_running }
end

Matchers

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

be_running

The be_running matcher tests if the site is running:

it { should be_running }

exist

The exist matcher tests if the site exists:

it { should exist }

have_app_pool

The have_app_pool matcher tests if the named application pool exists for the site:

it { should have_app_pool('DefaultAppPool') }

For example, testing if a site’s application pool inherits the settings of the parent application pool:

it { should have_app_pool('/') }

have_binding

The have_binding matcher tests if the specified binding exists for the site:

it { should have_binding('http :80:*') }

or:

it { should have_binding('net.pipe *') }

A site may have multiple bindings; use a have_binding matcher for each unique site binding to be tested.

Binding Attributes

The have_binding matcher can also test attributes that are defined for a site binding. For example, the sslFlags attribute defines if SSL is enabled, and (when enabled) what level of SSL is applied to the site.

Testing a site with SSL disabled:

it { should have_binding('https :443:www.contoso.com sslFlags=0') }

Testing a site with SSL enabled:

it { should have_binding('https :443:www.contoso.com sslFlags=Ssl') }

Testing a site with certificate mapping authentication enabled:

it { should have_binding('https :443:www.contoso.com sslFlags=SslMapCert') }

Testing a site with 128-bit SSL enabled:

it { should have_binding('https :443:www.contoso.com sslFlags=Ssl128') }

have_path

The have_path matcher tests if the named path is defined for the site:

it { should have_path('C:\\inetpub\\wwwroot') }