diff --git a/README.md b/README.md
index c3153e82c..92034c0b4 100644
--- a/README.md
+++ b/README.md
@@ -58,21 +58,25 @@ supports:
The following resources are available in the InSpec GCP Profile
-- [google_project_iam_custom_role](docs/resources/google_project_iam_custom_role.md)
-- [google_compute_instance](docs/resources/google_compute_instance.md)
-- [google_service_account](docs/resources/google_service_account.md)
-- [google_container_cluster](docs/resources/google_container_cluster.md)
-- [google_compute_firewalls](docs/resources/google_compute_firewalls.md)
-- [google_project](docs/resources/google_project.md)
- [google_compute_address](docs/resources/google_compute_address.md)
- [google_compute_firewall](docs/resources/google_compute_firewall.md)
+- [google_compute_firewalls](docs/resources/google_compute_firewalls.md)
- [google_compute_image](docs/resources/google_compute_image.md)
+- [google_compute_instance](docs/resources/google_compute_instance.md)
- [google_compute_instance_group](docs/resources/google_compute_instance_group.md)
-- [google_compute_zones](docs/resources/google_compute_zones.md)
-- [google_compute_zone](docs/resources/google_compute_zone.md)
- [google_compute_instances](docs/resources/google_compute_instances.md)
-- [google_storage_bucket](docs/resources/google_storage_bucket.md)
+- [google_compute_zone](docs/resources/google_compute_zone.md)
+- [google_compute_zones](docs/resources/google_compute_zones.md)
+- [google_container_cluster](docs/resources/google_container_cluster.md)
+- [google_container_clusters](docs/resources/google_container_clusters.md)
- [google_container_node_pool](docs/resources/google_container_node_pool.md)
+- [google_container_node_pools](docs/resources/google_container_node_pools.md)
+- [google_project](docs/resources/google_project.md)
+- [google_project_iam_custom_role](docs/resources/google_project_iam_custom_role.md)
+- [google_projects](docs/resources/google_projects.md)
+- [google_service_account](docs/resources/google_service_account.md)
+- [google_storage_bucket](docs/resources/google_storage_bucket.md)
+- [google_storage_buckets](docs/resources/google_storage_buckets.md)
## Test inspec-gcp resources
@@ -128,6 +132,11 @@ $ bundle exec rake test:run_integration_tests
$ bundle exec rake test:cleanup_integration_tests
```
+## Further Reading
+
+* [Introduction to InSpec GCP](https://lollyrock.com/articles/inspec-cloud-gcp-setup/)
+* [InSpec GCP Deep Dive](https://blog.chef.io/2018/06/19/inspec-gcp-deep-dive/)
+
## FAQ
### Failure running "inspec exec" on my GCP profile
diff --git a/docs/resources/google_compute_firewall.md b/docs/resources/google_compute_firewall.md
index 867fc063e..f04ff04ae 100644
--- a/docs/resources/google_compute_firewall.md
+++ b/docs/resources/google_compute_firewall.md
@@ -65,7 +65,7 @@ The following examples show how to use this InSpec audit resource.
it { should allow_port_protocol("80", "tcp") }
end
-### Test whether firewall rule allows ingress/egrees for specified tags
+### Test whether firewall rule allows ingress/egress for specified tags
describe google_compute_firewall(project: 'chef-inspec-gcp', name: 'firewall-rule') do
its('direction') { should eq "INGRESS" }
diff --git a/docs/resources/google_compute_zones.md b/docs/resources/google_compute_zones.md
index d9c0fc074..688135e03 100644
--- a/docs/resources/google_compute_zones.md
+++ b/docs/resources/google_compute_zones.md
@@ -71,7 +71,7 @@ The following examples show how to use this InSpec audit resource.
## Filter Criteria
-This resource supports the following filter criteria: `zone_id`; `zone_name` and `zone_status`. Anyy of these may be used with `where`, as a block or as a method.
+This resource supports the following filter criteria: `zone_id`; `zone_name` and `zone_status`. Any of these may be used with `where`, as a block or as a method.
## Properties
diff --git a/docs/resources/google_container_clusters.md b/docs/resources/google_container_clusters.md
new file mode 100644
index 000000000..b1609550f
--- /dev/null
+++ b/docs/resources/google_container_clusters.md
@@ -0,0 +1,77 @@
+---
+title: About the google_container_clusters Resource
+platform: gcp
+---
+
+# google\_container\_clusters
+
+Use the `google_container_clusters` InSpec audit resource to test properties of all, or a filtered group of, GCP container clusters for a project in a particular `google_compute_zone`.
+
+
+
+## Syntax
+
+A `google_container_clusters` resource block collects GCP clusters by project and zone, then tests that group.
+
+ describe google_container_clusters(project: 'chef-inspec-gcp', zone: 'europe-west2-a') do
+ it { should exist }
+ end
+
+Use this InSpec resource to enumerate IDs then test in-depth using `google_container_cluster`.
+
+ google_container_clusters(project: 'chef-inspec-gcp', zone: 'europe-west2-a').cluster_names.each do |cluster_name|
+ describe google_container_cluster(project: 'chef-inspec-gcp', cluster: cluster_name) do
+ it { should exist }
+ end
+ end
+
+
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test that there are no more than a specified number of clusters available for the project in a particular zone
+
+ describe google_container_clusters(project: 'chef-inspec-gcp', zone: 'europe-west2-a') do
+ its('count') { should be <= 5}
+ end
+
+### Test that an expected cluster is available for the project
+
+ describe google_container_clusters(project: 'chef-inspec-gcp', zone: 'europe-west2-a') do
+ its('cluster_names') { should include "my-cluster" }
+ end
+
+### Test whether any clusters are in status "STOPPED"
+
+ describe google_container_clusters(project: 'chef-inspec-gcp', zone: 'europe-west2-a') do
+ its('cluster_statuses') { should_not include "STOPPED" }
+ end
+
+### Test that a subset of all clusters matching "kube*" are "RUNNING"
+
+ describe google_container_clusters(project: gcp_project_id).where(cluster_name: /^kube/).cluster_names.each do |cluster_name|
+ describe google_container_cluster(project: 'chef-inspec-gcp', zone: 'europe-west2-a', name: cluster_name) do
+ it { should exist }
+ its('status') { should eq 'RUNNING' }
+ end
+ end
+
+
+
+## Filter Criteria
+
+This resource supports the following filter criteria: `cluster_name` and `cluster_status`. Any of these may be used with `where`, as a block or as a method.
+
+## Properties
+
+* `cluster_names` - an array of google_container_cluster name strings
+* `cluster_statuses`- an array of google_container_cluster status stringss
+
+
+
+
+## GCP Permissions
+
+Ensure the [Kubernetes Engine API](https://console.cloud.google.com/apis/library/container.googleapis.com) is enabled for the project where the resource is located.
\ No newline at end of file
diff --git a/docs/resources/google_container_node_pools.md b/docs/resources/google_container_node_pools.md
new file mode 100644
index 000000000..d65f1de60
--- /dev/null
+++ b/docs/resources/google_container_node_pools.md
@@ -0,0 +1,72 @@
+---
+title: About the google_container_node_pools Resource
+platform: gcp
+---
+
+# google\_container\_node_pools
+
+Use the `google_container_node_pools` InSpec audit resource to test properties of all, or a filtered group of, GCP container node_pools for a project, cluster and zone.
+
+
+
+## Syntax
+
+A `google_container_node_pools` resource block collects GCP node pools by project, cluster and zone then tests that group.
+
+ describe google_container_node_pools(project: 'chef-inspec-gcp', zone: 'europe-west2-a', cluster_name: 'inspec-gcp-cluster') do
+ it { should exist }
+ end
+
+Use this InSpec resource to enumerate IDs then test in-depth using `google_container_node_pool`.
+
+ google_container_node_pools(project: 'chef-inspec-gcp', zone: 'europe-west2-a', cluster_name: 'inspec-gcp-cluster').node_pool_names.each do |node_pool_name|
+ describe google_container_node_pool(project: 'chef-inspec-gcp', zone: 'europe-west2-a', cluster_name: 'inspec-gcp-cluster', nodepool_name: node_pool_name) do
+ it { should exist }
+ its('status') { should eq 'RUNNING' }
+ end
+ end
+
+
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test that there are no more than a specified number of node pools available for the project
+
+ describe google_container_node_pools(project: 'chef-inspec-gcp') do
+ its('count') { should be <= 10}
+ end
+
+### Test that an expected node pool is available for the project
+
+ describe google_container_node_pools(project: 'chef-inspec-gcp') do
+ its('node_pool_names') { should include "us-east1-b" }
+ end
+
+### Test that a subset of all node pools matching "mypooll*" are "UP"
+
+ describe google_container_node_pools(project: 'chef-inspec-gcp', zone: 'europe-west2-a', cluster_name: 'inspec-gcp-cluster').where(node_pool_name: /^mypool/).node_pool_names.each do |node_pool_name|
+ describe google_container_node_pool(project: 'chef-inspec-gcp', zone: 'europe-west2-a', cluster_name: 'inspec-gcp-cluster', nodepool_name: node_pool_name) do
+ it { should exist }
+ its('status') { should eq 'RUNNING' }
+ end
+ end
+
+
+
+## Filter Criteria
+
+This resource supports the following filter criteria: `node_pool_name` and `node_pool_status`. Any of these may be used with `where`, as a block or as a method.
+
+## Properties
+
+* `node_pool_names` - an array of google_container_node_pool name strings
+* `node_pool_statuses`- an array of google_container_node_pool status stringss
+
+
+
+
+## GCP Permissions
+
+Ensure the [Kubernetes Engine API](https://console.cloud.google.com/apis/library/container.googleapis.com) is enabled for the project where the resource is located.
\ No newline at end of file
diff --git a/docs/resources/google_projects.md b/docs/resources/google_projects.md
index 238167a32..85ace6858 100644
--- a/docs/resources/google_projects.md
+++ b/docs/resources/google_projects.md
@@ -41,19 +41,19 @@ The following examples show how to use this InSpec audit resource.
### Test that an expected named project is available
describe google_projects do
- its('project_names'){ should include gcp_project_id }
+ its('project_names'){ should include "gcp_project_id" }
end
### Test that an expected project number is available
describe google_projects do
- its('project_ids'){ should include gcp_project_name }
+ its('project_ids'){ should include "gcp_project_name" }
end
### Test that an expected project id is available
describe google_projects do
- its('project_numbers'){ should include gcp_project_number }
+ its('project_numbers'){ should include 1122334455 }
end
### Test that a particular subset of projects with id 'prod*' are in ACTIVE lifecycle state
diff --git a/docs/resources/google_storage_bucket.md b/docs/resources/google_storage_bucket.md
index f85ff618b..9489e5a0f 100644
--- a/docs/resources/google_storage_bucket.md
+++ b/docs/resources/google_storage_bucket.md
@@ -48,7 +48,7 @@ The following examples show how to use this InSpec audit resource.
* `etag`, `id`, `kind`, `location`, `metageneration`, `name`, `project_number`, `storage_class`, `time_created`, `updated`
-s
+
## GCP Permissions
diff --git a/docs/resources/google_storage_buckets.md b/docs/resources/google_storage_buckets.md
new file mode 100644
index 000000000..6fea754fe
--- /dev/null
+++ b/docs/resources/google_storage_buckets.md
@@ -0,0 +1,75 @@
+---
+title: About the google_storage_buckets Resource
+platform: gcp
+---
+
+# google\_storage\_bucket
+
+Use the `google_storage_buckets` InSpec audit resource to test properties of a GCP storage buckets.
+
+
+
+## Syntax
+
+A `google_storage_buckets` resource block collects GCP buckets by project then tests that group.
+
+ describe google_storage_buckets(project: 'chef-inspec-gcp') do
+ it { should exist }
+ end
+
+Use this InSpec resource to enumerate IDs then test in-depth using `google_storage_bucket`.
+
+ google_storage_buckets(project: 'chef-inspec-gcp').bucket_names.each do |bucket_name|
+ describe google_storage_bucket(name: bucket_name) do
+ it { should exist }
+ its('storage_class') { should eq 'STANDARD' }
+ end
+ end
+
+
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test that there are no more than a specified number of storage buckets for the project
+
+ describe google_storage_buckets(project: 'chef-inspec-gcp') do
+ its('count') { should be <= 100}
+ end
+
+
+### Test that an expected named bucket is available
+
+ describe google_storage_buckets do
+ its('bucket_names'){ should include "my_expected_bucket" }
+ end
+
+### Test that all buckets belong to the expected project number
+
+ google_storage_buckets(project: 'chef-inspec-gcp').bucket_names.each do |bucket_name|
+ describe google_storage_bucket(name: bucket_name) do
+ it { should exist }
+ its('project_number'){ should eq 1122334455 }
+ end
+ end
+
+
+
+## Filter Criteria
+
+This resource supports the following filter criteria: `bucket_id`; `bucket_name`; `bucket_project_number` and `bucket_location`. Any of these may be used with `where`, as a block or as a method.
+
+## Properties
+
+* `bucket_ids` - an array of google_storage_bucket identifier strings
+* `bucket_names` - an array of google_storage_bucket name strings
+* `bucket_project_numbers`- an array of google_storage_bucket identifier integers
+* `bucket_locations`- an array of google_storage_bucket location strings
+
+