Chef Certified: Compliance Management

This domain tests InSpec and Chef's compliance reporting: writing profiles, running them against targets, reading results, and handling exceptions without hiding risk. It is about expressing security and configuration policy as executable code, then proving it continuously.

Profile structure and the control DSL

An InSpec profile has inspec.yml, controls/, optional libraries/, and files/. A control declares impact, title, desc, and one or more describe blocks. Resources such as file, package, service, port, command, json, and users return matchers; should, should_not, its, and cmp express expectations. cmp compares loosely across string/number representations, which matters for modes and versions.

Running and reporting

• inspec exec profile -t ssh://user@host runs remotely; -t local and -t docker:// are also common. inspec check, inspec json, and inspec archive validate and package profiles.
• Reports can be emitted as CLI, JSON, or HTML with --reporter and --output.
• Chef Infra Client can run profiles in audit mode with chef-client --audit-mode, and newer clients expose a compliance phase; Chef Automate stores and visualizes results from scan jobs.
• Profile dependencies are declared in inspec.yml; waivers are YAML entries that record a control ID, justification, and expiration.

Worked example

A control checks sshd_config for PermitRootLogin no. A legacy node still permits root login. The correct response is a waiver with an expiration date and justification, not changing impact to 0.0 or deleting the control. A waiver preserves the finding and its audit trail; impact 0.0 removes the signal from scoring, so the exception becomes invisible.

Traps that cost marks

• its('mode') returns a string such as 0644; use cmp rather than numeric equality.
• command runs a shell command and checks exit status/output; it is not a file-content check.
• A profile that passes locally may fail remotely because the target's OS, user, or path differs.
• Waivers expire; an expired waiver should not be treated as a pass.
• Audit mode is not a substitute for remediation; it reports, it does not converge the node.