Chef has announced a major release to its compliance automation platform InSpec. Version 3.0 of the solution includes a new plugin architecture, improved usability, enhanced management and automation compliance for Terraform, and improved performance.
According to the company, this release is meant to target DevSecOps teams.
In addition, the release includes a number of bug fixes and adds platform support.
InSpec is an open-source language for providing security and compliance rules for software engineers, operations and security engineers, Chef explained. It can be used throughout all stages of the software delivery life cycle for continuous compliance.
“Establishing and maintaining compliance across heterogeneous environments is a daunting task, made more so by ever-shifting regulatory requirements alongside rapidly-evolving hybrid IT strategies,” said Corey Scobie, SVP of product and engineering at Chef. “InSpec 3.0 further eases the path to compliance for both developers and operations teams, and helps accelerate enterprises’ digital transformations by laying a solid foundation for cloud migration.”
The new plugin architecture is designed to extend InSpec to a variety of systems for compliance automation. It is available for InSpec and Transport Interface Library, and enables pluggable communication protocols and new resource types to be developed. For exception management, InSpec now includes actions, streaming processes and outcomes for core audit and remediation capabilities. “Exception management is challenging both in terms of the ability to skip the execution of certain InSpec controls on specific nodes (e.g., those with compensating controls) and the ability to keep track of acceptable failures (i.e., where controls are not skipped but the failures are acceptable),” the company explained in an announcement.
The solution also includes a new stable API between profiles and attributes in order to enable the ability to author new resources.
Other features include compliance for Terraform in order to validate the state of VMs and cloud infrastructure, compliance for Google Cloud Platform, and improved metadata interface on controls.
