Chef InSpec

Visit Website

Introduction

Chef InSpec is an open-source framework for testing and auditing applications and infrastructure. Tests are written as human-readable controls in a Ruby-based DSL, such as describe port(443) do it { should be_listening } end, and can run locally, over SSH or WinRM, inside Docker containers, or against cloud APIs.

Controls are grouped into profiles that carry metadata like impact and references to compliance standards, and community profiles exist for CIS benchmarks and other baselines. Resource packs extend InSpec to AWS, Azure and Google Cloud so the same style of control can check a security group or a storage bucket.

The source code is Apache-2.0, while Progress Chef distributes official builds under its own licence terms, so check which you are installing. In the quality loop InSpec works as a verifier in Test Kitchen, as a post-deploy check, and as a continuous compliance scan in production.

The source code is at inspec/inspec on GitHub under the Apache-2.0 licence, with about 3,100 stars; the most recent commit was on 10 November 2026.

Features

1. Readable controls: describe blocks with matchers for files, ports, packages, services and more.
2. Remote targets: SSH, WinRM, Docker and cloud API targets.
3. Profiles: Package and share controls with metadata and dependencies.
4. Cloud resources: AWS, Azure and GCP resource packs.
5. Reporters: CLI, JSON, JUnit and HTML output.
6. Waivers: Document accepted exceptions.

Pros

1. Compliance-friendly: Controls map cleanly to audit requirements.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 10 November 2026.
4. Community: About 3,100 GitHub stars.

Cons

1. Licensing nuance: Official Chef builds have commercial terms separate from the open-source code.
2. Ruby ecosystem: Ruby tooling is needed to extend it.
3. Slower than unit tests: Runs against real systems.

Usage and Links (Example)

control 'ssh-01' do
  impact 1.0
  title 'SSH root login disabled'
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end

inspec exec ./profile -t ssh://admin@host --reporter cli junit2:inspec.xml

Resources:

• Chef InSpec website
• GitHub repository

Pricing

Chef InSpec is free and open source under the Apache-2.0 licence.

Recommended for?

1. Security and compliance teams auditing fleets against baselines.
2. Infrastructure teams verifying servers after configuration changes.

Conclusion

InSpec turns compliance requirements into executable, reviewable tests.

Confirm the licence of the build you use, then run the same profiles in CI and in production.

On CheckOps, Chef InSpec is filed under the Integration testing, Security testing and Production monitoring & observability stages. Related tools listed here include Terratest, Test Kitchen, Molecule, Goss, terraform-compliance and Container Structure Test. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.