feat(azure-app): extract Web App resource metadata in automated way (#6529)

This commit is contained in:
Rubén De la Torre Vico authored and GitHub committed 2025-01-15 08:48:36 -05:00
1 parent fdac58d031
commit 0db46cdc81
41 files changed
+249 -194

No files matched your search

@@ -64,8 +64,9 @@ class Test_app_client_certificates_on:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Required",
@@ -106,8 +107,9 @@ class Test_app_client_certificates_on:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_ensure_auth_is_set_up:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(),
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_ensure_auth_is_set_up:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=False,
configurations=mock.MagicMock(),
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_ensure_http_is_redirected_to_https:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(),
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_ensure_http_is_redirected_to_https:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(),
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -99,8 +100,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(
linux_fx_version="Tomcat|9.0-java17", java_version=None
@@ -145,8 +147,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(
linux_fx_version="Tomcat|9.0-java11", java_version=None
@@ -191,8 +194,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(
linux_fx_version="", java_version="17"
@@ -236,8 +240,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(
linux_fx_version="", java_version="11"
@@ -282,8 +287,9 @@ class Test_app_ensure_java_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(
linux_fx_version="php|8.0", java_version=None
@@ -64,8 +64,9 @@ class Test_app_ensure_php_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -99,8 +100,9 @@ class Test_app_ensure_php_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(linux_fx_version="php|8.0"),
client_cert_mode="Ignore",
@@ -143,8 +145,9 @@ class Test_app_ensure_php_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(linux_fx_version="php|8.2"),
client_cert_mode="Ignore",
@@ -63,8 +63,9 @@ class Test_app_ensure_python_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -98,8 +99,9 @@ class Test_app_ensure_python_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(linux_fx_version="python|3.12"),
client_cert_mode="Ignore",
@@ -142,8 +144,9 @@ class Test_app_ensure_python_version_is_latest:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(linux_fx_version="python|3.10"),
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_ensure_using_http20:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_ensure_using_http20:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(http20_enabled=True),
client_cert_mode="Ignore",
@@ -148,8 +150,9 @@ class Test_app_ensure_using_http20:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(http20_enabled=False),
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_ftp_deployment_disabled:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_ftp_deployment_disabled:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(ftps_state="AllAllowed"),
client_cert_mode="Ignore",
@@ -148,8 +150,9 @@ class Test_app_ftp_deployment_disabled:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(ftps_state="Disabled"),
client_cert_mode="Ignore",
@@ -68,6 +68,7 @@ class Test_app_function_access_keys_configured:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -116,6 +117,7 @@ class Test_app_function_access_keys_configured:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -75,6 +75,7 @@ class Test_app_function_application_insights_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -139,6 +140,7 @@ class Test_app_function_application_insights_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -203,6 +205,7 @@ class Test_app_function_application_insights_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -267,6 +270,7 @@ class Test_app_function_application_insights_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -68,6 +68,7 @@ class Test_app_function_ftps_deployment_disabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -114,6 +115,7 @@ class Test_app_function_ftps_deployment_disabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -160,6 +162,7 @@ class Test_app_function_ftps_deployment_disabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -68,6 +68,7 @@ class Test_app_function_identity_is_configured:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -114,6 +115,7 @@ class Test_app_function_identity_is_configured:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -69,6 +69,7 @@ class Test_app_function_identity_without_admin_privileges:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -114,6 +115,7 @@ class Test_app_function_identity_without_admin_privileges:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -190,6 +192,7 @@ class Test_app_function_identity_without_admin_privileges:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -68,6 +68,7 @@ class Test_app_function_latest_runtime_version:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -113,6 +114,7 @@ class Test_app_function_latest_runtime_version:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -68,6 +68,7 @@ class Test_app_function_not_publicly_accessible:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -114,6 +115,7 @@ class Test_app_function_not_publicly_accessible:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -68,6 +68,7 @@ class Test_app_function_vnet_integration_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -113,6 +114,7 @@ class Test_app_function_vnet_integration_enabled:
app_client.functions = {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
location="West Europe",
kind="functionapp,linux",
@@ -63,8 +63,9 @@ class Test_app_http_logs_enabled:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app1": WebApp(
"resource_id": WebApp(
resource_id="resource_id",
name="app1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -107,8 +108,9 @@ class Test_app_http_logs_enabled:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
"resource_id1": WebApp(
resource_id="resource_id1",
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -151,8 +153,9 @@ class Test_app_http_logs_enabled:
),
],
),
"app_id-2": WebApp(
"resource_id2": WebApp(
resource_id="resource_id2",
name="app_id-2",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_minimum_tls_version_12:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_minimum_tls_version_12:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=mock.MagicMock(min_tls_version="1.2"),
client_cert_mode="Ignore",
@@ -148,8 +150,9 @@ class Test_app_minimum_tls_version_12:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=False,
configurations=mock.MagicMock(min_tls_version="1.0"),
client_cert_mode="Ignore",
@@ -190,8 +193,9 @@ class Test_app_minimum_tls_version_12:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=False,
configurations=mock.MagicMock(min_tls_version="1.3"),
client_cert_mode="Ignore",
@@ -64,8 +64,9 @@ class Test_app_register_with_identity:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -106,8 +107,9 @@ class Test_app_register_with_identity:
app_client.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
resource_id: WebApp(
resource_id=resource_id,
name="app_id-1",
auth_enabled=True,
configurations=None,
client_cert_mode="Ignore",
@@ -12,7 +12,7 @@ from tests.providers.azure.azure_fixtures import (
# def mock_app_get_apps(_):
# return {
# AZURE_SUBSCRIPTION_ID: {
# "app_id-1": WebApp(
# "/subscriptions/resource_id": WebApp(
# resource_id="/subscriptions/resource_id",
# configurations=SiteConfigResource(),
# identity=ManagedServiceIdentity(type="SystemAssigned"),
@@ -64,12 +64,15 @@ from tests.providers.azure.azure_fixtures import (
# )
class Test_App_Service:
def test_app_service_(self):
with patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), patch(
"prowler.providers.azure.services.monitor.monitor_service.Monitor",
new=MagicMock(),
with (
patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
patch(
"prowler.providers.azure.services.monitor.monitor_service.Monitor",
new=MagicMock(),
),
):
from prowler.providers.azure.services.app.app_service import WebApp
from prowler.providers.azure.services.monitor.monitor_service import (
@@ -79,8 +82,9 @@ class Test_App_Service:
app_service = MagicMock()
app_service.apps = {
AZURE_SUBSCRIPTION_ID: {
"app_id-1": WebApp(
"/subscriptions/resource_id": WebApp(
resource_id="/subscriptions/resource_id",
name="app_id-1",
configurations=SiteConfigResource(),
identity=ManagedServiceIdentity(type="SystemAssigned"),
auth_enabled=True,
@@ -130,56 +134,68 @@ class Test_App_Service:
# )
assert len(app_service.apps) == 1
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].resource_id
app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].resource_id
== "/subscriptions/resource_id"
)
assert app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].auth_enabled
assert app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].auth_enabled
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].client_cert_mode
app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].client_cert_mode
== "Required"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].location
app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].location
== "West Europe"
)
assert app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].https_only
assert app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].https_only
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].identity.type
app_service.apps[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].identity.type
== "SystemAssigned"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID][
"app_id-1"
"/subscriptions/resource_id"
].configurations.__class__.__name__
== "SiteConfigResource"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"]
app_service.apps[AZURE_SUBSCRIPTION_ID]["/subscriptions/resource_id"]
.monitor_diagnostic_settings[0]
.id
== "id2/id2"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"]
app_service.apps[AZURE_SUBSCRIPTION_ID]["/subscriptions/resource_id"]
.monitor_diagnostic_settings[0]
.logs[0]
.category
== "AppServiceHTTPLogs"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"]
app_service.apps[AZURE_SUBSCRIPTION_ID]["/subscriptions/resource_id"]
.monitor_diagnostic_settings[0]
.storage_account_name
== "storage_account_name2"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"]
app_service.apps[AZURE_SUBSCRIPTION_ID]["/subscriptions/resource_id"]
.monitor_diagnostic_settings[0]
.storage_account_id
== "storage_account_id2"
)
assert (
app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"]
app_service.apps[AZURE_SUBSCRIPTION_ID]["/subscriptions/resource_id"]
.monitor_diagnostic_settings[0]
.name
== "name_diagnostic_setting2"