feat(azure): locations added to Azure findings (#3596)

prowler/lib/check/models.py

@@ -148,12 +148,14 @@ class Check_Report_Azure(Check_Report):
     resource_name: str
     resource_id: str
     subscription: str
+    location: str
 
     def __init__(self, metadata):
         super().__init__(metadata)
         self.resource_name = ""
         self.resource_id = ""
         self.subscription = ""
+        self.location = "global"
 
 
 @dataclass

prowler/lib/outputs/common.py

@@ -52,8 +52,7 @@ def generate_provider_output(provider, finding, csv_data) -> FindingOutput:
             csv_data["account_name"] = finding.subscription
             csv_data["resource_name"] = finding.resource_name
             csv_data["resource_uid"] = finding.resource_id
-            # TODO: pending to get location from Azure resources (finding.location)
-            csv_data["region"] = ""
+            csv_data["region"] = finding.location
 
         elif provider.type == "gcp":
             csv_data["auth_method"] = f"Principal: {csv_data['auth_method']}"

prowler/providers/azure/services/aks/aks_cluster_rbac_enabled/aks_cluster_rbac_enabled.py

@@ -13,6 +13,7 @@ class aks_cluster_rbac_enabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = cluster.name
                 report.resource_id = cluster_id
+                report.location = cluster.location
                 report.status_extended = f"RBAC is enabled for cluster '{cluster.name}' in subscription '{subscription_name}'."
 
                 if not cluster.rbac_enabled:

prowler/providers/azure/services/aks/aks_clusters_created_with_private_nodes/aks_clusters_created_with_private_nodes.py

@@ -13,6 +13,7 @@ class aks_clusters_created_with_private_nodes(Check):
                 report.subscription = subscription_name
                 report.resource_name = cluster.name
                 report.resource_id = cluster_id
+                report.location = cluster.location
                 report.status_extended = f"Cluster '{cluster.name}' was created with private nodes in subscription '{subscription_name}'"
 
                 for agent_pool in cluster.agent_pool_profiles:

prowler/providers/azure/services/aks/aks_clusters_public_access_disabled/aks_clusters_public_access_disabled.py

@@ -13,6 +13,7 @@ class aks_clusters_public_access_disabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = cluster.name
                 report.resource_id = cluster_id
+                report.location = cluster.location
                 report.status_extended = f"Public access to nodes is enabled for cluster '{cluster.name}' in subscription '{subscription_name}'"
 
                 if cluster.private_fqdn:

prowler/providers/azure/services/aks/aks_network_policy_enabled/aks_network_policy_enabled.py

@@ -13,6 +13,7 @@ class aks_network_policy_enabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = cluster.name
                 report.resource_id = cluster_id
+                report.location = cluster.location
                 report.status_extended = f"Network policy is enabled for cluster '{cluster.name}' in subscription '{subscription_name}'."
 
                 if not getattr(cluster, "network_policy", False):

prowler/providers/azure/services/aks/aks_service.py

@@ -31,6 +31,7 @@ class AKS(AzureService):
                                     name=cluster.name,
                                     public_fqdn=cluster.fqdn,
                                     private_fqdn=cluster.private_fqdn,
+                                    location=cluster.location,
                                     network_policy=(
                                         getattr(
                                             cluster.network_profile,
@@ -63,3 +64,4 @@ class Cluster:
     network_policy: str
     agent_pool_profiles: list[ManagedClusterAgentPoolProfile]
     rbac_enabled: bool
+    location: str

prowler/providers/azure/services/app/app_client_certificates_on/app_client_certificates_on.py

@@ -16,6 +16,7 @@ class app_client_certificates_on(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"Clients are required to present a certificate for app '{app_name}' in subscription '{subscription_name}'."
 
                 if app.client_cert_mode != "Required":

prowler/providers/azure/services/app/app_ensure_auth_is_set_up/app_ensure_auth_is_set_up.py

@@ -16,6 +16,7 @@ class app_ensure_auth_is_set_up(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"Authentication is set up for app '{app_name}' in subscription '{subscription_name}'."
 
                 if not app.auth_enabled:

prowler/providers/azure/services/app/app_ensure_http_is_redirected_to_https/app_ensure_http_is_redirected_to_https.py

@@ -16,6 +16,7 @@ class app_ensure_http_is_redirected_to_https(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"HTTP is redirected to HTTPS for app '{app_name}' in subscription '{subscription_name}'."
 
                 if not app.https_only:

prowler/providers/azure/services/app/app_ensure_java_version_is_latest/app_ensure_java_version_is_latest.py

@@ -22,6 +22,7 @@ class app_ensure_java_version_is_latest(Check):
                     report.subscription = subscription_name
                     report.resource_name = app_name
                     report.resource_id = app.resource_id
+                    report.location = app.location
                     java_latest_version = app_client.audit_config.get(
                         "java_latest_version", "17"
                     )

prowler/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest.py

@@ -21,6 +21,7 @@ class app_ensure_php_version_is_latest(Check):
                     report.subscription = subscription_name
                     report.resource_name = app_name
                     report.resource_id = app.resource_id
+                    report.location = app.location
 
                     php_latest_version = app_client.audit_config.get(
                         "php_latest_version", "8.2"

prowler/providers/azure/services/app/app_ensure_python_version_is_latest/app_ensure_python_version_is_latest.py

@@ -21,6 +21,7 @@ class app_ensure_python_version_is_latest(Check):
                     report.subscription = subscription_name
                     report.resource_name = app_name
                     report.resource_id = app.resource_id
+                    report.location = app.location
                     python_latest_version = app_client.audit_config.get(
                         "python_latest_version", "3.12"
                     )

prowler/providers/azure/services/app/app_ensure_using_http20/app_ensure_using_http20.py

@@ -16,6 +16,7 @@ class app_ensure_using_http20(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"HTTP/2.0 is not enabled for app '{app_name}' in subscription '{subscription_name}'."
 
                 if app.configurations and getattr(

prowler/providers/azure/services/app/app_ftp_deployment_disabled/app_ftp_deployment_disabled.py

@@ -16,6 +16,7 @@ class app_ftp_deployment_disabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"FTP is enabled for app '{app_name}' in subscription '{subscription_name}'."
 
                 if (

prowler/providers/azure/services/app/app_minimum_tls_version_12/app_minimum_tls_version_12.py

@@ -16,6 +16,7 @@ class app_minimum_tls_version_12(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"Minimum TLS version is not set to 1.2 for app '{app_name}' in subscription '{subscription_name}'."
 
                 if (

prowler/providers/azure/services/app/app_register_with_identity/app_register_with_identity.py

@@ -16,6 +16,7 @@ class app_register_with_identity(Check):
                 report.subscription = subscription_name
                 report.resource_name = app_name
                 report.resource_id = app.resource_id
+                report.location = app.location
                 report.status_extended = f"App '{app_name}' in subscription '{subscription_name}' has an identity configured."
 
                 if not app.identity:

prowler/providers/azure/services/app/app_service.py

@@ -56,6 +56,7 @@ class App(AzureService):
                                 ),
                                 https_only=getattr(app, "https_only", False),
                                 identity=getattr(app, "identity", None),
+                                location=app.location,
                                 kind=getattr(app, "kind", "app"),
                             )
                         }
@@ -105,6 +106,7 @@ class WebApp:
     resource_id: str
     configurations: SiteConfigResource
     identity: ManagedServiceIdentity
+    location: str
     client_cert_mode: str = "Ignore"
     auth_enabled: bool = False
     https_only: bool = False

prowler/providers/azure/services/appinsights/appinsights_service.py

@@ -26,7 +26,9 @@ class AppInsights(AzureService):
                     components[subscription_name].update(
                         {
                             component.app_id: Component(
-                                resource_id=component.id, resource_name=component.name
+                                resource_id=component.id,
+                                resource_name=component.name,
+                                location=component.location,
                             )
                         }
                     )
@@ -42,3 +44,4 @@ class AppInsights(AzureService):
 class Component:
     resource_id: str
     resource_name: str
+    location: str

prowler/providers/azure/services/cosmosdb/cosmosdb_account_firewall_use_selected_networks/cosmosdb_account_firewall_use_selected_networks.py

@@ -12,6 +12,7 @@ class cosmosdb_account_firewall_use_selected_networks(Check):
                 report.resource_name = account.name
                 report.resource_id = account.id
                 report.status = "FAIL"
+                report.location = account.location
                 report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has firewall rules that allow access from all networks."
                 if account.is_virtual_network_filter_enabled:
                     report.status = "PASS"

prowler/providers/azure/services/cosmosdb/cosmosdb_account_use_aad_and_rbac/cosmosdb_account_use_aad_and_rbac.py

@@ -12,6 +12,7 @@ class cosmosdb_account_use_aad_and_rbac(Check):
                 report.resource_name = account.name
                 report.resource_id = account.id
                 report.status = "FAIL"
+                report.location = account.location
                 report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} is not using AAD and RBAC"
                 if account.disable_local_auth:
                     report.status = "PASS"

prowler/providers/azure/services/cosmosdb/cosmosdb_account_use_private_endpoints/cosmosdb_account_use_private_endpoints.py

@@ -12,6 +12,7 @@ class cosmosdb_account_use_private_endpoints(Check):
                 report.resource_name = account.name
                 report.resource_id = account.id
                 report.status = "FAIL"
+                report.location = account.location
                 report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} is not using private endpoints connections"
                 if account.private_endpoint_connections:
                     report.status = "PASS"

prowler/providers/azure/services/cosmosdb/cosmosdb_service.py

@@ -46,9 +46,9 @@ class Account:
     id: str
     name: str
     kind: str
-    location: str
     type: str
     tags: dict
     is_virtual_network_filter_enabled: bool
+    location: str
     private_endpoint_connections: list[PrivateEndpointConnection] = None
     disable_local_auth: bool = False

prowler/providers/azure/services/keyvault/keyvault_key_expiration_set_in_non_rbac/keyvault_key_expiration_set_in_non_rbac.py

@@ -13,6 +13,7 @@ class keyvault_key_expiration_set_in_non_rbac(Check):
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
                     report.status = "PASS"
+                    report.location = keyvault.location
                     report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the keys with expiration date set."
                     has_key_without_expiration = False
                     for key in keyvault.keys:

prowler/providers/azure/services/keyvault/keyvault_key_rotation_enabled/keyvault_key_rotation_enabled.py

@@ -12,6 +12,7 @@ class keyvault_key_rotation_enabled(Check):
                     report.subscription = subscription
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
+                    report.location = keyvault.location
                     for key in keyvault.keys:
                         if (
                             key.rotation_policy

prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py

@@ -16,6 +16,7 @@ class keyvault_logging_enabled(Check):
                     report.subscription = subscription_name
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
+                    report.location = keyvault.location
                     report.status_extended = f"There are no diagnostic settings capturing audit logs for Key Vault {keyvault_name} in subscription {subscription_name}."
                     findings.append(report)
                 else:
@@ -24,6 +25,7 @@ class keyvault_logging_enabled(Check):
                         report.subscription = subscription_name
                         report.resource_name = diagnostic_setting.name
                         report.resource_id = diagnostic_setting.id
+                        report.location = keyvault.location
                         report.status = "FAIL"
                         report.status_extended = f"Diagnostic setting {diagnostic_setting.name} for Key Vault {keyvault_name} in subscription {subscription_name} does not have audit logging."
                         audit = False

prowler/providers/azure/services/keyvault/keyvault_non_rbac_secret_expiration_set/keyvault_non_rbac_secret_expiration_set.py

@@ -15,6 +15,7 @@ class keyvault_non_rbac_secret_expiration_set(Check):
                     report.subscription = subscription
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
+                    report.location = keyvault.location
                     report.status = "PASS"
                     report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the secrets with expiration date set."
                     has_secret_without_expiration = False

prowler/providers/azure/services/keyvault/keyvault_private_endpoints/keyvault_private_endpoints.py

@@ -11,6 +11,7 @@ class keyvault_private_endpoints(Check):
                 report.subscription = subscription
                 report.resource_name = keyvault.name
                 report.resource_id = keyvault.id
+                report.location = keyvault.location
                 report.status = "FAIL"
                 report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not using private endpoints."
                 if (

prowler/providers/azure/services/keyvault/keyvault_rbac_enabled/keyvault_rbac_enabled.py

@@ -11,6 +11,7 @@ class keyvault_rbac_enabled(Check):
                 report.subscription = subscription
                 report.resource_name = keyvault.name
                 report.resource_id = keyvault.id
+                report.location = keyvault.location
                 report.status = "FAIL"
                 report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not using RBAC for access control."
                 if (

prowler/providers/azure/services/keyvault/keyvault_rbac_key_expiration_set/keyvault_rbac_key_expiration_set.py

@@ -12,6 +12,7 @@ class keyvault_rbac_key_expiration_set(Check):
                     report.subscription = subscription
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
+                    report.location = keyvault.location
                     report.status = "PASS"
                     report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the keys with expiration date set."
                     has_key_without_expiration = False

prowler/providers/azure/services/keyvault/keyvault_rbac_secret_expiration_set/keyvault_rbac_secret_expiration_set.py

@@ -12,6 +12,7 @@ class keyvault_rbac_secret_expiration_set(Check):
                     report.subscription = subscription
                     report.resource_name = keyvault.name
                     report.resource_id = keyvault.id
+                    report.location = keyvault.location
                     report.status = "PASS"
                     report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the secrets with expiration date set."
                     has_secret_without_expiration = False

prowler/providers/azure/services/keyvault/keyvault_recoverable/keyvault_recoverable.py

@@ -11,6 +11,7 @@ class keyvault_recoverable(Check):
                 report.subscription = subscription
                 report.resource_name = keyvault.name
                 report.resource_id = keyvault.id
+                report.location = keyvault.location
                 report.status = "FAIL"
                 report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not recoverable."
                 if (

prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_cmk_encrypted/monitor_storage_account_with_activity_logs_cmk_encrypted.py

@@ -20,6 +20,7 @@ class monitor_storage_account_with_activity_logs_cmk_encrypted(Check):
                         report.subscription = subscription_name
                         report.resource_name = storage_account.name
                         report.resource_id = storage_account.id
+                        report.location = storage_account.location
                         if storage_account.encryption_type == "Microsoft.Storage":
                             report.status = "FAIL"
                             report.status_extended = f"Storage account {storage_account.name} storing activity log in subscription {subscription_name} is not encrypted with Customer Managed Key."

prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_is_private/monitor_storage_account_with_activity_logs_is_private.py

@@ -20,6 +20,7 @@ class monitor_storage_account_with_activity_logs_is_private(Check):
                         report.subscription = subscription_name
                         report.resource_name = storage_account.name
                         report.resource_id = storage_account.id
+                        report.location = storage_account.location
                         if storage_account.allow_blob_public_access:
                             report.status = "FAIL"
                             report.status_extended = f"Blob public access enabled in storage account {storage_account.name} storing activity logs in subscription {subscription_name}."

prowler/providers/azure/services/mysql/mysql_flexible_server_audit_log_connection_activated/mysql_flexible_server_audit_log_connection_activated.py

@@ -19,6 +19,7 @@ class mysql_flexible_server_audit_log_connection_activated(Check):
                 report.subscription = subscription_name
                 report.resource_name = server_name
                 report.resource_id = server_name
+                report.location = server.location
                 report.status_extended = f"Audit log is disabled for server {server_name} in subscription {subscription_name}."
 
                 if "audit_log_events" in server.configurations:

prowler/providers/azure/services/mysql/mysql_flexible_server_audit_log_enabled/mysql_flexible_server_audit_log_enabled.py

@@ -19,6 +19,7 @@ class mysql_flexible_server_audit_log_enabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = server_name
                 report.resource_id = server_name
+                report.location = server.location
                 report.status_extended = f"Audit log is disabled for server {server_name} in subscription {subscription_name}."
 
                 if "audit_log_enabled" in server.configurations:

prowler/providers/azure/services/mysql/mysql_flexible_server_minimum_tls_version_12/mysql_flexible_server_minimum_tls_version_12.py

@@ -19,6 +19,7 @@ class mysql_flexible_server_minimum_tls_version_12(Check):
                 report.subscription = subscription_name
                 report.resource_name = server_name
                 report.resource_id = server_name
+                report.location = server.location
                 report.status_extended = f"TLS version is not configured in server {server_name} in subscription {subscription_name}."
 
                 if "tls_version" in server.configurations:

prowler/providers/azure/services/mysql/mysql_flexible_server_ssl_connection_enabled/mysql_flexible_server_ssl_connection_enabled.py

@@ -19,6 +19,7 @@ class mysql_flexible_server_ssl_connection_enabled(Check):
                 report.subscription = subscription_name
                 report.resource_name = server_name
                 report.resource_id = server_name
+                report.location = server.location
                 report.status_extended = f"SSL connection is disabled for server {server_name} in subscription {subscription_name}."
 
                 if "require_secure_transport" in server.configurations:

prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py

@@ -11,21 +11,17 @@ class network_bastion_host_exists(Check):
                 status_extended = (
                     f"Bastion Host from subscription {subscription} does not exist"
                 )
-                resource_id = "N/A"
             else:
                 bastion_names = ", ".join(
                     [bastion_host.name for bastion_host in bastion_hosts]
                 )
-                resource_id = ", ".join(
-                    [bastion_host.id for bastion_host in bastion_hosts]
-                )
                 status = "PASS"
                 status_extended = f"Bastion Host from subscription {subscription} available are: {bastion_names}"
 
             report = Check_Report_Azure(self.metadata())
             report.subscription = subscription
             report.resource_name = "Bastion Host"
-            report.resource_id = resource_id
+            report.resource_id = "Bastion Host"
             report.status = status
             report.status_extended = status_extended
             findings.append(report)

prowler/providers/azure/services/network/network_flow_log_captured_sent/network_flow_log_captured_sent.py

@@ -12,6 +12,7 @@ class network_flow_log_captured_sent(Check):
                 report.resource_name = network_watcher.name
                 report.resource_id = network_watcher.id
                 report.status = "FAIL"
+                report.location = network_watcher.location
                 report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} has no flow logs"
                 if network_watcher.flow_logs:
                     report.status = "FAIL"

prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py

@@ -11,6 +11,7 @@ class network_flow_log_more_than_90_days(Check):
                 report.subscription = subscription
                 report.resource_name = network_watcher.name
                 report.resource_id = network_watcher.id
+                report.location = network_watcher.location
                 if network_watcher.flow_logs:
                     report.status = "PASS"
                     report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} has flow logs enabled for more than 90 days"

prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py

@@ -12,6 +12,7 @@ class network_http_internet_access_restricted(Check):
                 report.resource_name = security_group.name
                 report.resource_id = security_group.id
                 report.status = "PASS"
+                report.location = security_group.location
                 report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has HTTP internet access restricted."
                 rule_fail_condition = any(
                     (

prowler/providers/azure/services/network/network_public_ip_shodan/network_public_ip_shodan.py

@@ -17,6 +17,7 @@ class network_public_ip_shodan(Check):
                     report.subscription = subscription
                     report.resource_name = ip.name
                     report.resource_id = ip.id
+                    report.location = ip.location
                     try:
                         shodan_info = api.host(ip.ip_address)
                         report.status = "FAIL"

prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py

@@ -12,6 +12,7 @@ class network_rdp_internet_access_restricted(Check):
                 report.resource_name = security_group.name
                 report.resource_id = security_group.id
                 report.status = "PASS"
+                report.location = security_group.location
                 report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has RDP internet access restricted."
                 rule_fail_condition = any(
                     (

prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py

@@ -12,6 +12,7 @@ class network_ssh_internet_access_restricted(Check):
                 report.resource_name = security_group.name
                 report.resource_id = security_group.id
                 report.status = "PASS"
+                report.location = security_group.location
                 report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has SSH internet access restricted."
                 rule_fail_condition = any(
                     (

prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py

@@ -12,6 +12,7 @@ class network_udp_internet_access_restricted(Check):
                 report.resource_name = security_group.name
                 report.resource_id = security_group.id
                 report.status = "PASS"
+                report.location = security_group.location
                 report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted."
                 rule_fail_condition = any(
                     rule.protocol in ["UDP"]

prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py

@@ -14,6 +14,7 @@ class network_watcher_enabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.resource_name = "Network Watcher"
+                report.location = location
                 report.resource_id = f"/subscriptions/{subscription}/providers/Microsoft.Network/networkWatchers/{location}"
                 if location not in nw_locations:
                     report.status = "FAIL"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_allow_access_services_disabled/postgresql_flexible_server_allow_access_services_disabled.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_allow_access_services_disabled(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has allow public access from any Azure service enabled"
                 if not any(
                     rule.start_ip == "0.0.0.0" and rule.end_ip == "0.0.0.0"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_connection_throttling_on/postgresql_flexible_server_connection_throttling_on.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_connection_throttling_on(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has connection_throttling disabled"
                 if server.connection_throttling == "ON":
                     report.status = "PASS"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_enforce_ssl_enabled/postgresql_flexible_server_enforce_ssl_enabled.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_enforce_ssl_enabled(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has enforce ssl disabled"
                 if server.require_secure_transport == "ON":
                     report.status = "PASS"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_checkpoints_on/postgresql_flexible_server_log_checkpoints_on.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_log_checkpoints_on(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has log_checkpoints disabled"
                 if server.log_checkpoints == "ON":
                     report.status = "PASS"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_connections_on/postgresql_flexible_server_log_connections_on.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_log_connections_on(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has log_connections disabled"
                 if server.log_connections == "ON":
                     report.status = "PASS"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_disconnections_on/postgresql_flexible_server_log_disconnections_on.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_log_disconnections_on(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has log_disconnections disabled"
                 if server.log_disconnections == "ON":
                     report.status = "PASS"

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_retention_days_greater_3/postgresql_flexible_server_log_retention_days_greater_3.py

@@ -17,6 +17,7 @@ class postgresql_flexible_server_log_retention_days_greater_3(Check):
                 report.resource_name = server.name
                 report.resource_id = server.id
                 report.status = "FAIL"
+                report.location = server.location
                 report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has log_retention disabled"
                 if server.log_retention_days:
                     report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription} has log_retention set to {server.log_retention_days}"

prowler/providers/azure/services/postgresql/postgresql_service.py

@@ -42,6 +42,9 @@ class PostgreSQL(AzureService):
                     firewall = self.__get_firewall__(
                         subscription, resource_group, postgresql_server.name
                     )
+                    location = self.__get_location__(
+                        subscription, resource_group, postgresql_server.name
+                    )
                     flexible_servers[subscription].append(
                         Server(
                             id=postgresql_server.id,
@@ -54,6 +57,7 @@ class PostgreSQL(AzureService):
                             connection_throttling=connection_throttling,
                             log_retention_days=log_retention_days,
                             firewall=firewall,
+                            location=location,
                         )
                     )
             except Exception as error:
@@ -96,6 +100,11 @@ class PostgreSQL(AzureService):
         )
         return log_disconnections.value.upper()
 
+    def __get_location__(self, subscription, resouce_group_name, server_name):
+        client = self.clients[subscription]
+        location = client.servers.get(resouce_group_name, server_name).location
+        return location
+
     def __get_connection_throttling__(
         self, subscription, resouce_group_name, server_name
     ):
@@ -152,3 +161,4 @@ class Server:
     connection_throttling: str
     log_retention_days: str
     firewall: list[Firewall]
+    location: str

prowler/providers/azure/services/sqlserver/sqlserver_auditing_enabled/sqlserver_auditing_enabled.py

@@ -13,7 +13,7 @@ class sqlserver_auditing_enabled(Check):
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has a auditing policy configured."
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
-
+                report.location = sql_server.location
                 for auditing_policy in sql_server.auditing_policies:
                     if auditing_policy.state == "Disabled":
                         report.status = "FAIL"

prowler/providers/azure/services/sqlserver/sqlserver_auditing_retention_90_days/sqlserver_auditing_retention_90_days.py

@@ -11,6 +11,7 @@ class sqlserver_auditing_retention_90_days(Check):
                 report.subscription = subscription
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
+                report.location = sql_server.location
                 has_failed = False
                 has_policy = False
                 for policy in sql_server.auditing_policies:

prowler/providers/azure/services/sqlserver/sqlserver_azuread_administrator_enabled/sqlserver_azuread_administrator_enabled.py

@@ -10,6 +10,7 @@ class sqlserver_azuread_administrator_enabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = sql_server.location
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has an Active Directory administrator."
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id

prowler/providers/azure/services/sqlserver/sqlserver_microsoft_defender_enabled/sqlserver_microsoft_defender_enabled.py

@@ -13,6 +13,7 @@ class sqlserver_microsoft_defender_enabled(Check):
                     report.resource_name = sql_server.name
                     report.resource_id = sql_server.id
                     report.status = "FAIL"
+                    report.location = sql_server.location
                     report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has microsoft defender disabled."
                     if sql_server.security_alert_policies.state == "Enabled":
                         report.status = "PASS"

prowler/providers/azure/services/sqlserver/sqlserver_service.py

@@ -48,6 +48,10 @@ class SQLServer(AzureService):
                             subscription, resource_group, sql_server.name
                         )
                     )
+                    location = self.__get_location__(
+                        subscription, resource_group, sql_server.name
+                    )
+
                     sql_servers[subscription].append(
                         Server(
                             id=sql_server.id,
@@ -63,6 +67,7 @@ class SQLServer(AzureService):
                             ),
                             vulnerability_assessment=vulnerability_assessment,
                             security_alert_policies=security_alert_policies,
+                            location=location,
                         )
                     )
             except Exception as error:
@@ -164,6 +169,12 @@ class SQLServer(AzureService):
         )
         return security_alert_policies
 
+    def __get_location__(self, subscription, resouce_group_name, server_name):
+        client = self.clients[subscription]
+        location = client.servers.get(resouce_group_name, server_name).location
+
+        return location
+
 
 @dataclass
 class Database:
@@ -184,6 +195,7 @@ class Server:
     administrators: ServerExternalAdministrator
     auditing_policies: ServerBlobAuditingPolicy
     firewall_rules: FirewallRule
+    location: str
     encryption_protector: EncryptionProtector = None
     databases: list[Database] = None
     vulnerability_assessment: ServerVulnerabilityAssessment = None

prowler/providers/azure/services/sqlserver/sqlserver_tde_encrypted_with_cmk/sqlserver_tde_encrypted_with_cmk.py

@@ -15,6 +15,7 @@ class sqlserver_tde_encrypted_with_cmk(Check):
                     report.subscription = subscription
                     report.resource_name = sql_server.name
                     report.resource_id = sql_server.id
+                    report.location = sql_server.location
                     found_disabled = False
                     if (
                         sql_server.encryption_protector.server_key_type

prowler/providers/azure/services/sqlserver/sqlserver_tde_encryption_enabled/sqlserver_tde_encryption_enabled.py

@@ -16,6 +16,7 @@ class sqlserver_tde_encryption_enabled(Check):
                         report.subscription = subscription
                         report.resource_name = database.name
                         report.resource_id = database.id
+                        report.location = sql_server.location
                         if database.tde_encryption.status == "Enabled":
                             report.status = "PASS"
                             report.status_extended = f"Database {database.name} from SQL Server {sql_server.name} from subscription {subscription} has TDE enabled"

prowler/providers/azure/services/sqlserver/sqlserver_unrestricted_inbound_access/sqlserver_unrestricted_inbound_access.py

@@ -13,7 +13,7 @@ class sqlserver_unrestricted_inbound_access(Check):
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} does not have firewall rules allowing 0.0.0.0-255.255.255.255."
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
-
+                report.location = sql_server.location
                 for firewall_rule in sql_server.firewall_rules:
                     if (
                         firewall_rule.start_ip_address == "0.0.0.0"

prowler/providers/azure/services/sqlserver/sqlserver_va_emails_notifications_admins_enabled/sqlserver_va_emails_notifications_admins_enabled.py

@@ -12,6 +12,7 @@ class sqlserver_va_emails_notifications_admins_enabled(Check):
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
                 report.status = "FAIL"
+                report.location = sql_server.location
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has vulnerability assessment disabled."
                 if (
                     sql_server.vulnerability_assessment

prowler/providers/azure/services/sqlserver/sqlserver_va_periodic_recurring_scans_enabled/sqlserver_va_periodic_recurring_scans_enabled.py

@@ -12,6 +12,7 @@ class sqlserver_va_periodic_recurring_scans_enabled(Check):
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
                 report.status = "FAIL"
+                report.location = sql_server.location
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has vulnerability assessment disabled."
                 if (
                     sql_server.vulnerability_assessment

prowler/providers/azure/services/sqlserver/sqlserver_va_scan_reports_configured/sqlserver_va_scan_reports_configured.py

@@ -12,6 +12,7 @@ class sqlserver_va_scan_reports_configured(Check):
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
                 report.status = "FAIL"
+                report.location = sql_server.location
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has vulnerability assessment disabled."
                 if (
                     sql_server.vulnerability_assessment

prowler/providers/azure/services/sqlserver/sqlserver_vulnerability_assessment_enabled/sqlserver_vulnerability_assessment_enabled.py

@@ -12,6 +12,7 @@ class sqlserver_vulnerability_assessment_enabled(Check):
                 report.resource_name = sql_server.name
                 report.resource_id = sql_server.id
                 report.status = "FAIL"
+                report.location = sql_server.location
                 report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has vulnerability assessment disabled."
                 if (
                     sql_server.vulnerability_assessment

prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py

@@ -10,6 +10,7 @@ class storage_blob_public_access_level_is_disabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "FAIL"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has allow blob public access enabled."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py

@@ -10,6 +10,7 @@ class storage_default_network_access_rule_is_denied(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has network access rule set to Deny."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py

@@ -10,6 +10,7 @@ class storage_ensure_azure_services_are_trusted_to_access_is_enabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} allows trusted Microsoft services to access this storage account."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py

@@ -10,6 +10,7 @@ class storage_ensure_encryption_with_customer_managed_keys(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} encrypts with CMKs."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py

@@ -10,6 +10,7 @@ class storage_ensure_minimum_tls_version_12(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has TLS version set to 1.2."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py

@@ -11,6 +11,7 @@ class storage_ensure_private_endpoints_in_storage_accounts(Check):
                 report.subscription = subscription
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id
+                report.location = storage_account.location
                 if storage_account.private_endpoint_connections:
                     report.status = "PASS"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has private endpoint connections."

prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py

@@ -12,6 +12,7 @@ class storage_ensure_soft_delete_is_enabled(Check):
                     report.subscription = subscription
                     report.resource_name = storage_account.name
                     report.resource_id = storage_account.id
+                    report.location = storage_account.location
                     if getattr(
                         storage_account.blob_properties.container_delete_retention_policy,
                         "enabled",

prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py

@@ -10,6 +10,7 @@ class storage_infrastructure_encryption_is_enabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has infrastructure encryption enabled."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py

@@ -11,6 +11,7 @@ class storage_key_rotation_90_days(Check):
                 report.subscription = subscription
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id
+                report.location = storage_account.location
                 if not storage_account.key_expiration_period_in_days:
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has no key expiration period set."

prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py

@@ -10,6 +10,7 @@ class storage_secure_transfer_required_is_enabled(Check):
                 report = Check_Report_Azure(self.metadata())
                 report.subscription = subscription
                 report.status = "PASS"
+                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required enabled."
                 report.resource_name = storage_account.name
                 report.resource_id = storage_account.id

prowler/providers/azure/services/storage/storage_service.py

@@ -51,6 +51,7 @@ class Storage(AzureService):
                             minimum_tls_version=storage_account.minimum_tls_version,
                             private_endpoint_connections=storage_account.private_endpoint_connections,
                             key_expiration_period_in_days=key_expiration_period_in_days,
+                            location=storage_account.location,
                         )
                     )
             except Exception as error:
@@ -103,4 +104,5 @@ class Account:
     minimum_tls_version: str
     private_endpoint_connections: PrivateEndpointConnection
     key_expiration_period_in_days: str
+    location: str
     blob_properties: BlobProperties = None

prowler/providers/azure/services/vm/vm_ensure_attached_disks_encrypted_with_cmk/vm_ensure_attached_disks_encrypted_with_cmk.py

@@ -14,6 +14,7 @@ class vm_ensure_attached_disks_encrypted_with_cmk(Check):
                     report.subscription = subscription_name
                     report.resource_name = disk.resource_name
                     report.resource_id = disk.resource_id
+                    report.location = disk.location
                     report.status_extended = f"Disk '{disk_id}' is encrypted with a customer-managed key in subscription {subscription_name}."
 
                     if (

prowler/providers/azure/services/vm/vm_ensure_unattached_disks_encrypted_with_cmk/vm_ensure_unattached_disks_encrypted_with_cmk.py

@@ -14,6 +14,7 @@ class vm_ensure_unattached_disks_encrypted_with_cmk(Check):
                     report.subscription = subscription_name
                     report.resource_name = disk.resource_name
                     report.resource_id = disk.resource_id
+                    report.location = disk.location
                     report.status_extended = f"Disk '{disk_id}' is encrypted with a customer-managed key in subscription {subscription_name}."
 
                     if (

prowler/providers/azure/services/vm/vm_ensure_using_managed_disks/vm_ensure_using_managed_disks.py

@@ -13,6 +13,7 @@ class vm_ensure_using_managed_disks(Check):
                 report.subscription = subscription_name
                 report.resource_name = vm.resource_name
                 report.resource_id = vm_id
+                report.location = vm.location
                 report.status_extended = f"VM {vm.resource_name} is using managed disks in subscription {subscription_name}"
 
                 using_managed_disks = (

prowler/providers/azure/services/vm/vm_service.py

@@ -31,6 +31,7 @@ class VirtualMachines(AzureService):
                                 resource_id=vm.id,
                                 resource_name=vm.name,
                                 storage_profile=getattr(vm, "storage_profile", None),
+                                location=vm.location,
                             )
                         }
                     )
@@ -61,6 +62,7 @@ class VirtualMachines(AzureService):
                             disk.unique_id: Disk(
                                 resource_id=disk.id,
                                 resource_name=disk.name,
+                                location=disk.location,
                                 vms_attached=vms_attached,
                                 encryption_type=getattr(
                                     getattr(disk, "encryption", None), "type", None
@@ -81,6 +83,7 @@ class VirtualMachine:
     resource_id: str
     resource_name: str
     storage_profile: StorageProfile
+    location: str
 
 
 @dataclass
@@ -89,3 +92,4 @@ class Disk:
     resource_name: str
     vms_attached: list[str]
     encryption_type: str
+    location: str

tests/providers/azure/services/aks/aks_cluster_rbac_enabled/aks_cluster_rbac_enabled_test.py

@@ -58,6 +58,7 @@ class Test_aks_cluster_rbac_enabled:
                     private_fqdn=None,
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -85,6 +86,7 @@ class Test_aks_cluster_rbac_enabled:
             assert result[0].resource_name == "cluster_name"
             assert result[0].resource_id == cluster_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_rbac_not_enabled(self):
         aks_client = mock.MagicMock
@@ -97,6 +99,7 @@ class Test_aks_cluster_rbac_enabled:
                     private_fqdn=None,
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=False,
                 )
             }
@@ -124,3 +127,4 @@ class Test_aks_cluster_rbac_enabled:
             assert result[0].resource_name == "cluster_name"
             assert result[0].resource_id == cluster_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"

tests/providers/azure/services/aks/aks_clusters_created_with_private_nodes/aks_clusters_created_with_private_nodes_test.py

@@ -58,6 +58,7 @@ class Test_aks_clusters_created_with_private_nodes:
                     private_fqdn="",
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=True)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -85,6 +86,7 @@ class Test_aks_clusters_created_with_private_nodes:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_cluster_private_nodes(self):
         aks_client = mock.MagicMock
@@ -97,6 +99,7 @@ class Test_aks_clusters_created_with_private_nodes:
                     private_fqdn="private_fqdn",
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -124,6 +127,7 @@ class Test_aks_clusters_created_with_private_nodes:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_cluster_public_and_private_nodes(self):
         aks_client = mock.MagicMock
@@ -140,6 +144,7 @@ class Test_aks_clusters_created_with_private_nodes:
                         mock.MagicMock(enable_node_public_ip=True),
                         mock.MagicMock(enable_node_public_ip=False),
                     ],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -167,3 +172,4 @@ class Test_aks_clusters_created_with_private_nodes:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"

tests/providers/azure/services/aks/aks_clusters_public_access_disabled/aks_clusters_public_access_disabled_test.py

@@ -58,6 +58,7 @@ class Test_aks_clusters_public_access_disabled:
                     private_fqdn=None,
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -85,6 +86,7 @@ class Test_aks_clusters_public_access_disabled:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_cluster_private_fqdn(self):
         aks_client = mock.MagicMock
@@ -97,6 +99,7 @@ class Test_aks_clusters_public_access_disabled:
                     private_fqdn="private_fqdn",
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -124,6 +127,7 @@ class Test_aks_clusters_public_access_disabled:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_cluster_private_fqdn_with_public_ip(self):
         aks_client = mock.MagicMock
@@ -136,6 +140,7 @@ class Test_aks_clusters_public_access_disabled:
                     private_fqdn="private_fqdn",
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=True)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -163,3 +168,4 @@ class Test_aks_clusters_public_access_disabled:
             assert result[0].resource_id == cluster_id
             assert result[0].resource_name == "cluster_name"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"

tests/providers/azure/services/aks/aks_network_policy_enabled/aks_network_policy_enabled_test.py

@@ -58,6 +58,7 @@ class Test_aks_network_policy_enabled:
                     private_fqdn=None,
                     network_policy="network_policy",
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -85,6 +86,7 @@ class Test_aks_network_policy_enabled:
             assert result[0].resource_name == "cluster_name"
             assert result[0].resource_id == cluster_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"
 
     def test_aks_network_policy_disabled(self):
         aks_client = mock.MagicMock
@@ -97,6 +99,7 @@ class Test_aks_network_policy_enabled:
                     private_fqdn=None,
                     network_policy=None,
                     agent_pool_profiles=[mock.MagicMock(enable_node_public_ip=False)],
+                    location="westeurope",
                     rbac_enabled=True,
                 )
             }
@@ -124,3 +127,4 @@ class Test_aks_network_policy_enabled:
             assert result[0].resource_name == "cluster_name"
             assert result[0].resource_id == cluster_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "westeurope"

tests/providers/azure/services/aks/aks_service_test.py

@@ -16,6 +16,7 @@ def mock_aks_get_clusters(_):
                 private_fqdn="private_fqdn",
                 network_policy="network_policy",
                 agent_pool_profiles=[],
+                location="westeurope",
                 rbac_enabled=True,
             )
         }
@@ -60,4 +61,7 @@ class Test_AppInsights_Service:
             aks.clusters[AZURE_SUBSCRIPTION_ID]["cluster_id-1"].agent_pool_profiles
             == []
         )
+        assert (
+            aks.clusters[AZURE_SUBSCRIPTION_ID]["cluster_id-1"].location == "westeurope"
+        )
         assert aks.clusters[AZURE_SUBSCRIPTION_ID]["cluster_id-1"].rbac_enabled

tests/providers/azure/services/app/app_client_certificates_on/app_client_certificates_on_test.py

@@ -71,6 +71,7 @@ class Test_app_client_certificates_on:
                         client_cert_mode="Required",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_client_certificates_on:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_client_certificates_off(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_client_certificates_on:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,3 +128,4 @@ class Test_app_client_certificates_on:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ensure_auth_is_set_up/app_ensure_auth_is_set_up_test.py

@@ -71,6 +71,7 @@ class Test_app_ensure_auth_is_set_up:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_ensure_auth_is_set_up:
             assert result[0].resource_name == "app_id-1"
             assert result[0].resource_id == resource_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_auth_disabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_ensure_auth_is_set_up:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,3 +128,4 @@ class Test_app_ensure_auth_is_set_up:
             assert result[0].resource_name == "app_id-1"
             assert result[0].resource_id == resource_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ensure_http_is_redirected_to_https/app_ensure_http_is_redirected_to_https_test.py

@@ -71,6 +71,7 @@ class Test_app_ensure_http_is_redirected_to_https:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_ensure_http_is_redirected_to_https:
             assert result[0].resource_name == "app_id-1"
             assert result[0].resource_id == resource_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_http_to_https_enabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_ensure_http_is_redirected_to_https:
                         client_cert_mode="Ignore",
                         https_only=True,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,3 +128,4 @@ class Test_app_ensure_http_is_redirected_to_https:
             assert result[0].resource_name == "app_id-1"
             assert result[0].resource_id == resource_id
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ensure_java_version_is_latest/app_ensure_java_version_is_latest_test.py

@@ -71,6 +71,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -107,6 +108,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -121,6 +123,7 @@ class Test_app_ensure_java_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_linux_java_version_not_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -151,6 +154,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -165,6 +169,7 @@ class Test_app_ensure_java_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_windows_java_version_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -195,6 +200,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -209,11 +215,11 @@ class Test_app_ensure_java_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_windows_java_version_not_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
         app_client = mock.MagicMock
-
         app_client.audit_config = {"java_latest_version": "17"}
 
         with mock.patch(
@@ -239,6 +245,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -253,6 +260,7 @@ class Test_app_ensure_java_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_linux_php_version_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -283,6 +291,7 @@ class Test_app_ensure_java_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }

tests/providers/azure/services/app/app_ensure_php_version_is_latest/app_ensure_php_version_is_latest_test.py

@@ -71,6 +71,7 @@ class Test_app_ensure_php_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -105,6 +106,7 @@ class Test_app_ensure_php_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -119,6 +121,7 @@ class Test_app_ensure_php_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_php_version_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -147,6 +150,7 @@ class Test_app_ensure_php_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -161,3 +165,4 @@ class Test_app_ensure_php_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ensure_python_version_is_latest/app_ensure_python_version_is_latest_test.py

@@ -49,7 +49,6 @@ class Test_app_ensure_python_version_is_latest:
     def test_app_configurations_none(self):
         resource_id = f"/subscriptions/{uuid4()}"
         app_client = mock.MagicMock
-
         with mock.patch(
             "prowler.providers.common.common.get_global_provider",
             return_value=set_mocked_azure_provider(),
@@ -71,6 +70,7 @@ class Test_app_ensure_python_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -105,6 +105,7 @@ class Test_app_ensure_python_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -119,6 +120,7 @@ class Test_app_ensure_python_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_python_version_not_latest(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -147,6 +149,7 @@ class Test_app_ensure_python_version_is_latest:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -161,3 +164,4 @@ class Test_app_ensure_python_version_is_latest:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ensure_using_http20/app_ensure_using_http20_test.py

@@ -71,6 +71,7 @@ class Test_app_ensure_using_http20:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_ensure_using_http20:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_http20_enabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_ensure_using_http20:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,6 +128,7 @@ class Test_app_ensure_using_http20:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_http20_not_enabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -151,6 +155,7 @@ class Test_app_ensure_using_http20:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -165,3 +170,4 @@ class Test_app_ensure_using_http20:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_ftp_deployment_disabled/app_ftp_deployment_disabled_test.py

@@ -71,6 +71,7 @@ class Test_app_ftp_deployment_disabled:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_ftp_deployment_disabled:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_ftp_deployment_disabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_ftp_deployment_disabled:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,6 +128,7 @@ class Test_app_ftp_deployment_disabled:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_ftp_deploy_enabled(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -151,6 +155,7 @@ class Test_app_ftp_deployment_disabled:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -165,3 +170,4 @@ class Test_app_ftp_deployment_disabled:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_http_logs_enabled/app_http_logs_enabled_test.py

@@ -71,6 +71,7 @@ class Test_app_http_logs_enabled:
                         https_only=False,
                         identity=None,
                         kind="webapps",
+                        location="West Europe",
                     )
                 }
             }
@@ -114,6 +115,7 @@ class Test_app_http_logs_enabled:
                         https_only=False,
                         kind="functionapp",
                         identity=mock.MagicMock,
+                        location="West Europe",
                         monitor_diagnostic_settings=[
                             DiagnosticSetting(
                                 id="id1/id1",
@@ -157,6 +159,7 @@ class Test_app_http_logs_enabled:
                         https_only=False,
                         kind="WebApp",
                         identity=mock.MagicMock,
+                        location="West Europe",
                         monitor_diagnostic_settings=[
                             DiagnosticSetting(
                                 id="id2/id2",

tests/providers/azure/services/app/app_minimum_tls_version_12/app_minimum_tls_version_12_test.py

@@ -71,6 +71,7 @@ class Test_app_minimum_tls_version_12:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_minimum_tls_version_12:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_min_tls_version_12(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_minimum_tls_version_12:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,6 +128,7 @@ class Test_app_minimum_tls_version_12:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_min_tls_version_10(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -151,6 +155,7 @@ class Test_app_minimum_tls_version_12:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -165,3 +170,4 @@ class Test_app_minimum_tls_version_12:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_register_with_identity/app_register_with_identity_test.py

@@ -71,6 +71,7 @@ class Test_app_register_with_identity:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=None,
+                        location="West Europe",
                     )
                 }
             }
@@ -85,6 +86,7 @@ class Test_app_register_with_identity:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"
 
     def test_app_identity(self):
         resource_id = f"/subscriptions/{uuid4()}"
@@ -111,6 +113,7 @@ class Test_app_register_with_identity:
                         client_cert_mode="Ignore",
                         https_only=False,
                         identity=mock.MagicMock,
+                        location="West Europe",
                     )
                 }
             }
@@ -125,3 +128,4 @@ class Test_app_register_with_identity:
             assert result[0].resource_id == resource_id
             assert result[0].resource_name == "app_id-1"
             assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "West Europe"

tests/providers/azure/services/app/app_service_test.py

@@ -86,6 +86,7 @@ class Test_App_Service:
                         auth_enabled=True,
                         client_cert_mode="Required",
                         https_only=True,
+                        location="West Europe",
                         monitor_diagnostic_settings=[
                             DiagnosticSetting(
                                 id="id2/id2",
@@ -137,6 +138,10 @@ class Test_App_Service:
             app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].client_cert_mode
             == "Required"
         )
+        assert (
+            app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].location
+            == "West Europe"
+        )
         assert app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].https_only
         assert (
             app_service.apps[AZURE_SUBSCRIPTION_ID]["app_id-1"].identity.type

tests/providers/azure/services/appinsights/appinsights_ensure_is_configured/appinsights_ensure_is_configured_test.py

@@ -49,6 +49,7 @@ class Test_appinsights_ensure_is_configured:
             assert result[0].status == "FAIL"
             assert result[0].resource_id == "AppInsights"
             assert result[0].resource_name == "AppInsights"
+            assert result[0].location == "global"
             assert (
                 result[0].status_extended
                 == f"There are no AppInsight configured in susbscription {AZURE_SUBSCRIPTION_ID}."
@@ -61,6 +62,7 @@ class Test_appinsights_ensure_is_configured:
                 "app_id-1": Component(
                     resource_id="/subscriptions/resource_id",
                     resource_name="AppInsightsTest",
+                    location="westeurope",
                 )
             }
         }
@@ -83,6 +85,7 @@ class Test_appinsights_ensure_is_configured:
             assert result[0].status == "PASS"
             assert result[0].resource_id == "AppInsights"
             assert result[0].resource_name == "AppInsights"
+            assert result[0].location == "global"
             assert (
                 result[0].status_extended
                 == f"There is at least one AppInsight configured in susbscription {AZURE_SUBSCRIPTION_ID}."