ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(azure): skip system 'master' DB in sqlserver_tde_encrypted_with_cmk (#11235)

Browse Source 
Co-authored-by: Pedro Martín <pedromarting3@gmail.com>
This commit is contained in:
Prowler Bot
2026-05-19 17:05:35 +02:00
committed by GitHub
parent c0559e7f10
commit 1a4cfd81c5
2 changed files with 204 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/azure/services/sqlserver/sqlserver_tde_encrypted_with_cmk/sqlserver_tde_encrypted_with_cmk.py
+7 -3
View File
@@ -10,9 +10,13 @@ class sqlserver_tde_encrypted_with_cmk(Check):
subscription, subscription
)
for sql_server in sql_servers:
databases = (
sql_server.databases if sql_server.databases is not None else []
)
databases = [
database
for database in (
sql_server.databases if sql_server.databases is not None else []
)
if database.name.lower() != "master"
]
if len(databases) > 0:
report = Check_Report_Azure(
metadata=self.metadata(), resource=sql_server
tests/providers/azure/services/sqlserver/sqlserver_tde_encrypted_with_cmk/sqlserver_tde_encrypted_with_cmk_test.py
+197
View File
@@ -264,3 +264,200 @@ class Test_sqlserver_tde_encrypted_with_cmk:
assert result[0].resource_name == sql_server_name
assert result[0].resource_id == sql_server_id
assert result[0].location == "location"
def test_sql_servers_master_database_disabled_user_database_enabled(self):
# System "master" database always reports TDE Disabled in Azure SQL
# and is not customer-controllable. It must not fail a server whose
# user databases are correctly encrypted with CMK (PROWLER-1760).
sqlserver_client = mock.MagicMock
sqlserver_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
sql_server_name = "SQL Server Name"
sql_server_id = str(uuid4())
master_database = Database(
id="master_id",
name="master",
type="type",
location="location",
managed_by="managed_by",
tde_encryption=TransparentDataEncryption(status="Disabled"),
)
user_database = Database(
id="user_id",
name="DynamicBudgets_Intacct",
type="type",
location="location",
managed_by="managed_by",
tde_encryption=TransparentDataEncryption(status="Enabled"),
)
sqlserver_client.sql_servers = {
AZURE_SUBSCRIPTION_ID: [
Server(
id=sql_server_id,
name=sql_server_name,
location="location",
public_network_access="",
minimal_tls_version="",
administrators=None,
auditing_policies=None,
firewall_rules=None,
databases=[master_database, user_database],
encryption_protector=EncryptionProtector(
server_key_type="AzureKeyVault"
),
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk.sqlserver_client",
new=sqlserver_client,
),
):
from prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk import (
sqlserver_tde_encrypted_with_cmk,
)
check = sqlserver_tde_encrypted_with_cmk()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"SQL Server {sql_server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has TDE enabled with CMK."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == sql_server_name
assert result[0].resource_id == sql_server_id
assert result[0].location == "location"
def test_sql_servers_only_master_database(self):
# A server whose only database is the system "master" has no user
# databases to evaluate, so it must not produce a finding.
sqlserver_client = mock.MagicMock
sqlserver_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
sql_server_name = "SQL Server Name"
sql_server_id = str(uuid4())
master_database = Database(
id="master_id",
name="MASTER",
type="type",
location="location",
managed_by="managed_by",
tde_encryption=TransparentDataEncryption(status="Disabled"),
)
sqlserver_client.sql_servers = {
AZURE_SUBSCRIPTION_ID: [
Server(
id=sql_server_id,
name=sql_server_name,
location="location",
public_network_access="",
minimal_tls_version="",
administrators=None,
auditing_policies=None,
firewall_rules=None,
databases=[master_database],
encryption_protector=EncryptionProtector(
server_key_type="AzureKeyVault"
),
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk.sqlserver_client",
new=sqlserver_client,
),
):
from prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk import (
sqlserver_tde_encrypted_with_cmk,
)
check = sqlserver_tde_encrypted_with_cmk()
result = check.execute()
assert len(result) == 0
def test_sql_servers_master_disabled_user_database_disabled(self):
# Filtering out "master" must not mask a genuinely failing user
# database: a disabled user DB still fails even with CMK.
sqlserver_client = mock.MagicMock
sqlserver_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
sql_server_name = "SQL Server Name"
sql_server_id = str(uuid4())
master_database = Database(
id="master_id",
name="master",
type="type",
location="location",
managed_by="managed_by",
tde_encryption=TransparentDataEncryption(status="Disabled"),
)
user_database = Database(
id="user_id",
name="DynamicBudgets_Intacct",
type="type",
location="location",
managed_by="managed_by",
tde_encryption=TransparentDataEncryption(status="Disabled"),
)
sqlserver_client.sql_servers = {
AZURE_SUBSCRIPTION_ID: [
Server(
id=sql_server_id,
name=sql_server_name,
location="location",
public_network_access="",
minimal_tls_version="",
administrators=None,
auditing_policies=None,
firewall_rules=None,
databases=[master_database, user_database],
encryption_protector=EncryptionProtector(
server_key_type="AzureKeyVault"
),
)
]
}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk.sqlserver_client",
new=sqlserver_client,
),
):
from prowler.providers.azure.services.sqlserver.sqlserver_tde_encrypted_with_cmk.sqlserver_tde_encrypted_with_cmk import (
sqlserver_tde_encrypted_with_cmk,
)
check = sqlserver_tde_encrypted_with_cmk()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"SQL Server {sql_server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has TDE disabled with CMK."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == sql_server_name
assert result[0].resource_id == sql_server_id
assert result[0].location == "location"