mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
feat(entra): New 11 checks related with Microsoft Entra ID (#3585)
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
170d555ab4
commit
2d58d1bdc7
+130
@@ -0,0 +1,130 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_default_users_cannot_create_security_groups:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups import (
|
||||
entra_policy_default_users_cannot_create_security_groups,
|
||||
)
|
||||
|
||||
check = entra_policy_default_users_cannot_create_security_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups import (
|
||||
entra_policy_default_users_cannot_create_security_groups,
|
||||
)
|
||||
|
||||
check = entra_policy_default_users_cannot_create_security_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Non-privileged users are able to create security groups via the Access Panel and the Azure administration portal."
|
||||
)
|
||||
|
||||
def test_entra_default_user_role_permissions_allowed_to_create_security_groups(
|
||||
self,
|
||||
):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups import (
|
||||
entra_policy_default_users_cannot_create_security_groups,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_security_groups=True
|
||||
),
|
||||
guest_invite_settings="everyone",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_default_users_cannot_create_security_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Non-privileged users are able to create security groups via the Access Panel and the Azure administration portal."
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
def test_entra_default_user_role_permissions_not_allowed_to_create_security_groups(
|
||||
self,
|
||||
):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_default_users_cannot_create_security_groups.entra_policy_default_users_cannot_create_security_groups import (
|
||||
entra_policy_default_users_cannot_create_security_groups,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_security_groups=False
|
||||
),
|
||||
guest_invite_settings="everyone",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_default_users_cannot_create_security_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Non-privileged users are not able to create security groups via the Access Panel and the Azure administration portal."
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
+79
-41
@@ -1,39 +1,12 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.entra.entra_service import AuthorizationPolicy
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_ensure_default_user_cannot_create_apps:
|
||||
def test_entra_no_authorization_policy(self):
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
|
||||
entra_policy_ensure_default_user_cannot_create_tenants,
|
||||
)
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_tenants()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_default_user_role_permissions_not_allowed_to_create_apps(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {
|
||||
"test.com": AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_apps=False
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps.entra_client",
|
||||
@@ -43,6 +16,65 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
|
||||
entra_policy_ensure_default_user_cannot_create_apps,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps import (
|
||||
entra_policy_ensure_default_user_cannot_create_apps,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "App creation is not disabled for non-admin users."
|
||||
)
|
||||
|
||||
def test_entra_default_user_role_permissions_not_allowed_to_create_apps(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps import (
|
||||
entra_policy_ensure_default_user_cannot_create_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_apps=False
|
||||
),
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
@@ -53,21 +85,11 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == "All from tenant 'test.com'"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
def test_entra_default_user_role_permissions_allowed_to_create_apps(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {
|
||||
"test.com": AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_apps=True
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps.entra_client",
|
||||
@@ -76,6 +98,22 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_apps.entra_policy_ensure_default_user_cannot_create_apps import (
|
||||
entra_policy_ensure_default_user_cannot_create_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_apps=True
|
||||
),
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_apps()
|
||||
result = check.execute()
|
||||
@@ -87,4 +125,4 @@ class Test_entra_policy_ensure_default_user_cannot_create_apps:
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == "All from tenant 'test.com'"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
+85
-49
@@ -1,11 +1,11 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.entra.entra_service import AuthorizationPolicy
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_ensure_default_user_cannot_create_tenants:
|
||||
def test_entra_no_authorization_policy(self):
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
@@ -21,53 +21,9 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self):
|
||||
id = str(uuid4())
|
||||
def test_entra_empty_tenant(self):
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {
|
||||
"test.omnimicrosoft.com": AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_tenants=False
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
|
||||
entra_policy_ensure_default_user_cannot_create_tenants,
|
||||
)
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_tenants()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Tenants creation is disabled for non-admin users."
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == "All from tenant 'test.omnimicrosoft.com'"
|
||||
|
||||
def test_entra_default_user_role_permissions_allowed_to_create_tenants(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.authorization_policy = {
|
||||
"test.omnimicrosoft.com": AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_tenants=True
|
||||
),
|
||||
)
|
||||
}
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
|
||||
@@ -77,6 +33,86 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
|
||||
entra_policy_ensure_default_user_cannot_create_tenants,
|
||||
)
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_tenants()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Tenants creation is not disabled for non-admin users."
|
||||
)
|
||||
|
||||
def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
|
||||
entra_policy_ensure_default_user_cannot_create_tenants,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_tenants=False
|
||||
),
|
||||
guest_invite_settings="everyone",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_tenants()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Tenants creation is disabled for non-admin users."
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
def test_entra_default_user_role_permissions_allowed_to_create_tenants(self):
|
||||
id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import (
|
||||
entra_policy_ensure_default_user_cannot_create_tenants,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Test",
|
||||
description="Test",
|
||||
default_user_role_permissions=mock.MagicMock(
|
||||
allowed_to_create_tenants=True
|
||||
),
|
||||
guest_invite_settings="everyone",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_ensure_default_user_cannot_create_tenants()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
@@ -87,4 +123,4 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants:
|
||||
)
|
||||
assert result[0].resource_name == "Test"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == "All from tenant 'test.omnimicrosoft.com'"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
+159
@@ -0,0 +1,159 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_guest_invite_only_for_admin_roles:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles import (
|
||||
entra_policy_guest_invite_only_for_admin_roles,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
check = entra_policy_guest_invite_only_for_admin_roles()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_empty_tenant(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles import (
|
||||
entra_policy_guest_invite_only_for_admin_roles,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
check = entra_policy_guest_invite_only_for_admin_roles()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Guest invitations are not restricted to users with specific administrative roles only."
|
||||
)
|
||||
|
||||
def test_entra_tenant_policy_allow_invites_from_everyone(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles import (
|
||||
entra_policy_guest_invite_only_for_admin_roles,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="TestPolicy",
|
||||
description="TestPolicyDescription",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings="everyone",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_invite_only_for_admin_roles()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
"Guest invitations are not restricted to users with specific administrative roles only."
|
||||
)
|
||||
assert result[0].resource_name == "TestPolicy"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
def test_entra_tenant_policy_allow_invites_from_admins(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles import (
|
||||
entra_policy_guest_invite_only_for_admin_roles,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="TestPolicy",
|
||||
description="TestPolicyDescription",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings="adminsAndGuestInviters",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_invite_only_for_admin_roles()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
"Guest invitations are restricted to users with specific administrative roles only."
|
||||
)
|
||||
assert result[0].resource_name == "TestPolicy"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
|
||||
def test_entra_tenant_policy_allow_invites_from_none(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_invite_only_for_admin_roles.entra_policy_guest_invite_only_for_admin_roles import (
|
||||
entra_policy_guest_invite_only_for_admin_roles,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="TestPolicy",
|
||||
description="TestPolicyDescription",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_invite_only_for_admin_roles()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
"Guest invitations are restricted to users with specific administrative roles only."
|
||||
)
|
||||
assert result[0].resource_name == "TestPolicy"
|
||||
assert result[0].resource_id == id
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
+162
@@ -0,0 +1,162 @@
|
||||
from unittest import mock
|
||||
from uuid import UUID, uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_guest_users_access_restrictions:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions import (
|
||||
entra_policy_guest_users_access_restrictions,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
check = entra_policy_guest_users_access_restrictions()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions import (
|
||||
entra_policy_guest_users_access_restrictions,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
check = entra_policy_guest_users_access_restrictions()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Guest user access is not restricted to properties and memberships of their own directory objects"
|
||||
)
|
||||
|
||||
def test_entra_tenant_policy_access_same_as_member(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions import (
|
||||
entra_policy_guest_users_access_restrictions,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Authorization Policy",
|
||||
description="",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings=None,
|
||||
guest_user_role_id=UUID("a0b1b346-4d3e-4e8b-98f8-753987be4970"),
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_users_access_restrictions()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Guest user access is not restricted to properties and memberships of their own directory objects"
|
||||
)
|
||||
|
||||
def test_entra_tenant_policy_limited_access(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions import (
|
||||
entra_policy_guest_users_access_restrictions,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Authorization Policy",
|
||||
description="",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings=None,
|
||||
guest_user_role_id=UUID("10dae51f-b6af-4016-8d66-8c2a99b929b3"),
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_users_access_restrictions()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Guest user access is not restricted to properties and memberships of their own directory objects"
|
||||
)
|
||||
|
||||
def test_entra_tenant_policy_access_restricted(self):
|
||||
entra_client = mock.MagicMock
|
||||
id = str(uuid4())
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_guest_users_access_restrictions.entra_policy_guest_users_access_restrictions import (
|
||||
entra_policy_guest_users_access_restrictions,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id=id,
|
||||
name="Authorization Policy",
|
||||
description="",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings=None,
|
||||
guest_user_role_id=UUID("2af84b1e-32c8-42b7-82bc-daa82404023b"),
|
||||
)
|
||||
}
|
||||
|
||||
check = entra_policy_guest_users_access_restrictions()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Guest user access is restricted to properties and memberships of their own directory objects"
|
||||
)
|
||||
+167
@@ -0,0 +1,167 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_restricts_user_consent_for_apps:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps import (
|
||||
entra_policy_restricts_user_consent_for_apps,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
check = entra_policy_restricts_user_consent_for_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps import (
|
||||
entra_policy_restricts_user_consent_for_apps,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: {}}
|
||||
|
||||
check = entra_policy_restricts_user_consent_for_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == "authorizationPolicy"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra allows users to consent apps accessing company data on their behalf"
|
||||
)
|
||||
|
||||
def test_entra_tenant_no_default_user_role_permissions(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps import (
|
||||
entra_policy_restricts_user_consent_for_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
auth_policy = AuthorizationPolicy(
|
||||
id=uuid4(),
|
||||
name="Authorization Policy",
|
||||
description="Authorization Policy Description",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: auth_policy}
|
||||
|
||||
check = entra_policy_restricts_user_consent_for_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == auth_policy.id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra allows users to consent apps accessing company data on their behalf"
|
||||
)
|
||||
|
||||
def test_entra_tenant_no_consent(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps import (
|
||||
entra_policy_restricts_user_consent_for_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
def_user_role_permissions = mock.MagicMock
|
||||
def_user_role_permissions.permission_grant_policies_assigned = []
|
||||
|
||||
auth_policy = AuthorizationPolicy(
|
||||
id=uuid4(),
|
||||
name="Authorization Policy",
|
||||
description="Authorization Policy Description",
|
||||
default_user_role_permissions=def_user_role_permissions,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: auth_policy}
|
||||
|
||||
check = entra_policy_restricts_user_consent_for_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == auth_policy.id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra does not allow users to consent apps accessing company data on their behalf"
|
||||
)
|
||||
|
||||
def test_entra_tenant_legacy_consent(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_restricts_user_consent_for_apps.entra_policy_restricts_user_consent_for_apps import (
|
||||
entra_policy_restricts_user_consent_for_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
def_user_role_permissions = mock.MagicMock
|
||||
def_user_role_permissions.permission_grant_policies_assigned = [
|
||||
"ManagePermissionGrantsForSelf.microsoft-user-default-legacy"
|
||||
]
|
||||
|
||||
auth_policy = AuthorizationPolicy(
|
||||
id=uuid4(),
|
||||
name="Authorization Policy",
|
||||
description="Authorization Policy Description",
|
||||
default_user_role_permissions=def_user_role_permissions,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: auth_policy}
|
||||
|
||||
check = entra_policy_restricts_user_consent_for_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == auth_policy.id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra allows users to consent apps accessing company data on their behalf"
|
||||
)
|
||||
+105
@@ -0,0 +1,105 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_policy_user_consent_for_verified_apps:
|
||||
def test_entra_no_subscriptions(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps import (
|
||||
entra_policy_user_consent_for_verified_apps,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {}
|
||||
|
||||
check = entra_policy_user_consent_for_verified_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_no_consent(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps import (
|
||||
entra_policy_user_consent_for_verified_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
def_user_role_permissions = mock.MagicMock
|
||||
def_user_role_permissions.permission_grant_policies_assigned = []
|
||||
|
||||
auth_policy = AuthorizationPolicy(
|
||||
id=uuid4(),
|
||||
name="Authorization Policy",
|
||||
description="Authorization Policy Description",
|
||||
default_user_role_permissions=def_user_role_permissions,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: auth_policy}
|
||||
|
||||
check = entra_policy_user_consent_for_verified_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == auth_policy.id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra does not allow users to consent non-verified apps accessing company data on their behalf."
|
||||
)
|
||||
|
||||
def test_entra_tenant_legacy_consent(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_policy_user_consent_for_verified_apps.entra_policy_user_consent_for_verified_apps import (
|
||||
entra_policy_user_consent_for_verified_apps,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
)
|
||||
|
||||
def_user_role_permissions = mock.MagicMock
|
||||
def_user_role_permissions.permission_grant_policies_assigned = [
|
||||
"ManagePermissionGrantsForSelf.microsoft-user-default-legacy"
|
||||
]
|
||||
|
||||
auth_policy = AuthorizationPolicy(
|
||||
id=uuid4(),
|
||||
name="Authorization Policy",
|
||||
description="Authorization Policy Description",
|
||||
default_user_role_permissions=def_user_role_permissions,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
|
||||
entra_client.authorization_policy = {DOMAIN: auth_policy}
|
||||
|
||||
check = entra_policy_user_consent_for_verified_apps()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Authorization Policy"
|
||||
assert result[0].resource_id == auth_policy.id
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Entra allows users to consent apps accessing company data on their behalf."
|
||||
)
|
||||
+103
@@ -0,0 +1,103 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_security_defaults_enabled:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
|
||||
entra_security_defaults_enabled,
|
||||
)
|
||||
|
||||
entra_client.security_default = {}
|
||||
|
||||
check = entra_security_defaults_enabled()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
|
||||
entra_security_defaults_enabled,
|
||||
)
|
||||
|
||||
entra_client.security_default = {DOMAIN: {}}
|
||||
|
||||
check = entra_security_defaults_enabled()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == "Entra security defaults is diabled."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Security Default"
|
||||
assert result[0].resource_id == "Security Default"
|
||||
|
||||
def test_entra_security_default_enabled(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
|
||||
entra_security_defaults_enabled,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
SecurityDefault,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
|
||||
entra_client.security_default = {
|
||||
DOMAIN: SecurityDefault(id=id, name="Sec Default", is_enabled=True)
|
||||
}
|
||||
|
||||
check = entra_security_defaults_enabled()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == "Entra security defaults is enabled."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Sec Default"
|
||||
assert result[0].resource_id == id
|
||||
|
||||
def test_entra_security_default_disabled(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
|
||||
entra_security_defaults_enabled,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
SecurityDefault,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
|
||||
entra_client.security_default = {
|
||||
DOMAIN: SecurityDefault(id=id, name="Sec Default", is_enabled=False)
|
||||
}
|
||||
|
||||
check = entra_security_defaults_enabled()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == "Entra security defaults is diabled."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Sec Default"
|
||||
assert result[0].resource_id == id
|
||||
@@ -2,7 +2,11 @@ from unittest.mock import patch
|
||||
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
AuthorizationPolicy,
|
||||
DirectoryRole,
|
||||
Entra,
|
||||
GroupSetting,
|
||||
NamedLocation,
|
||||
SecurityDefault,
|
||||
User,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_audit_info
|
||||
@@ -10,17 +14,68 @@ from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_audit_
|
||||
|
||||
async def mock_entra_get_users(_):
|
||||
return {
|
||||
"user-1@tenant1.es": User(id="id-1", name="User 1"),
|
||||
DOMAIN: {
|
||||
"user-1@tenant1.es": User(id="id-1", name="User 1"),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
async def mock_entra_get_authorization_policy(_):
|
||||
return AuthorizationPolicy(
|
||||
id="id-1",
|
||||
name="Name 1",
|
||||
description="Description 1",
|
||||
default_user_role_permissions=None,
|
||||
)
|
||||
return {
|
||||
DOMAIN: AuthorizationPolicy(
|
||||
id="id-1",
|
||||
name="Name 1",
|
||||
description="Description 1",
|
||||
default_user_role_permissions=None,
|
||||
guest_invite_settings="none",
|
||||
guest_user_role_id=None,
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
async def mock_entra_get_group_settings(_):
|
||||
return {
|
||||
DOMAIN: {
|
||||
"id-1": GroupSetting(
|
||||
name="Test",
|
||||
template_id="id-group-setting",
|
||||
settings=[],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
async def mock_entra_get_security_default(_):
|
||||
return {
|
||||
DOMAIN: SecurityDefault(
|
||||
id="id-security-default",
|
||||
name="Test",
|
||||
is_enabled=True,
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
async def mock_entra_get_named_locations(_):
|
||||
return {
|
||||
DOMAIN: {
|
||||
"id-1": NamedLocation(
|
||||
name="Test",
|
||||
ip_ranges_addresses=[],
|
||||
is_trusted=False,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
async def mock_entra_get_directory_roles(_):
|
||||
return {
|
||||
DOMAIN: {
|
||||
"GlobalAdministrator": DirectoryRole(
|
||||
id="id-directory-role",
|
||||
members=[],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@patch(
|
||||
@@ -31,6 +86,22 @@ async def mock_entra_get_authorization_policy(_):
|
||||
"prowler.providers.azure.services.entra.entra_service.Entra.__get_authorization_policy__",
|
||||
new=mock_entra_get_authorization_policy,
|
||||
)
|
||||
@patch(
|
||||
"prowler.providers.azure.services.entra.entra_service.Entra.__get_group_settings__",
|
||||
new=mock_entra_get_group_settings,
|
||||
)
|
||||
@patch(
|
||||
"prowler.providers.azure.services.entra.entra_service.Entra.__get_security_default__",
|
||||
new=mock_entra_get_security_default,
|
||||
)
|
||||
@patch(
|
||||
"prowler.providers.azure.services.entra.entra_service.Entra.__get_named_locations__",
|
||||
new=mock_entra_get_named_locations,
|
||||
)
|
||||
@patch(
|
||||
"prowler.providers.azure.services.entra.entra_service.Entra.__get_directory_roles__",
|
||||
new=mock_entra_get_directory_roles,
|
||||
)
|
||||
class Test_Entra_Service:
|
||||
def test__get_client__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
@@ -43,12 +114,48 @@ class Test_Entra_Service:
|
||||
def test__get_users__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert len(entra_client.users) == 1
|
||||
assert entra_client.users["user-1@tenant1.es"].id == "id-1"
|
||||
assert entra_client.users["user-1@tenant1.es"].name == "User 1"
|
||||
assert entra_client.users[DOMAIN]["user-1@tenant1.es"].id == "id-1"
|
||||
assert entra_client.users[DOMAIN]["user-1@tenant1.es"].name == "User 1"
|
||||
|
||||
def test__get_authorization_policy__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert entra_client.authorization_policy.id == "id-1"
|
||||
assert entra_client.authorization_policy.name == "Name 1"
|
||||
assert entra_client.authorization_policy.description == "Description 1"
|
||||
assert not entra_client.authorization_policy.default_user_role_permissions
|
||||
assert entra_client.authorization_policy[DOMAIN].id == "id-1"
|
||||
assert entra_client.authorization_policy[DOMAIN].name == "Name 1"
|
||||
assert entra_client.authorization_policy[DOMAIN].description == "Description 1"
|
||||
assert not entra_client.authorization_policy[
|
||||
DOMAIN
|
||||
].default_user_role_permissions
|
||||
|
||||
def test__get_group_settings__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert entra_client.group_settings[DOMAIN]["id-1"].name == "Test"
|
||||
assert (
|
||||
entra_client.group_settings[DOMAIN]["id-1"].template_id
|
||||
== "id-group-setting"
|
||||
)
|
||||
assert len(entra_client.group_settings[DOMAIN]["id-1"].settings) == 0
|
||||
|
||||
def test__get_security_default__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert entra_client.security_default[DOMAIN].id == "id-security-default"
|
||||
assert entra_client.security_default[DOMAIN].name == "Test"
|
||||
assert entra_client.security_default[DOMAIN].is_enabled
|
||||
|
||||
def test__get_named_locations__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert entra_client.named_locations[DOMAIN]["id-1"].name == "Test"
|
||||
assert (
|
||||
len(entra_client.named_locations[DOMAIN]["id-1"].ip_ranges_addresses) == 0
|
||||
)
|
||||
assert not entra_client.named_locations[DOMAIN]["id-1"].is_trusted
|
||||
|
||||
def test__get_directory_roles__(self):
|
||||
entra_client = Entra(set_mocked_azure_audit_info())
|
||||
assert (
|
||||
entra_client.directory_roles[DOMAIN]["GlobalAdministrator"].id
|
||||
== "id-directory-role"
|
||||
)
|
||||
assert (
|
||||
len(entra_client.directory_roles[DOMAIN]["GlobalAdministrator"].members)
|
||||
== 0
|
||||
)
|
||||
|
||||
+153
@@ -0,0 +1,153 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_trusted_named_locations_exists:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists import (
|
||||
entra_trusted_named_locations_exists,
|
||||
)
|
||||
|
||||
entra_client.named_locations = {}
|
||||
|
||||
check = entra_trusted_named_locations_exists()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists import (
|
||||
entra_trusted_named_locations_exists,
|
||||
)
|
||||
|
||||
entra_client.named_locations = {DOMAIN: {}}
|
||||
|
||||
check = entra_trusted_named_locations_exists()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There is no trusted location with IP ranges defined."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Named Locations"
|
||||
assert result[0].resource_id == "Named Locations"
|
||||
|
||||
def test_entra_named_location_with_ip_ranges(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
NamedLocation,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists import (
|
||||
entra_trusted_named_locations_exists,
|
||||
)
|
||||
|
||||
entra_client.named_locations = {
|
||||
DOMAIN: {
|
||||
"location_id": NamedLocation(
|
||||
name="Test Location",
|
||||
ip_ranges_addresses=["192.168.0.1/24"],
|
||||
is_trusted=True,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_trusted_named_locations_exists()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Exits trusted location with trusted IP ranges, this IPs ranges are: ['192.168.0.1/24']"
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Test Location"
|
||||
assert result[0].resource_id == "location_id"
|
||||
|
||||
def test_entra_named_location_without_ip_ranges(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
NamedLocation,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists import (
|
||||
entra_trusted_named_locations_exists,
|
||||
)
|
||||
|
||||
entra_client.named_locations = {
|
||||
DOMAIN: {
|
||||
"location_id": NamedLocation(
|
||||
name="Test Location", ip_ranges_addresses=[], is_trusted=True
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_trusted_named_locations_exists()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There is no trusted location with IP ranges defined."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Test Location"
|
||||
assert result[0].resource_id == "location_id"
|
||||
|
||||
def test_entra_new_named_location_with_ip_ranges_not_trusted(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
NamedLocation,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_trusted_named_locations_exists.entra_trusted_named_locations_exists import (
|
||||
entra_trusted_named_locations_exists,
|
||||
)
|
||||
|
||||
entra_client.named_locations = {
|
||||
DOMAIN: {
|
||||
"location_id": NamedLocation(
|
||||
name="Test Location",
|
||||
ip_ranges_addresses=["192.168.0.1/24"],
|
||||
is_trusted=False,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_trusted_named_locations_exists()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There is no trusted location with IP ranges defined."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Test Location"
|
||||
assert result[0].resource_id == "location_id"
|
||||
+163
@@ -0,0 +1,163 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_users_cannot_create_microsoft_365_groups:
|
||||
def test_entra_no_tenant(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups import (
|
||||
entra_users_cannot_create_microsoft_365_groups,
|
||||
)
|
||||
|
||||
entra_client.group_settings = {}
|
||||
|
||||
check = entra_users_cannot_create_microsoft_365_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups import (
|
||||
entra_users_cannot_create_microsoft_365_groups,
|
||||
)
|
||||
|
||||
entra_client.group_settings = {DOMAIN: {}}
|
||||
|
||||
check = entra_users_cannot_create_microsoft_365_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == "Users can create Microsoft 365 groups."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Microsoft365 Groups"
|
||||
assert result[0].resource_id == "Microsoft365 Groups"
|
||||
|
||||
def test_entra_users_cannot_create_microsoft_365_groups(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
GroupSetting,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups import (
|
||||
entra_users_cannot_create_microsoft_365_groups,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
template_id = str(uuid4())
|
||||
|
||||
setting = mock.MagicMock
|
||||
setting.name = "EnableGroupCreation"
|
||||
setting.value = "false"
|
||||
|
||||
entra_client.group_settings = {
|
||||
DOMAIN: {
|
||||
id: GroupSetting(
|
||||
name="Group.Unified",
|
||||
template_id=template_id,
|
||||
settings=[setting],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_cannot_create_microsoft_365_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended == "Users cannot create Microsoft 365 groups."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Microsoft365 Groups"
|
||||
assert result[0].resource_id == "Microsoft365 Groups"
|
||||
|
||||
def test_entra_users_can_create_microsoft_365_groups(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
GroupSetting,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups import (
|
||||
entra_users_cannot_create_microsoft_365_groups,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
template_id = str(uuid4())
|
||||
|
||||
setting = mock.MagicMock
|
||||
setting.name = "EnableGroupCreation"
|
||||
setting.value = "true"
|
||||
|
||||
entra_client.group_settings = {
|
||||
DOMAIN: {
|
||||
id: GroupSetting(
|
||||
name="Group.Unified",
|
||||
template_id=template_id,
|
||||
settings=[setting],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_cannot_create_microsoft_365_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == "Users can create Microsoft 365 groups."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Microsoft365 Groups"
|
||||
assert result[0].resource_id == "Microsoft365 Groups"
|
||||
|
||||
def test_entra_users_can_create_microsoft_365_groups_no_setting(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
GroupSetting,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_cannot_create_microsoft_365_groups.entra_users_cannot_create_microsoft_365_groups import (
|
||||
entra_users_cannot_create_microsoft_365_groups,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
template_id = str(uuid4())
|
||||
|
||||
entra_client.group_settings = {
|
||||
DOMAIN: {
|
||||
id: GroupSetting(
|
||||
name="Group.Unified",
|
||||
template_id=template_id,
|
||||
settings=[],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_cannot_create_microsoft_365_groups()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == "Users can create Microsoft 365 groups."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Microsoft365 Groups"
|
||||
assert result[0].resource_id == "Microsoft365 Groups"
|
||||
+180
@@ -0,0 +1,180 @@
|
||||
from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import DOMAIN
|
||||
|
||||
|
||||
class Test_entra_users_less_than_five_global_admins:
|
||||
def test_entra_no_tenants(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins import (
|
||||
entra_users_less_than_five_global_admins,
|
||||
)
|
||||
|
||||
entra_client.directory_roles = {}
|
||||
|
||||
check = entra_users_less_than_five_global_admins()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_tenant_empty(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins import (
|
||||
entra_users_less_than_five_global_admins,
|
||||
)
|
||||
|
||||
entra_client.directory_roles = {DOMAIN: {}}
|
||||
|
||||
check = entra_users_less_than_five_global_admins()
|
||||
result = check.execute()
|
||||
assert len(result) == 0
|
||||
|
||||
def test_entra_less_than_five_global_admins(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
DirectoryRole,
|
||||
User,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins import (
|
||||
entra_users_less_than_five_global_admins,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
id_user1 = str(uuid4())
|
||||
id_user2 = str(uuid4())
|
||||
|
||||
entra_client.directory_roles = {
|
||||
DOMAIN: {
|
||||
"Global Administrator": DirectoryRole(
|
||||
id=id,
|
||||
members=[
|
||||
User(id=id_user1, name="User1"),
|
||||
User(id=id_user2, name="User2"),
|
||||
],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_less_than_five_global_admins()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == "There are 2 global administrators."
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Global Administrator"
|
||||
assert result[0].resource_id == id
|
||||
|
||||
def test_entra_more_than_five_global_admins(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
DirectoryRole,
|
||||
User,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins import (
|
||||
entra_users_less_than_five_global_admins,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
id_user1 = str(uuid4())
|
||||
id_user2 = str(uuid4())
|
||||
id_user3 = str(uuid4())
|
||||
id_user4 = str(uuid4())
|
||||
id_user5 = str(uuid4())
|
||||
id_user6 = str(uuid4())
|
||||
|
||||
entra_client.directory_roles = {
|
||||
DOMAIN: {
|
||||
"Global Administrator": DirectoryRole(
|
||||
id=id,
|
||||
members=[
|
||||
User(id=id_user1, name="User1"),
|
||||
User(id=id_user2, name="User2"),
|
||||
User(id=id_user3, name="User3"),
|
||||
User(id=id_user4, name="User4"),
|
||||
User(id=id_user5, name="User5"),
|
||||
User(id=id_user6, name="User6"),
|
||||
],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_less_than_five_global_admins()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There are 6 global administrators. It should be less than five."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Global Administrator"
|
||||
assert result[0].resource_id == id
|
||||
|
||||
def test_entra_exactly_five_global_admins(self):
|
||||
entra_client = mock.MagicMock
|
||||
|
||||
with mock.patch(
|
||||
"prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins.entra_client",
|
||||
new=entra_client,
|
||||
):
|
||||
from prowler.providers.azure.services.entra.entra_service import (
|
||||
DirectoryRole,
|
||||
User,
|
||||
)
|
||||
from prowler.providers.azure.services.entra.entra_users_less_than_five_global_admins.entra_users_less_than_five_global_admins import (
|
||||
entra_users_less_than_five_global_admins,
|
||||
)
|
||||
|
||||
id = str(uuid4())
|
||||
id_user1 = str(uuid4())
|
||||
id_user2 = str(uuid4())
|
||||
id_user3 = str(uuid4())
|
||||
id_user4 = str(uuid4())
|
||||
id_user5 = str(uuid4())
|
||||
|
||||
entra_client.directory_roles = {
|
||||
DOMAIN: {
|
||||
"Global Administrator": DirectoryRole(
|
||||
id=id,
|
||||
members=[
|
||||
User(id=id_user1, name="User1"),
|
||||
User(id=id_user2, name="User2"),
|
||||
User(id=id_user3, name="User3"),
|
||||
User(id=id_user4, name="User4"),
|
||||
User(id=id_user5, name="User5"),
|
||||
],
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
check = entra_users_less_than_five_global_admins()
|
||||
result = check.execute()
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "There are 5 global administrators. It should be less than five."
|
||||
)
|
||||
assert result[0].subscription == f"Tenant: '{DOMAIN}'"
|
||||
assert result[0].resource_name == "Global Administrator"
|
||||
assert result[0].resource_id == id
|
||||
Reference in New Issue
Block a user