feat(cosmosdb): extract CosmosDB resource metadata in automated way (#6533)

This commit is contained in:
Rubén De la Torre Vico
2025-01-15 14:51:48 +01:00
committed by GitHub
parent 3dfd578ee5
commit 48ff9a5100
4 changed files with 13 additions and 14 deletions
@@ -7,12 +7,11 @@ class cosmosdb_account_firewall_use_selected_networks(Check):
findings = []
for subscription, accounts in cosmosdb_client.accounts.items():
for account in accounts:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=account
)
report.subscription = subscription
report.resource_name = account.name
report.resource_id = account.id
report.status = "FAIL"
report.location = account.location
report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has firewall rules that allow access from all networks."
if account.is_virtual_network_filter_enabled:
report.status = "PASS"
@@ -7,12 +7,11 @@ class cosmosdb_account_use_aad_and_rbac(Check):
findings = []
for subscription, accounts in cosmosdb_client.accounts.items():
for account in accounts:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=account
)
report.subscription = subscription
report.resource_name = account.name
report.resource_id = account.id
report.status = "FAIL"
report.location = account.location
report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} is not using AAD and RBAC"
if account.disable_local_auth:
report.status = "PASS"
@@ -7,12 +7,11 @@ class cosmosdb_account_use_private_endpoints(Check):
findings = []
for subscription, accounts in cosmosdb_client.accounts.items():
for account in accounts:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=account
)
report.subscription = subscription
report.resource_name = account.name
report.resource_id = account.id
report.status = "FAIL"
report.location = account.location
report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} is not using private endpoints connections"
if account.private_endpoint_connections:
report.status = "PASS"
@@ -1,4 +1,4 @@
from dataclasses import dataclass
from dataclasses import dataclass, field
from azure.mgmt.cosmosdb import CosmosDBManagementClient
from azure.mgmt.cosmosdb.models import PrivateEndpointConnection
@@ -50,5 +50,7 @@ class Account:
tags: dict
is_virtual_network_filter_enabled: bool
location: str
private_endpoint_connections: list[PrivateEndpointConnection] = None
private_endpoint_connections: list[PrivateEndpointConnection] = field(
default_factory=list
)
disable_local_auth: bool = False