From 55a8310334420cbb246f64e21615fcc5718d8d32 Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Thu, 13 Mar 2025 20:48:33 +0100 Subject: [PATCH] refactor: rename entra_policy_ensure_default_user_cannot_create_tenants --- ...t_user_cannot_create_tenants.metadata.json | 30 ---- ...sure_default_user_cannot_create_tenants.py | 33 ---- .../__init__.py | 0 ..._user_cannot_create_tenants.metadata.json} | 2 +- ...ure_default_user_cannot_create_tenants.py} | 2 +- .../__init__.py | 0 ...default_user_cannot_create_tenants_test.py | 152 ------------------ ...efault_user_cannot_create_tenants_test.py} | 26 +-- 8 files changed, 15 insertions(+), 230 deletions(-) delete mode 100644 prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json delete mode 100644 prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py rename prowler/providers/{azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants => microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants}/__init__.py (100%) rename prowler/providers/microsoft365/services/entra/{entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json => entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json} (95%) rename prowler/providers/microsoft365/services/entra/{entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py => entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py} (96%) delete mode 100644 prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py delete mode 100644 tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py rename tests/providers/microsoft365/services/entra/{entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py => entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py} (75%) diff --git a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json deleted file mode 100644 index 4d7a2d7bd9..0000000000 --- a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "Provider": "azure", - "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants", - "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'", - "CheckType": [], - "ServiceName": "entra", - "SubServiceName": "", - "ResourceIdTemplate": "", - "Severity": "high", - "ResourceType": "#microsoft.graph.authorizationPolicy", - "Description": "Require administrators or appropriately delegated users to create new tenants.", - "Risk": "It is recommended to only allow an administrator to create new tenants. This prevent users from creating new Azure AD or Azure AD B2C tenants and ensures that only authorized users are able to do so.", - "RelatedUrl": "https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions", - "Remediation": { - "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" - }, - "Recommendation": { - "Text": "1. From Azure Home select the Portal Menu 2. Select Azure Active Directory 3. Select Users 4. Select User settings 5. Set 'Restrict non-admin users from creating' tenants to 'Yes'", - "Url": "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#tenant-creator" - } - }, - "Categories": [], - "DependsOn": [], - "RelatedTo": [], - "Notes": "Enforcing this setting will ensure that only authorized users are able to create new tenants." -} diff --git a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py deleted file mode 100644 index 6f621d1042..0000000000 --- a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py +++ /dev/null @@ -1,33 +0,0 @@ -from prowler.lib.check.models import Check, Check_Report_Azure -from prowler.providers.azure.services.entra.entra_client import entra_client - - -class entra_policy_ensure_default_user_cannot_create_tenants(Check): - def execute(self) -> Check_Report_Azure: - findings = [] - - for tenant_domain, auth_policy in entra_client.authorization_policy.items(): - report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy) - report.subscription = f"Tenant: {tenant_domain}" - report.resource_name = getattr(auth_policy, "name", "Authorization Policy") - report.resource_id = getattr(auth_policy, "id", "authorizationPolicy") - report.status = "FAIL" - report.status_extended = ( - "Tenants creation is not disabled for non-admin users." - ) - - if getattr( - auth_policy, "default_user_role_permissions", None - ) and not getattr( - auth_policy.default_user_role_permissions, - "allowed_to_create_tenants", - True, - ): - report.status = "PASS" - report.status_extended = ( - "Tenants creation is disabled for non-admin users." - ) - - findings.append(report) - - return findings diff --git a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py b/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/__init__.py similarity index 100% rename from prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py rename to prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/__init__.py diff --git a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json b/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json similarity index 95% rename from prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json rename to prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json index 12a0da5cf9..3144ad0123 100644 --- a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json +++ b/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json @@ -1,6 +1,6 @@ { "Provider": "microsoft365", - "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants", + "CheckID": "entra_authpolicy_ensure_default_user_cannot_create_tenants", "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'", "CheckType": [], "ServiceName": "entra", diff --git a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py b/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py similarity index 96% rename from prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py rename to prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py index de2c2112eb..1157d6b5ee 100644 --- a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py +++ b/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py @@ -4,7 +4,7 @@ from prowler.lib.check.models import Check, CheckReportMicrosoft365 from prowler.providers.microsoft365.services.entra.entra_client import entra_client -class entra_policy_ensure_default_user_cannot_create_tenants(Check): +class entra_authpolicy_ensure_default_user_cannot_create_tenants(Check): """Check if default users are restricted from creating tenants. This check verifies whether the authorization policy prevents non-admin users diff --git a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py deleted file mode 100644 index 7e97b4558d..0000000000 --- a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py +++ /dev/null @@ -1,152 +0,0 @@ -from unittest import mock -from uuid import uuid4 - -from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provider - - -class Test_entra_policy_ensure_default_user_cannot_create_tenants: - def test_entra_no_tenants(self): - entra_client = mock.MagicMock - entra_client.authorization_policy = {} - - with ( - mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), - mock.patch( - "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", - new=entra_client, - ), - ): - from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, - ) - - check = entra_policy_ensure_default_user_cannot_create_tenants() - result = check.execute() - assert len(result) == 0 - - def test_entra_empty_tenant(self): - entra_client = mock.MagicMock - entra_client.authorization_policy = {DOMAIN: {}} - - with ( - mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), - mock.patch( - "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", - new=entra_client, - ), - ): - from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, - ) - - check = entra_policy_ensure_default_user_cannot_create_tenants() - result = check.execute() - assert len(result) == 1 - assert result[0].status == "FAIL" - assert result[0].subscription == f"Tenant: {DOMAIN}" - assert result[0].resource_name == "Authorization Policy" - assert result[0].resource_id == "authorizationPolicy" - assert ( - result[0].status_extended - == "Tenants creation is not disabled for non-admin users." - ) - - def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self): - id = str(uuid4()) - entra_client = mock.MagicMock - - with ( - mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), - mock.patch( - "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", - new=entra_client, - ), - ): - from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, - ) - from prowler.providers.azure.services.entra.entra_service import ( - AuthorizationPolicy, - DefaultUserRolePermissions, - ) - - entra_client.authorization_policy = { - DOMAIN: AuthorizationPolicy( - id=id, - name="Test", - description="Test", - default_user_role_permissions=DefaultUserRolePermissions( - allowed_to_create_tenants=False - ), - guest_invite_settings="everyone", - guest_user_role_id=uuid4(), - ) - } - - check = entra_policy_ensure_default_user_cannot_create_tenants() - result = check.execute() - assert len(result) == 1 - assert result[0].status == "PASS" - assert ( - result[0].status_extended - == "Tenants creation is disabled for non-admin users." - ) - assert result[0].resource_name == "Test" - assert result[0].resource_id == id - assert result[0].subscription == f"Tenant: {DOMAIN}" - - def test_entra_default_user_role_permissions_allowed_to_create_tenants(self): - id = str(uuid4()) - entra_client = mock.MagicMock - - with ( - mock.patch( - "prowler.providers.common.provider.Provider.get_global_provider", - return_value=set_mocked_azure_provider(), - ), - mock.patch( - "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", - new=entra_client, - ), - ): - from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, - ) - from prowler.providers.azure.services.entra.entra_service import ( - AuthorizationPolicy, - DefaultUserRolePermissions, - ) - - entra_client.authorization_policy = { - DOMAIN: AuthorizationPolicy( - id=id, - name="Test", - description="Test", - default_user_role_permissions=DefaultUserRolePermissions( - allowed_to_create_tenants=True - ), - guest_invite_settings="everyone", - guest_user_role_id=uuid4(), - ) - } - - check = entra_policy_ensure_default_user_cannot_create_tenants() - result = check.execute() - assert len(result) == 1 - assert result[0].status == "FAIL" - assert ( - result[0].status_extended - == "Tenants creation is not disabled for non-admin users." - ) - assert result[0].resource_name == "Test" - assert result[0].resource_id == id - assert result[0].subscription == f"Tenant: {DOMAIN}" diff --git a/tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py b/tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py similarity index 75% rename from tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py rename to tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py index 5c615b1da0..a89fbb1f84 100644 --- a/tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py +++ b/tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py @@ -10,7 +10,7 @@ from tests.providers.microsoft365.microsoft365_fixtures import ( ) -class Test_entra_policy_ensure_default_user_cannot_create_tenants: +class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: def test_entra_empty_tenant(self): entra_client = mock.MagicMock entra_client.authorization_policy = {} @@ -21,15 +21,15 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( + entra_authpolicy_ensure_default_user_cannot_create_tenants, ) - check = entra_policy_ensure_default_user_cannot_create_tenants() + check = entra_authpolicy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" @@ -52,12 +52,12 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( + entra_authpolicy_ensure_default_user_cannot_create_tenants, ) entra_client.authorization_policy = AuthorizationPolicy( @@ -69,7 +69,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants: ), ) - check = entra_policy_ensure_default_user_cannot_create_tenants() + check = entra_authpolicy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" @@ -92,12 +92,12 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( - entra_policy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( + entra_authpolicy_ensure_default_user_cannot_create_tenants, ) entra_client.authorization_policy = AuthorizationPolicy( @@ -109,7 +109,7 @@ class Test_entra_policy_ensure_default_user_cannot_create_tenants: ), ) - check = entra_policy_ensure_default_user_cannot_create_tenants() + check = entra_authpolicy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "PASS"