From 63458cd976a13185134fe271c072c9c4ab7765ad Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Mon, 16 Jun 2025 13:19:51 +0200 Subject: [PATCH] fix(azure): add new way to auth against App Insight (#8024) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rubén De la Torre Vico Co-authored-by: Sergio Garcia --- prowler/CHANGELOG.md | 2 + ...p_function_application_insights_enabled.py | 14 +--- ...ction_application_insights_enabled_test.py | 80 +------------------ 3 files changed, 8 insertions(+), 88 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 8e43feabc3..f822ac2af6 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -26,6 +26,8 @@ All notable changes to the **Prowler SDK** are documented in this file. - `storage_account_key_access_disabled` check for Azure provider [(#7974)](https://github.com/prowler-cloud/prowler/pull/7974) - `storage_ensure_file_shares_soft_delete_is_enabled` check for Azure provider [(#7966)](https://github.com/prowler-cloud/prowler/pull/7966) - Make `validate_mutelist` method static inside `Mutelist` class [(#7811)](https://github.com/prowler-cloud/prowler/pull/7811) +- Avoid bypassing IAM check using wildcards [(#7708)](https://github.com/prowler-cloud/prowler/pull/7708) +- Add new method to authenticate in AppInsights in check `app_function_application_insights_enabled` [(#7763)](https://github.com/prowler-cloud/prowler/pull/7763) --- ## [v5.7.5] (Prowler UNRELEASED) diff --git a/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py b/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py index 3c5102dbbb..004af0da30 100644 --- a/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py +++ b/prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py @@ -1,8 +1,5 @@ from prowler.lib.check.models import Check, Check_Report_Azure from prowler.providers.azure.services.app.app_client import app_client -from prowler.providers.azure.services.appinsights.appinsights_client import ( - appinsights_client, -) class app_function_application_insights_enabled(Check): @@ -25,13 +22,10 @@ class app_function_application_insights_enabled(Check): ) if function.enviroment_variables.get( - "APPINSIGHTS_INSTRUMENTATIONKEY", "" - ) in [ - component.instrumentation_key - for component in appinsights_client.components[ - subscription_name - ].values() - ]: + "APPINSIGHTS_INSTRUMENTATIONKEY", None + ) or function.enviroment_variables.get( + "APPLICATIONINSIGHTS_CONNECTION_STRING", None + ): report.status = "PASS" report.status_extended = ( f"Function {function.name} is using Application Insights." diff --git a/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py b/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py index 4f934f1977..4ea444157c 100644 --- a/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py +++ b/tests/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled_test.py @@ -56,7 +56,6 @@ class Test_app_function_application_insights_enabled: def test_app_function_no_app_insights(self): app_client = mock.MagicMock - app_insights = mock.MagicMock with ( mock.patch( @@ -67,18 +66,11 @@ class Test_app_function_application_insights_enabled: "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.app_client", new=app_client, ), - mock.patch( - "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.appinsights_client", - new=app_insights, - ), ): from prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled import ( app_function_application_insights_enabled, ) from prowler.providers.azure.services.app.app_service import FunctionApp - from prowler.providers.azure.services.appinsights.appinsights_service import ( - Component, - ) function_id = str(uuid4()) @@ -99,17 +91,6 @@ class Test_app_function_application_insights_enabled: } } - app_insights.components = { - AZURE_SUBSCRIPTION_ID: { - "app_id-1": Component( - resource_id="component_id", - resource_name="component_name", - location="West Europe", - instrumentation_key="1234", - ) - } - } - check = app_function_application_insights_enabled() result = check.execute() assert len(result) == 1 @@ -125,7 +106,6 @@ class Test_app_function_application_insights_enabled: def test_app_function_using_app_insights(self): app_client = mock.MagicMock - app_insights = mock.MagicMock with ( mock.patch( @@ -136,18 +116,11 @@ class Test_app_function_application_insights_enabled: "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.app_client", new=app_client, ), - mock.patch( - "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.appinsights_client", - new=app_insights, - ), ): from prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled import ( app_function_application_insights_enabled, ) from prowler.providers.azure.services.app.app_service import FunctionApp - from prowler.providers.azure.services.appinsights.appinsights_service import ( - Component, - ) function_id = str(uuid4()) @@ -168,17 +141,6 @@ class Test_app_function_application_insights_enabled: } } - app_insights.components = { - AZURE_SUBSCRIPTION_ID: { - "app_id-1": Component( - resource_id="component_id", - resource_name="component_name", - location="West Europe", - instrumentation_key="1234", - ) - } - } - check = app_function_application_insights_enabled() result = check.execute() assert len(result) == 1 @@ -194,7 +156,6 @@ class Test_app_function_application_insights_enabled: def test_app_function_using_app_insights_different_key(self): app_client = mock.MagicMock - app_insights = mock.MagicMock with ( mock.patch( @@ -205,18 +166,11 @@ class Test_app_function_application_insights_enabled: "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.app_client", new=app_client, ), - mock.patch( - "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.appinsights_client", - new=app_insights, - ), ): from prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled import ( app_function_application_insights_enabled, ) from prowler.providers.azure.services.app.app_service import FunctionApp - from prowler.providers.azure.services.appinsights.appinsights_service import ( - Component, - ) function_id = str(uuid4()) @@ -237,24 +191,13 @@ class Test_app_function_application_insights_enabled: } } - app_insights.components = { - AZURE_SUBSCRIPTION_ID: { - "app_id-1": Component( - resource_id="component_id", - resource_name="component_name", - location="West Europe", - instrumentation_key="5678", - ) - } - } - check = app_function_application_insights_enabled() result = check.execute() assert len(result) == 1 - assert result[0].status == "FAIL" + assert result[0].status == "PASS" assert ( result[0].status_extended - == "Function function1 is not using Application Insights." + == "Function function1 is using Application Insights." ) assert result[0].resource_id == function_id assert result[0].resource_name == "function1" @@ -263,7 +206,6 @@ class Test_app_function_application_insights_enabled: def test_app_function_with_app_insights_no_key(self): app_client = mock.MagicMock - app_insights = mock.MagicMock with ( mock.patch( @@ -274,18 +216,11 @@ class Test_app_function_application_insights_enabled: "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.app_client", new=app_client, ), - mock.patch( - "prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled.appinsights_client", - new=app_insights, - ), ): from prowler.providers.azure.services.app.app_function_application_insights_enabled.app_function_application_insights_enabled import ( app_function_application_insights_enabled, ) from prowler.providers.azure.services.app.app_service import FunctionApp - from prowler.providers.azure.services.appinsights.appinsights_service import ( - Component, - ) function_id = str(uuid4()) @@ -306,17 +241,6 @@ class Test_app_function_application_insights_enabled: } } - app_insights.components = { - AZURE_SUBSCRIPTION_ID: { - "app_id-1": Component( - resource_id="component_id", - resource_name="component_name", - location="West Europe", - instrumentation_key="Not Found", - ) - } - } - check = app_function_application_insights_enabled() result = check.execute() assert len(result) == 1