feat(azure): add new azure region and refactor scopes

docs/tutorials/azure/use-non-default-cloud.md

@@ -6,7 +6,11 @@ By default, Prowler uses `AzureCloud` cloud which is the comercial one. (you can
 At the time of writing this documentation the available Azure Clouds from different regions are the following:
 - AzureCloud
 - AzureChinaCloud
-- AzureUSGovernment
+- AzureUSGovernmentL4
+- AzureUSGovernmentL5
+
+???+ note
+    More information about Azure US Goverment region [here](https://devblogs.microsoft.com/microsoft365dev/new-microsoft-graph-endpoints-in-us-government-cloud/)
 
 If you want to change the default one you must include the flag `--azure-region`, i.e.:
 

prowler/providers/azure/azure_provider.py

@@ -202,7 +202,7 @@ class AzureProvider(Provider):
                 ...     sp_env_auth=True,
                 ...     browser_auth=False,
                 ...     managed_identity_auth=False,
-                ...     region="AzureUSGovernment",
+                ...     region="AzureUSGovernmentL4",
                 ... )
             - Subscriptions: rowler is multisubscription, which means that is going to scan all the subscriptions is able to list. If you only assign permissions to one subscription, it is going to scan a single one.
               Prowler also allows you to specify the subscriptions you want to scan by passing a list of subscription IDs.

prowler/providers/azure/lib/arguments/arguments.py

@@ -59,7 +59,8 @@ def validate_azure_region(region):
     """validate_azure_region validates if the region passed as argument is valid"""
     regions_allowed = [
         "AzureChinaCloud",
-        "AzureUSGovernment",
+        "AzureUSGovernmentL4",
+        "AzureUSGovernmentL5",
         "AzureCloud",
     ]
     if region not in regions_allowed:

prowler/providers/azure/lib/regions/regions.py

@@ -14,7 +14,7 @@ AZURE_GRAPH_CHINA = "https://microsoftgraph.chinacloudapi.cn/.default"
 def get_regions_config(region):
     allowed_regions = {
         "AzureCloud": {
-            "authority": None,
+            "authority": AzureAuthorityHosts.AZURE_PUBLIC_CLOUD,
             "base_url": AZURE_GENERIC_CLOUD,
             "credential_scopes": [AZURE_GENERIC_CLOUD + "/.default"],
             "graph_credential_scopes": [AZURE_GRAPH_GLOBAL],
@@ -25,11 +25,17 @@ def get_regions_config(region):
             "credential_scopes": [AZURE_CHINA_CLOUD + "/.default"],
             "graph_credential_scopes": [AZURE_GRAPH_CHINA],
         },
-        "AzureUSGovernment": {
+        "AzureUSGovernmentL4": {
             "authority": AzureAuthorityHosts.AZURE_GOVERNMENT,
             "base_url": AZURE_US_GOV_CLOUD,
             "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"],
-            "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4, AZURE_GRAPH_GOV_US_L5],
+            "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4],
+        },
+        "AzureUSGovernmentL5": {
+            "authority": AzureAuthorityHosts.AZURE_GOVERNMENT,
+            "base_url": AZURE_US_GOV_CLOUD,
+            "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"],
+            "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L5],
         },
     }
     return allowed_regions[region]

tests/lib/cli/parser_test.py

@@ -1293,12 +1293,14 @@ class Test_Parser:
     def test_validate_azure_region_valid_regions(self):
         expected_regions = [
             "AzureChinaCloud",
-            "AzureUSGovernment",
+            "AzureUSGovernmentL4",
+            "AzureUSGovernmentL5",
             "AzureCloud",
         ]
         input_regions = [
             "AzureChinaCloud",
-            "AzureUSGovernment",
+            "AzureUSGovernmentL4",
+            "AzureUSGovernmentL5",
             "AzureCloud",
         ]
         for region in input_regions:
@@ -1307,7 +1309,8 @@ class Test_Parser:
     def test_validate_azure_region_invalid_regions(self):
         expected_regions = [
             "AzureChinaCloud",
-            "AzureUSGovernment",
+            "AzureUSGovernmentL4",
+            "AzureUSGovernmentL5",
             "AzureCloud",
         ]
         invalid_region = "non-valid-region"

tests/providers/azure/lib/regions/regions_test.py

@@ -17,7 +17,8 @@ class Test_azure_regions:
         allowed_regions = [
             "AzureCloud",
             "AzureChinaCloud",
-            "AzureUSGovernment",
+            "AzureUSGovernmentL4",
+            "AzureUSGovernmentL5",
         ]
         expected_output = {
             "AzureCloud": {
@@ -32,14 +33,17 @@ class Test_azure_regions:
                 "credential_scopes": [AZURE_CHINA_CLOUD + "/.default"],
                 "graph_credential_scopes": [AZURE_GRAPH_CHINA],
             },
-            "AzureUSGovernment": {
+            "AzureUSGovernmentL4": {
                 "authority": AzureAuthorityHosts.AZURE_GOVERNMENT,
                 "base_url": AZURE_US_GOV_CLOUD,
                 "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"],
-                "graph_credential_scopes": [
-                    AZURE_GRAPH_GOV_US_L4,
-                    AZURE_GRAPH_GOV_US_L5,
-                ],
+                "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4],
+            },
+            "AzureUSGovernmentL5": {
+                "authority": AzureAuthorityHosts.AZURE_GOVERNMENT,
+                "base_url": AZURE_US_GOV_CLOUD,
+                "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"],
+                "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L5],
             },
         }