diff --git a/docs/tutorials/azure/use-non-default-cloud.md b/docs/tutorials/azure/use-non-default-cloud.md index 0494efe88c..018e15f970 100644 --- a/docs/tutorials/azure/use-non-default-cloud.md +++ b/docs/tutorials/azure/use-non-default-cloud.md @@ -6,7 +6,11 @@ By default, Prowler uses `AzureCloud` cloud which is the comercial one. (you can At the time of writing this documentation the available Azure Clouds from different regions are the following: - AzureCloud - AzureChinaCloud -- AzureUSGovernment +- AzureUSGovernmentL4 +- AzureUSGovernmentL5 + +???+ note + More information about Azure US Goverment region [here](https://devblogs.microsoft.com/microsoft365dev/new-microsoft-graph-endpoints-in-us-government-cloud/) If you want to change the default one you must include the flag `--azure-region`, i.e.: diff --git a/prowler/providers/azure/azure_provider.py b/prowler/providers/azure/azure_provider.py index 8d97bc647d..26f42c94d2 100644 --- a/prowler/providers/azure/azure_provider.py +++ b/prowler/providers/azure/azure_provider.py @@ -202,7 +202,7 @@ class AzureProvider(Provider): ... sp_env_auth=True, ... browser_auth=False, ... managed_identity_auth=False, - ... region="AzureUSGovernment", + ... region="AzureUSGovernmentL4", ... ) - Subscriptions: rowler is multisubscription, which means that is going to scan all the subscriptions is able to list. If you only assign permissions to one subscription, it is going to scan a single one. Prowler also allows you to specify the subscriptions you want to scan by passing a list of subscription IDs. diff --git a/prowler/providers/azure/lib/arguments/arguments.py b/prowler/providers/azure/lib/arguments/arguments.py index 2b624a3f23..d155e29933 100644 --- a/prowler/providers/azure/lib/arguments/arguments.py +++ b/prowler/providers/azure/lib/arguments/arguments.py @@ -59,7 +59,8 @@ def validate_azure_region(region): """validate_azure_region validates if the region passed as argument is valid""" regions_allowed = [ "AzureChinaCloud", - "AzureUSGovernment", + "AzureUSGovernmentL4", + "AzureUSGovernmentL5", "AzureCloud", ] if region not in regions_allowed: diff --git a/prowler/providers/azure/lib/regions/regions.py b/prowler/providers/azure/lib/regions/regions.py index 15226be299..07c1c91afa 100644 --- a/prowler/providers/azure/lib/regions/regions.py +++ b/prowler/providers/azure/lib/regions/regions.py @@ -14,7 +14,7 @@ AZURE_GRAPH_CHINA = "https://microsoftgraph.chinacloudapi.cn/.default" def get_regions_config(region): allowed_regions = { "AzureCloud": { - "authority": None, + "authority": AzureAuthorityHosts.AZURE_PUBLIC_CLOUD, "base_url": AZURE_GENERIC_CLOUD, "credential_scopes": [AZURE_GENERIC_CLOUD + "/.default"], "graph_credential_scopes": [AZURE_GRAPH_GLOBAL], @@ -25,11 +25,17 @@ def get_regions_config(region): "credential_scopes": [AZURE_CHINA_CLOUD + "/.default"], "graph_credential_scopes": [AZURE_GRAPH_CHINA], }, - "AzureUSGovernment": { + "AzureUSGovernmentL4": { "authority": AzureAuthorityHosts.AZURE_GOVERNMENT, "base_url": AZURE_US_GOV_CLOUD, "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"], - "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4, AZURE_GRAPH_GOV_US_L5], + "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4], + }, + "AzureUSGovernmentL5": { + "authority": AzureAuthorityHosts.AZURE_GOVERNMENT, + "base_url": AZURE_US_GOV_CLOUD, + "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"], + "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L5], }, } return allowed_regions[region] diff --git a/tests/lib/cli/parser_test.py b/tests/lib/cli/parser_test.py index 16b322ac9c..55374b9415 100644 --- a/tests/lib/cli/parser_test.py +++ b/tests/lib/cli/parser_test.py @@ -1293,12 +1293,14 @@ class Test_Parser: def test_validate_azure_region_valid_regions(self): expected_regions = [ "AzureChinaCloud", - "AzureUSGovernment", + "AzureUSGovernmentL4", + "AzureUSGovernmentL5", "AzureCloud", ] input_regions = [ "AzureChinaCloud", - "AzureUSGovernment", + "AzureUSGovernmentL4", + "AzureUSGovernmentL5", "AzureCloud", ] for region in input_regions: @@ -1307,7 +1309,8 @@ class Test_Parser: def test_validate_azure_region_invalid_regions(self): expected_regions = [ "AzureChinaCloud", - "AzureUSGovernment", + "AzureUSGovernmentL4", + "AzureUSGovernmentL5", "AzureCloud", ] invalid_region = "non-valid-region" diff --git a/tests/providers/azure/lib/regions/regions_test.py b/tests/providers/azure/lib/regions/regions_test.py index 06e5d973c9..0f590f5093 100644 --- a/tests/providers/azure/lib/regions/regions_test.py +++ b/tests/providers/azure/lib/regions/regions_test.py @@ -17,7 +17,8 @@ class Test_azure_regions: allowed_regions = [ "AzureCloud", "AzureChinaCloud", - "AzureUSGovernment", + "AzureUSGovernmentL4", + "AzureUSGovernmentL5", ] expected_output = { "AzureCloud": { @@ -32,14 +33,17 @@ class Test_azure_regions: "credential_scopes": [AZURE_CHINA_CLOUD + "/.default"], "graph_credential_scopes": [AZURE_GRAPH_CHINA], }, - "AzureUSGovernment": { + "AzureUSGovernmentL4": { "authority": AzureAuthorityHosts.AZURE_GOVERNMENT, "base_url": AZURE_US_GOV_CLOUD, "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"], - "graph_credential_scopes": [ - AZURE_GRAPH_GOV_US_L4, - AZURE_GRAPH_GOV_US_L5, - ], + "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L4], + }, + "AzureUSGovernmentL5": { + "authority": AzureAuthorityHosts.AZURE_GOVERNMENT, + "base_url": AZURE_US_GOV_CLOUD, + "credential_scopes": [AZURE_US_GOV_CLOUD + "/.default"], + "graph_credential_scopes": [AZURE_GRAPH_GOV_US_L5], }, }