mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-29 23:04:23 +00:00
feat(azure): add Deploy-to-Azure Bicep template and certificate auth
This commit is contained in:
Lydia Vilchez committed
1 parent
d41b2eaa0f
commit
ab738e8a4e
34 files changed
+1953
-93
No files matched your search
@@ -6,11 +6,13 @@ Prowler for Azure supports multiple authentication types. Authentication methods
|
||||
|
||||
**Prowler Cloud:**
|
||||
|
||||
- [**Service Principal Application**](#service-principal-application-authentication-recommended)
|
||||
- [**Certificate Authentication**](#certificate-authentication) (**Recommended** — one-click setup via the [Deploy to Azure](#deploy-to-azure-quick-start) quick-start)
|
||||
- [**Service Principal Application**](#service-principal-application-authentication-recommended) with a client secret
|
||||
|
||||
**Prowler CLI:**
|
||||
|
||||
- [**Service Principal Application**](#service-principal-application-authentication-recommended) (**Recommended**)
|
||||
- [**Certificate Authentication**](#certificate-authentication) (**Recommended**)
|
||||
- [**Service Principal Application**](#service-principal-application-authentication-recommended) with a client secret
|
||||
- [**AZ CLI credentials**](#az-cli-authentication)
|
||||
- [**Interactive browser authentication**](#browser-authentication)
|
||||
- [**Managed Identity Authentication**](#managed-identity-authentication)
|
||||
@@ -216,6 +218,84 @@ The following security checks require the `ProwlerRole` permissions for executio
|
||||
|
||||
---
|
||||
|
||||
## Deploy to Azure (Quick-Start)
|
||||
|
||||
Prowler ships a public [Bicep template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/azure/bicep/prowler-scan.bicep) that provisions the App Registration, Service Principal, built-in `Reader` role assignment, and the custom `ProwlerRole` — all bound to an X.509 certificate credential — in a single deployment. This is the Azure analogue of the AWS CloudFormation quick-create flow.
|
||||
|
||||
Use it from the Prowler Cloud **add-provider wizard**:
|
||||
|
||||
1. Pick **Azure**, then choose **Certificate Authentication (Recommended)** in the credential-type selector.
|
||||
2. Click **Deploy to Azure**. The button opens the Azure Portal deployment blade pre-loaded with the template.
|
||||
3. Generate a certificate (see [Certificate Authentication](#certificate-authentication) below) and paste the base64-encoded public certificate and its SHA-1 thumbprint into the Bicep parameters.
|
||||
4. Deploy and, when the stack finishes, copy the `tenantId`, `applicationId`, and `certificateThumbprint` outputs plus the private key back into Prowler.
|
||||
|
||||
<Note>
|
||||
The Deploy to Azure button is not available for sovereign clouds (Azure Government, Azure China, Azure Germany) or personal Microsoft accounts. Follow the manual [Certificate Authentication](#certificate-authentication) or [Service Principal](#service-principal-application-authentication-recommended) instructions instead.
|
||||
</Note>
|
||||
|
||||
## Certificate Authentication
|
||||
|
||||
Certificate authentication is the recommended way to run Prowler against Azure because Entra ID keeps only the public certificate (no shared secrets to rotate), and Bicep can bind the certificate to the App Registration natively via `keyCredentials`.
|
||||
|
||||
### Generating the certificate
|
||||
|
||||
Prowler never sees the private key during deployment — the user generates the keypair locally.
|
||||
|
||||
**macOS / Linux (OpenSSL):**
|
||||
|
||||
```console
|
||||
openssl req -x509 -newkey rsa:4096 -keyout prowler.key -out prowler.crt \
|
||||
-days 365 -nodes -subj "/CN=Prowler"
|
||||
|
||||
# Base64 of the public certificate — feeds `certificateBase64` in the Bicep template
|
||||
openssl x509 -in prowler.crt -outform DER | base64 | tr -d '\n'
|
||||
|
||||
# SHA-1 thumbprint — feeds `certificateThumbprint` in the Bicep template
|
||||
openssl x509 -in prowler.crt -noout -fingerprint -sha1 \
|
||||
| cut -d= -f2 | tr -d ':' | tr '[:lower:]' '[:upper:]'
|
||||
|
||||
# Base64 of the private key — paste into Prowler as "Certificate Content"
|
||||
base64 -i prowler.key | tr -d '\n'
|
||||
```
|
||||
|
||||
**Windows (PowerShell):**
|
||||
|
||||
```powershell
|
||||
$cert = New-SelfSignedCertificate -Subject "CN=Prowler" `
|
||||
-CertStoreLocation "Cert:\CurrentUser\My" `
|
||||
-KeyExportPolicy Exportable -KeySpec Signature `
|
||||
-KeyLength 4096 -HashAlgorithm SHA256
|
||||
|
||||
[Convert]::ToBase64String($cert.RawData) # certificateBase64
|
||||
$cert.Thumbprint # certificateThumbprint
|
||||
```
|
||||
|
||||
### Prowler Cloud
|
||||
|
||||
Paste the following into the Certificate Authentication form of the Azure add-provider wizard:
|
||||
|
||||
- **Tenant ID** — copy from the deployment outputs.
|
||||
- **Client ID** — copy from the deployment outputs (`applicationId`).
|
||||
- **Certificate Content** — the base64-encoded **private key** (never the public certificate).
|
||||
|
||||
### Prowler CLI
|
||||
|
||||
Set the following environment variables and invoke Prowler with `--certificate-auth`:
|
||||
|
||||
```console
|
||||
export AZURE_CLIENT_ID="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
|
||||
export AZURE_TENANT_ID="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
|
||||
export AZURE_CERTIFICATE_CONTENT="<base64-encoded private key>"
|
||||
|
||||
prowler azure --certificate-auth
|
||||
```
|
||||
|
||||
Alternatively, point Prowler at a certificate file on disk:
|
||||
|
||||
```console
|
||||
prowler azure --certificate-auth --certificate-path /path/to/prowler.key
|
||||
```
|
||||
|
||||
## Service Principal Application Authentication (Recommended)
|
||||
|
||||
This method is required for Prowler Cloud and recommended for Prowler CLI.
|
||||
|
||||
@@ -53,26 +53,29 @@ For detailed instructions on how to create the Service Principal and configure p
|
||||
|
||||
### Step 3: Add Credentials to Prowler Cloud
|
||||
|
||||
For Azure, Prowler Cloud uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](/user-guide/providers/azure/authentication). When you finish creating and adding the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
|
||||
Azure supports two authentication methods in the add-provider wizard. Prowler Cloud shows a credential-type selector where you can pick the one that fits.
|
||||
|
||||
#### Certificate Authentication (Recommended)
|
||||
|
||||
1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`
|
||||
The one-click flow: click **Deploy to Azure** in the wizard and let the Bicep template create the App Registration, Service Principal, `Reader` role assignment, and custom `ProwlerRole` with a certificate credential in a single deployment.
|
||||
|
||||
|
||||
1. In the Azure wizard, select **Certificate Authentication (Recommended)**.
|
||||
2. Click the **Deploy to Azure** button. This opens the Azure Portal deployment blade pre-loaded with the [Prowler Bicep template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/azure/bicep/prowler-scan.bicep).
|
||||
3. Generate a certificate locally and fill the Bicep parameters (`certificateBase64` and `certificateThumbprint`). See [Certificate Authentication → Generating the certificate](/user-guide/providers/azure/authentication#generating-the-certificate) for the exact commands.
|
||||
4. When the deployment finishes, copy the `tenantId` and `applicationId` outputs back to Prowler along with the base64-encoded **private key** you generated earlier, and pastes them into the Certificate Content field.
|
||||
5. Click **Next**, then **Launch Scan**.
|
||||
|
||||
2. Go to Prowler Cloud and paste:
|
||||
#### Service Principal with Client Secret
|
||||
|
||||
- `Client ID`
|
||||
- `Tenant ID`
|
||||
- `Client Secret` from [earlier](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended)
|
||||
The manual fallback that mirrors the previous Prowler Cloud flow, and the only option for sovereign clouds and personal accounts.
|
||||
|
||||
1. Follow [Creating Prowler Service Principal](/user-guide/providers/azure/create-prowler-service-principal) to create the App Registration, assign the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions, and issue a client secret.
|
||||
2. In the Azure wizard, select **Service Principal with Client Secret**.
|
||||
3. Paste `Tenant ID`, `Client ID`, and `Client Secret`.
|
||||
|
||||
|
||||
|
||||
3. Click `Next`
|
||||
|
||||
|
||||
|
||||
4. Click "Launch Scan"
|
||||
4. Click `Next`, then **Launch Scan**.
|
||||
|
||||
|
||||
|
||||
@@ -86,7 +89,29 @@ To authenticate with Azure, Prowler CLI supports multiple authentication methods
|
||||
|
||||
For detailed authentication setup instructions, see [Authentication](/user-guide/providers/azure/authentication).
|
||||
|
||||
**Service Principal (Recommended)**
|
||||
**Certificate Authentication (Recommended)**
|
||||
|
||||
Set up environment variables with the base64-encoded private key:
|
||||
|
||||
```console
|
||||
export AZURE_CLIENT_ID="XXXXXXXXX"
|
||||
export AZURE_TENANT_ID="XXXXXXXXX"
|
||||
export AZURE_CERTIFICATE_CONTENT="<base64-encoded private key>"
|
||||
```
|
||||
|
||||
Then run:
|
||||
|
||||
```console
|
||||
prowler azure --certificate-auth
|
||||
```
|
||||
|
||||
Or point Prowler at a certificate file on disk:
|
||||
|
||||
```console
|
||||
prowler azure --certificate-auth --certificate-path /path/to/prowler.key
|
||||
```
|
||||
|
||||
**Service Principal with Client Secret**
|
||||
|
||||
Set up environment variables:
|
||||
|
||||
|
||||
Reference in new issue
Block a user