ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(keyvault): extract KeyVault resource metadata automated (#6553)

Browse Source
This commit is contained in:
Rubén De la Torre Vico
2025-01-16 15:17:36 +01:00
committed by GitHub
parent 74d6b614b3
commit b35495eaa7
10 changed files with 32 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/azure/services/keyvault/keyvault_key_expiration_set_in_non_rbac/keyvault_key_expiration_set_in_non_rbac.py
+3 -4
View File
@@ -8,12 +8,11 @@ class keyvault_key_expiration_set_in_non_rbac(Check):
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
if not keyvault.properties.enable_rbac_authorization and keyvault.keys:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.status = "PASS"
report.location = keyvault.location
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the keys with expiration date set."
has_key_without_expiration = False
for key in keyvault.keys:
prowler/providers/azure/services/keyvault/keyvault_key_rotation_enabled/keyvault_key_rotation_enabled.py
+3 -4
View File
@@ -8,11 +8,10 @@ class keyvault_key_rotation_enabled(Check):
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
if keyvault.keys:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
for key in keyvault.keys:
if (
key.rotation_policy
prowler/providers/azure/services/keyvault/keyvault_logging_enabled/keyvault_logging_enabled.py
+8 -13
View File
@@ -6,28 +6,23 @@ class keyvault_logging_enabled(Check):
def execute(self) -> Check_Report_Azure:
findings = []
for subscription, key_vaults in keyvault_client.key_vaults.items():
for subscription_name, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
keyvault_name = keyvault.name
subscription_name = subscription
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription_name
if not keyvault.monitor_diagnostic_settings:
report = Check_Report_Azure(self.metadata())
report.status = "FAIL"
report.subscription = subscription_name
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status_extended = f"There are no diagnostic settings capturing audit logs for Key Vault {keyvault_name} in subscription {subscription_name}."
report.status_extended = f"There are no diagnostic settings capturing audit logs for Key Vault {keyvault.name} in subscription {subscription_name}."
findings.append(report)
else:
for diagnostic_setting in keyvault.monitor_diagnostic_settings:
report = Check_Report_Azure(self.metadata())
report.subscription = subscription_name
report.resource_name = diagnostic_setting.name
report.resource_id = diagnostic_setting.id
report.location = keyvault.location
report.status = "FAIL"
report.status_extended = f"Diagnostic setting {diagnostic_setting.name} for Key Vault {keyvault_name} in subscription {subscription_name} does not have audit logging."
report.status_extended = f"Diagnostic setting {diagnostic_setting.name} for Key Vault {keyvault.name} in subscription {subscription_name} does not have audit logging."
audit = False
allLogs = False
for log in diagnostic_setting.logs:
@@ -37,7 +32,7 @@ class keyvault_logging_enabled(Check):
allLogs = True
if audit and allLogs:
report.status = "PASS"
report.status_extended = f"Diagnostic setting {diagnostic_setting.name} for Key Vault {keyvault_name} in subscription {subscription_name} has audit logging."
report.status_extended = f"Diagnostic setting {diagnostic_setting.name} for Key Vault {keyvault.name} in subscription {subscription_name} has audit logging."
break
findings.append(report)
prowler/providers/azure/services/keyvault/keyvault_non_rbac_secret_expiration_set/keyvault_non_rbac_secret_expiration_set.py
+3 -4
View File
@@ -11,11 +11,10 @@ class keyvault_non_rbac_secret_expiration_set(Check):
not keyvault.properties.enable_rbac_authorization
and keyvault.secrets
):
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "PASS"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the secrets with expiration date set."
has_secret_without_expiration = False
prowler/providers/azure/services/keyvault/keyvault_private_endpoints/keyvault_private_endpoints.py
+3 -4
View File
@@ -7,11 +7,10 @@ class keyvault_private_endpoints(Check):
findings = []
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "FAIL"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not using private endpoints."
if (
prowler/providers/azure/services/keyvault/keyvault_rbac_enabled/keyvault_rbac_enabled.py
+3 -4
View File
@@ -7,11 +7,10 @@ class keyvault_rbac_enabled(Check):
findings = []
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "FAIL"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not using RBAC for access control."
if (
prowler/providers/azure/services/keyvault/keyvault_rbac_key_expiration_set/keyvault_rbac_key_expiration_set.py
+3 -4
View File
@@ -8,11 +8,10 @@ class keyvault_rbac_key_expiration_set(Check):
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
if keyvault.properties.enable_rbac_authorization and keyvault.keys:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "PASS"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the keys with expiration date set."
has_key_without_expiration = False
prowler/providers/azure/services/keyvault/keyvault_rbac_secret_expiration_set/keyvault_rbac_secret_expiration_set.py
+3 -4
View File
@@ -8,11 +8,10 @@ class keyvault_rbac_secret_expiration_set(Check):
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
if keyvault.properties.enable_rbac_authorization and keyvault.secrets:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "PASS"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} has all the secrets with expiration date set."
has_secret_without_expiration = False
prowler/providers/azure/services/keyvault/keyvault_recoverable/keyvault_recoverable.py
+3 -4
View File
@@ -7,11 +7,10 @@ class keyvault_recoverable(Check):
findings = []
for subscription, key_vaults in keyvault_client.key_vaults.items():
for keyvault in key_vaults:
report = Check_Report_Azure(self.metadata())
report = Check_Report_Azure(
metadata=self.metadata(), resource_metadata=keyvault
)
report.subscription = subscription
report.resource_name = keyvault.name
report.resource_id = keyvault.id
report.location = keyvault.location
report.status = "FAIL"
report.status_extended = f"Keyvault {keyvault.name} from subscription {subscription} is not recoverable."
if (
prowler/providers/azure/services/keyvault/keyvault_service.py
-1
View File
@@ -16,7 +16,6 @@ from prowler.providers.azure.services.monitor.monitor_client import monitor_clie
from prowler.providers.azure.services.monitor.monitor_service import DiagnosticSetting
########################## KeyVault
class KeyVault(AzureService):
def __init__(self, provider: AzureProvider):
super().__init__(KeyVaultManagementClient, provider)