fix(sdk): scan every Azure subscription when display names collide (#10718)

Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
authored and GitHub committed 2026-05-07 13:59:38 +02:00
1 parent 71683f3093
commit bcaa6ac488
339 files changed
+3210 -1235

No files matched your search

+34
View File
@@ -1149,6 +1149,40 @@ class TestCheck:
)
assert findings[0].muted is True
def test_execute_azure_mutelist_passes_subscription_id_and_name(self):
"""Test that execute() passes Azure subscription ID and display name."""
subscription_id = "12345678-1234-1234-1234-123456789012"
subscription_name = "subscription_1"
finding = Mock()
finding.status = "PASS"
finding.muted = False
finding.subscription = subscription_id
check = Mock()
check.CheckID = "azure_test_check"
check.execute = Mock(return_value=[finding])
provider = mock.MagicMock()
provider.type = "azure"
provider.identity.subscriptions = {subscription_id: subscription_name}
provider.mutelist.mutelist = {"Accounts": {subscription_name: {}}}
provider.mutelist.is_finding_muted = Mock(return_value=True)
findings = execute(
check=check,
global_provider=provider,
custom_checks_metadata=None,
output_options=None,
)
provider.mutelist.is_finding_muted.assert_called_once_with(
subscription_id=subscription_id,
subscription_name=subscription_name,
finding=finding,
)
assert findings[0].muted is True
def test_execute_check_exception_only_logs(self, caplog):
caplog.set_level(ERROR)
+2 -2
View File
@@ -331,8 +331,8 @@ class TestFinding:
assert finding_output.auth_method == "mock_identity_type: mock_identity_id"
assert finding_output.account_organization_uid == "mock_tenant_id_1"
assert finding_output.account_organization_name == "mock_tenant_domain"
assert finding_output.account_uid == "mock_subscription_name"
assert finding_output.account_name == "mock_subscription_id"
assert finding_output.account_uid == "mock_subscription_id"
assert finding_output.account_name == "mock_subscription_name"
assert finding_output.resource_name == "test_resource_name"
assert finding_output.resource_uid == "test_resource_id"
assert finding_output.region == "us-west-1"
+42
View File
@@ -0,0 +1,42 @@
from types import SimpleNamespace
from prowler.lib.outputs.summary_table import display_summary_table
class TestDisplaySummaryTable:
def test_azure_summary_shows_display_name_and_subscription_id(self, capsys):
provider = SimpleNamespace(
type="azure",
identity=SimpleNamespace(
tenant_domain="tenant.example.com",
tenant_ids=["tenant-id"],
subscriptions={
"subscription-id-1": "Duplicate Subscription",
"subscription-id-2": "Duplicate Subscription",
},
),
)
output_options = SimpleNamespace(
output_directory="out",
output_filename="report",
output_modes=[],
)
findings = [
SimpleNamespace(
status="PASS",
muted=False,
check_metadata=SimpleNamespace(
ServiceName="network",
Provider="azure",
Severity="low",
),
)
]
display_summary_table(findings, provider, output_options)
captured = capsys.readouterr()
assert "Subscriptions scanned:" in captured.out
assert "Duplicate Subscription (subscription-id-1)" in captured.out
assert "Duplicate Subscription (subscription-id-2)" in captured.out
+1
View File
@@ -8,6 +8,7 @@ from prowler.providers.azure.models import AzureIdentityInfo, AzureRegionConfig
AZURE_SUBSCRIPTION_ID = str(uuid4())
AZURE_SUBSCRIPTION_NAME = "Subscription Name"
AZURE_SUBSCRIPTION_DISPLAY = f"{AZURE_SUBSCRIPTION_NAME} ({AZURE_SUBSCRIPTION_ID})"
# Azure Identity
IDENTITY_ID = "00000000-0000-0000-0000-000000000000"
+199 -5
View File
@@ -3,6 +3,7 @@ from uuid import uuid4
import pytest
from azure.core.credentials import AccessToken
from azure.core.exceptions import HttpResponseError
from azure.identity import DefaultAzureCredential
from mock import MagicMock
@@ -432,8 +433,29 @@ class TestAzureProvider:
)
def test_test_connection_with_ClientAuthenticationError(self):
with pytest.raises(AzureHTTPResponseError) as exception:
tenant_id = str(uuid4())
tenant_id = str(uuid4())
error_message = (
"Authentication failed: Unable to get authority configuration for "
f"https://login.microsoftonline.com/{tenant_id}."
)
with (
patch(
"prowler.providers.azure.azure_provider.AzureProvider.setup_session"
) as mock_setup_session,
patch(
"prowler.providers.azure.azure_provider.SubscriptionClient"
) as mock_subscription_client,
pytest.raises(AzureHTTPResponseError) as exception,
):
mock_setup_session.return_value = MagicMock()
mock_client = MagicMock()
mock_client.subscriptions = MagicMock()
mock_client.subscriptions.list.side_effect = HttpResponseError(
message=error_message
)
mock_subscription_client.return_value = mock_client
AzureProvider.test_connection(
browser_auth=True,
tenant_id=tenant_id,
@@ -441,9 +463,8 @@ class TestAzureProvider:
)
assert exception.type == AzureHTTPResponseError
assert (
exception.value.args[0]
== f"[2010] Error in HTTP response from Azure - Authentication failed: Unable to get authority configuration for https://login.microsoftonline.com/{tenant_id}. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant or https://tenant_name.ciamlogin.com or https://tenant_name.b2clogin.com/tenant.onmicrosoft.com/policy. Also please double check your tenant name or GUID is correct."
assert exception.value.args[0] == (
f"[2010] Error in HTTP response from Azure - {error_message}"
)
def test_test_connection_without_any_method(self):
@@ -527,3 +548,176 @@ class TestAzureProvider:
regions = azure_provider.get_regions(subscription_ids=subscription_ids)
assert regions == expected_regions
class TestAzureProviderSetupIdentitySubscriptions:
"""Regression tests ensuring identity.subscriptions preserves every
subscription even when multiple Azure subscriptions share the same
display_name (which is permitted by Azure)."""
@staticmethod
def _mock_subscription(display_name, subscription_id):
mock_subscription = MagicMock()
mock_subscription.display_name = display_name
mock_subscription.subscription_id = subscription_id
return mock_subscription
@staticmethod
def _build_subscriptions_client_mock(list_result=None, get_map=None):
"""Construct a fully explicit SubscriptionClient mock so the tests do
not depend on MagicMock auto-attribute behavior, which makes the suite
sensitive to shared state across test files."""
subscriptions_operations = MagicMock()
subscriptions_operations.list = MagicMock(return_value=list_result or [])
if get_map is not None:
subscriptions_operations.get = MagicMock(
side_effect=lambda subscription_id: get_map[subscription_id]
)
else:
subscriptions_operations.get = MagicMock()
tenants_operations = MagicMock()
tenants_operations.list = MagicMock(return_value=[])
client_instance = MagicMock()
client_instance.subscriptions = subscriptions_operations
client_instance.tenants = tenants_operations
client_class = MagicMock(return_value=client_instance)
return client_class
@staticmethod
def _build_provider():
"""Create an AzureProvider instance ready to invoke setup_identity
with auth flags left False so the AAD lookup branches are skipped and
the test focuses on the subscription resolution logic."""
with patch.object(AzureProvider, "__init__", return_value=None):
azure_provider = AzureProvider()
azure_provider._session = MagicMock()
azure_provider._region_config = AzureRegionConfig(
name="AzureCloud",
authority=None,
base_url="https://management.azure.com",
credential_scopes=["https://management.azure.com/.default"],
)
return azure_provider
def test_setup_identity_auto_discovery_preserves_unique_display_names(self):
first_id = str(uuid4())
second_id = str(uuid4())
client_class = self._build_subscriptions_client_mock(
list_result=[
self._mock_subscription("Unique Name One", first_id),
self._mock_subscription("Unique Name Two", second_id),
]
)
with patch(
"prowler.providers.azure.azure_provider.SubscriptionClient",
client_class,
):
azure_provider = self._build_provider()
identity = azure_provider.setup_identity(
az_cli_auth=False,
sp_env_auth=False,
browser_auth=False,
managed_identity_auth=False,
subscription_ids=[],
client_id=None,
)
assert identity.subscriptions == {
first_id: "Unique Name One",
second_id: "Unique Name Two",
}
def test_setup_identity_auto_discovery_preserves_duplicate_display_names(
self,
):
shared_name = "Shared Display Name"
first_id = str(uuid4())
second_id = str(uuid4())
client_class = self._build_subscriptions_client_mock(
list_result=[
self._mock_subscription(shared_name, first_id),
self._mock_subscription(shared_name, second_id),
]
)
with patch(
"prowler.providers.azure.azure_provider.SubscriptionClient",
client_class,
):
azure_provider = self._build_provider()
identity = azure_provider.setup_identity(
az_cli_auth=False,
sp_env_auth=False,
browser_auth=False,
managed_identity_auth=False,
subscription_ids=[],
client_id=None,
)
assert identity.subscriptions == {
first_id: shared_name,
second_id: shared_name,
}
def test_setup_identity_filtered_preserves_unique_display_names(self):
first_id = str(uuid4())
second_id = str(uuid4())
client_class = self._build_subscriptions_client_mock(
get_map={
first_id: self._mock_subscription("Unique Name One", first_id),
second_id: self._mock_subscription("Unique Name Two", second_id),
}
)
with patch(
"prowler.providers.azure.azure_provider.SubscriptionClient",
client_class,
):
azure_provider = self._build_provider()
identity = azure_provider.setup_identity(
az_cli_auth=False,
sp_env_auth=False,
browser_auth=False,
managed_identity_auth=False,
subscription_ids=[first_id, second_id],
client_id=None,
)
assert identity.subscriptions == {
first_id: "Unique Name One",
second_id: "Unique Name Two",
}
def test_setup_identity_filtered_preserves_duplicate_display_names(self):
shared_name = "Shared Display Name"
first_id = str(uuid4())
second_id = str(uuid4())
client_class = self._build_subscriptions_client_mock(
get_map={
first_id: self._mock_subscription(shared_name, first_id),
second_id: self._mock_subscription(shared_name, second_id),
}
)
with patch(
"prowler.providers.azure.azure_provider.SubscriptionClient",
client_class,
):
azure_provider = self._build_provider()
identity = azure_provider.setup_identity(
az_cli_auth=False,
sp_env_auth=False,
browser_auth=False,
managed_identity_auth=False,
subscription_ids=[first_id, second_id],
client_id=None,
)
assert identity.subscriptions == {
first_id: shared_name,
second_id: shared_name,
}
@@ -64,10 +64,12 @@ class TestAzureMutelist:
finding.status = "FAIL"
finding.resource_name = "test_resource"
finding.resource_tags = {}
finding.subscription = "subscription_1"
finding.subscription = "12345678-1234-1234-1234-123456789012"
assert mutelist.is_finding_muted(
finding, "12345678-1234-1234-1234-123456789012"
finding,
"12345678-1234-1234-1234-123456789012",
"subscription_1",
)
def test_is_finding_muted_subscription_id(self):
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.aisearch.aisearch_service import AISearchService
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_AISearch_service_not_publicly_accessible:
def test_aisearch_sevice_no_aisearch_services(self):
aisearch_client = mock.MagicMock
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aisearch_client.aisearch_services = {}
with (
@@ -35,6 +38,7 @@ class Test_AISearch_service_not_publicly_accessible:
aisearch_service_id = str(uuid4())
aisearch_service_name = "Test AISearch Service"
aisearch_client = mock.MagicMock
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aisearch_client.aisearch_services = {
AZURE_SUBSCRIPTION_ID: {
aisearch_service_id: AISearchService(
@@ -66,7 +70,7 @@ class Test_AISearch_service_not_publicly_accessible:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_ID} allows public access."
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} allows public access."
)
assert result[0].resource_id == aisearch_service_id
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
@@ -77,6 +81,7 @@ class Test_AISearch_service_not_publicly_accessible:
aisearch_service_id = str(uuid4())
aisearch_service_name = "Test Search Service"
aisearch_client = mock.MagicMock
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aisearch_client.aisearch_services = {
AZURE_SUBSCRIPTION_ID: {
aisearch_service_id: AISearchService(
@@ -108,7 +113,7 @@ class Test_AISearch_service_not_publicly_accessible:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_ID} does not allows public access."
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not allows public access."
)
assert result[0].resource_id == aisearch_service_id
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.aks.aks_service import Cluster
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_aks_cluster_rbac_enabled:
def test_aks_no_subscriptions(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {}
with (
@@ -33,6 +36,7 @@ class Test_aks_cluster_rbac_enabled:
def test_aks_subscription_empty(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_aks_cluster_rbac_enabled:
def test_aks_cluster_rbac_enabled(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -91,7 +96,7 @@ class Test_aks_cluster_rbac_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"RBAC is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"RBAC is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "cluster_name"
assert result[0].resource_id == cluster_id
@@ -100,6 +105,7 @@ class Test_aks_cluster_rbac_enabled:
def test_aks_rbac_not_enabled(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -136,7 +142,7 @@ class Test_aks_cluster_rbac_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"RBAC is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"RBAC is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "cluster_name"
assert result[0].resource_id == cluster_id
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.aks.aks_service import Cluster
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_aks_clusters_created_with_private_nodes:
def test_aks_no_subscriptions(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {}
with (
@@ -33,6 +36,7 @@ class Test_aks_clusters_created_with_private_nodes:
def test_aks_subscription_empty(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_aks_clusters_created_with_private_nodes:
def test_aks_cluster_no_private_nodes(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -91,7 +96,7 @@ class Test_aks_clusters_created_with_private_nodes:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -100,6 +105,7 @@ class Test_aks_clusters_created_with_private_nodes:
def test_aks_cluster_private_nodes(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -136,7 +142,7 @@ class Test_aks_clusters_created_with_private_nodes:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Cluster 'cluster_name' was created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Cluster 'cluster_name' was created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -145,6 +151,7 @@ class Test_aks_clusters_created_with_private_nodes:
def test_aks_cluster_public_and_private_nodes(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -185,7 +192,7 @@ class Test_aks_clusters_created_with_private_nodes:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.aks.aks_service import Cluster
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_aks_clusters_public_access_disabled:
def test_aks_no_subscriptions(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {}
with (
@@ -33,6 +36,7 @@ class Test_aks_clusters_public_access_disabled:
def test_aks_subscription_empty(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_aks_clusters_public_access_disabled:
def test_aks_cluster_public_fqdn(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -91,7 +96,7 @@ class Test_aks_clusters_public_access_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -100,6 +105,7 @@ class Test_aks_clusters_public_access_disabled:
def test_aks_cluster_private_fqdn(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -136,7 +142,7 @@ class Test_aks_clusters_public_access_disabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Public access to nodes is disabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Public access to nodes is disabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -145,6 +151,7 @@ class Test_aks_clusters_public_access_disabled:
def test_aks_cluster_private_fqdn_with_public_ip(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -181,7 +188,7 @@ class Test_aks_clusters_public_access_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
)
assert result[0].resource_id == cluster_id
assert result[0].resource_name == "cluster_name"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.aks.aks_service import Cluster
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_aks_network_policy_enabled:
def test_aks_no_subscriptions(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {}
with (
@@ -33,6 +36,7 @@ class Test_aks_network_policy_enabled:
def test_aks_subscription_empty(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_aks_network_policy_enabled:
def test_aks_network_policy_enabled(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -91,7 +96,7 @@ class Test_aks_network_policy_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Network policy is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Network policy is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "cluster_name"
assert result[0].resource_id == cluster_id
@@ -100,6 +105,7 @@ class Test_aks_network_policy_enabled:
def test_aks_network_policy_disabled(self):
aks_client = mock.MagicMock
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cluster_id = str(uuid4())
aks_client.clusters = {
AZURE_SUBSCRIPTION_ID: {
@@ -136,7 +142,7 @@ class Test_aks_network_policy_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Network policy is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Network policy is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "cluster_name"
assert result[0].resource_id == cluster_id
@@ -8,6 +8,7 @@ from azure.monitor.query import LogsQueryResult
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -193,6 +194,9 @@ class Test_APIM_Service(TestCase):
# Properly mock the nested client structure
mock_client = mock.MagicMock()
mock_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
mock_workspaces = mock.MagicMock()
mock_workspaces.get.return_value = mock_workspace
mock_client.workspaces = mock_workspaces
@@ -246,6 +250,9 @@ class Test_APIM_Service(TestCase):
# Properly mock the nested client structure
mock_client = mock.MagicMock()
mock_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
mock_client.query_workspace.return_value = mock_response
mock_logsquery_client.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
@@ -2,7 +2,9 @@ from datetime import datetime
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -139,10 +141,18 @@ def mock_get_llm_operations_logs_no_workspace(subscription, instance, minutes):
return []
def mock_get_llm_operations_logs_by_subscription(subscription, instance, minutes):
"""Return different logs per subscription to validate isolation."""
if subscription == AZURE_SUBSCRIPTION_ID:
return mock_get_llm_operations_logs_attacker(subscription, instance, minutes)
return mock_get_llm_operations_logs_2_operations(subscription, instance, minutes)
class Test_apim_threat_detection_llm_jacking:
def test_no_apim_instances(self):
"""Test when there are no APIM instances"""
apim_client = mock.MagicMock()
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.instances = {}
apim_client.audit_config = {
"apim_threat_detection_llm_jacking_threshold": 0.1,
@@ -175,6 +185,7 @@ class Test_apim_threat_detection_llm_jacking:
def test_no_potential_llm_jacking(self):
"""Test when no potential LLM jacking is detected"""
apim_client = mock.MagicMock()
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.instances = {
AZURE_SUBSCRIPTION_ID: [
mock.MagicMock(
@@ -184,7 +195,7 @@ class Test_apim_threat_detection_llm_jacking:
)
]
}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.audit_config = {
"apim_threat_detection_llm_jacking_threshold": 0.9,
"apim_threat_detection_llm_jacking_minutes": 1440,
@@ -240,6 +251,7 @@ class Test_apim_threat_detection_llm_jacking:
def test_potential_llm_jacking_detected(self):
"""Test when potential LLM jacking is detected"""
apim_client = mock.MagicMock()
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.instances = {
AZURE_SUBSCRIPTION_ID: [
mock.MagicMock(
@@ -286,6 +298,7 @@ class Test_apim_threat_detection_llm_jacking:
"Potential LLM Jacking attack detected from IP address 10.0.0.50"
in result[0].status_extended
)
assert AZURE_SUBSCRIPTION_DISPLAY in result[0].status_extended
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource["name"] == "10.0.0.50"
assert result[0].resource["id"] == "10.0.0.50"
@@ -293,6 +306,7 @@ class Test_apim_threat_detection_llm_jacking:
def test_higher_threshold_no_detection(self):
"""Test when threshold is higher and no attack is detected"""
apim_client = mock.MagicMock()
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.instances = {
AZURE_SUBSCRIPTION_ID: [
mock.MagicMock(
@@ -302,7 +316,7 @@ class Test_apim_threat_detection_llm_jacking:
)
]
}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.audit_config = {
"apim_threat_detection_llm_jacking_threshold": 0.9,
"apim_threat_detection_llm_jacking_minutes": 1440,
@@ -367,7 +381,7 @@ class Test_apim_threat_detection_llm_jacking:
)
]
}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.audit_config = {
"apim_threat_detection_llm_jacking_threshold": 0.9,
"apim_threat_detection_llm_jacking_minutes": 1440,
@@ -423,6 +437,7 @@ class Test_apim_threat_detection_llm_jacking:
def test_multiple_subscriptions(self):
"""Test with multiple subscriptions"""
apim_client = mock.MagicMock()
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
apim_client.instances = {
AZURE_SUBSCRIPTION_ID: [
mock.MagicMock(
@@ -440,7 +455,7 @@ class Test_apim_threat_detection_llm_jacking:
],
}
apim_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
"another-subscription": "another-subscription-id",
}
apim_client.audit_config = {
@@ -496,3 +511,90 @@ class Test_apim_threat_detection_llm_jacking:
"No potential LLM Jacking attacks detected"
in report.status_extended
)
def test_multiple_subscriptions_keep_findings_isolated(self):
"""Ensure findings from one subscription do not leak into another."""
apim_client = mock.MagicMock()
second_subscription_id = "another-subscription"
second_subscription_name = "another-subscription-id"
apim_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
second_subscription_id: second_subscription_name,
}
apim_client.instances = {
AZURE_SUBSCRIPTION_ID: [
mock.MagicMock(
id="/subscriptions/test-sub/resourceGroups/test-rg/providers/Microsoft.ApiManagement/service/test-apim",
name="test-apim",
log_analytics_workspace_id="/subscriptions/test-sub/resourceGroups/test-rg/providers/Microsoft.OperationalInsights/workspaces/test-workspace",
)
],
second_subscription_id: [
mock.MagicMock(
id="/subscriptions/another-sub/resourceGroups/test-rg/providers/Microsoft.ApiManagement/service/another-apim",
name="another-apim",
log_analytics_workspace_id="/subscriptions/another-sub/resourceGroups/test-rg/providers/Microsoft.OperationalInsights/workspaces/another-workspace",
)
],
}
apim_client.audit_config = {
"apim_threat_detection_llm_jacking_threshold": 0.2,
"apim_threat_detection_llm_jacking_minutes": 1440,
"apim_threat_detection_llm_jacking_actions": [
"ChatCompletions_Create",
"ImageGenerations_Create",
"Completions_Create",
"Embeddings_Create",
"FineTuning_Jobs_Create",
"Models_List",
"Deployments_List",
"Deployments_Get",
"Deployments_Create",
"Deployments_Delete",
"Messages_Create",
"Claude_Create",
"GenerateContent",
"GenerateText",
"GenerateImage",
"Llama_Create",
"CodeLlama_Create",
"Gemini_Generate",
"Claude_Generate",
"Llama_Generate",
],
}
apim_client.get_llm_operations_logs = (
mock_get_llm_operations_logs_by_subscription
)
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.apim.apim_threat_detection_llm_jacking.apim_threat_detection_llm_jacking.apim_client",
new=apim_client,
),
):
from prowler.providers.azure.services.apim.apim_threat_detection_llm_jacking.apim_threat_detection_llm_jacking import (
apim_threat_detection_llm_jacking,
)
check = apim_threat_detection_llm_jacking()
result = check.execute()
assert len(result) == 2
report_by_subscription = {report.subscription: report for report in result}
assert report_by_subscription[AZURE_SUBSCRIPTION_ID].status == "FAIL"
assert (
AZURE_SUBSCRIPTION_DISPLAY
in report_by_subscription[AZURE_SUBSCRIPTION_ID].status_extended
)
assert report_by_subscription[second_subscription_id].status == "PASS"
assert (
f"{second_subscription_name} ({second_subscription_id})"
in report_by_subscription[second_subscription_id].status_extended
)
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_client_certificates_on:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_client_certificates_on:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_client_certificates_on:
def test_app_client_certificates_on(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_client_certificates_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Clients are required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Clients are required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -101,6 +106,7 @@ class Test_app_client_certificates_on:
def test_app_client_certificates_off(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_client_certificates_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Clients are not required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Clients are not required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_auth_is_set_up:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_auth_is_set_up:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_auth_is_set_up:
def test_app_auth_enabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_ensure_auth_is_set_up:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Authentication is set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Authentication is set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "app_id-1"
assert result[0].resource_id == resource_id
@@ -101,6 +106,7 @@ class Test_app_ensure_auth_is_set_up:
def test_app_auth_disabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_ensure_auth_is_set_up:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Authentication is not set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Authentication is not set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "app_id-1"
assert result[0].resource_id == resource_id
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_http_is_redirected_to_https:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_http_is_redirected_to_https:
def test_app_subscriptions_empty_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_http_is_redirected_to_https:
def test_app_http_to_https(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_ensure_http_is_redirected_to_https:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"HTTP is not redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"HTTP is not redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "app_id-1"
assert result[0].resource_id == resource_id
@@ -101,6 +106,7 @@ class Test_app_ensure_http_is_redirected_to_https:
def test_app_http_to_https_enabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_ensure_http_is_redirected_to_https:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"HTTP is redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"HTTP is redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_name == "app_id-1"
assert result[0].resource_id == resource_id
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_java_version_is_latest:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_configurations_none(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -92,6 +97,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_linux_java_version_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"java_latest_version": "17"}
@@ -132,7 +138,7 @@ class Test_app_ensure_java_version_is_latest:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -142,6 +148,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_linux_java_version_not_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"java_latest_version": "17"}
@@ -182,7 +189,7 @@ class Test_app_ensure_java_version_is_latest:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Java version is set to 'Tomcat|9.0-java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Java version is set to 'Tomcat|9.0-java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -192,6 +199,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_windows_java_version_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"java_latest_version": "17"}
@@ -232,7 +240,7 @@ class Test_app_ensure_java_version_is_latest:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -242,6 +250,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_windows_java_version_not_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"java_latest_version": "17"}
with (
@@ -281,7 +290,7 @@ class Test_app_ensure_java_version_is_latest:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Java version is set to 'java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Java version is set to 'java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -291,6 +300,7 @@ class Test_app_ensure_java_version_is_latest:
def test_app_linux_php_version_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"java_latest_version": "17"}
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_php_version_is_latest:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_php_version_is_latest:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_php_version_is_latest:
def test_app_configurations_none(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -92,6 +97,7 @@ class Test_app_ensure_php_version_is_latest:
def test_app_php_version_not_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"php_latest_version": "8.2"}
@@ -130,7 +136,7 @@ class Test_app_ensure_php_version_is_latest:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"PHP version is set to 'php|8.0', the latest version that you could use is the '8.2' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"PHP version is set to 'php|8.0', the latest version that you could use is the '8.2' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -140,6 +146,7 @@ class Test_app_ensure_php_version_is_latest:
def test_app_php_version_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"php_latest_version": "8.2"}
@@ -178,7 +185,7 @@ class Test_app_ensure_php_version_is_latest:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"PHP version is set to '8.2' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"PHP version is set to '8.2' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_python_version_is_latest:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_python_version_is_latest:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_python_version_is_latest:
def test_app_configurations_none(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -91,6 +96,7 @@ class Test_app_ensure_python_version_is_latest:
def test_app_python_version_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"python_latest_version": "3.12"}
@@ -129,7 +135,7 @@ class Test_app_ensure_python_version_is_latest:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Python version is set to '3.12' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Python version is set to '3.12' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -139,6 +145,7 @@ class Test_app_ensure_python_version_is_latest:
def test_app_python_version_not_latest(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.audit_config = {"python_latest_version": "3.12"}
@@ -177,7 +184,7 @@ class Test_app_ensure_python_version_is_latest:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Python version is 'python|3.10', the latest version that you could use is the '3.12' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Python version is 'python|3.10', the latest version that you could use is the '3.12' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ensure_using_http20:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ensure_using_http20:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ensure_using_http20:
def test_app_configurations_none(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_ensure_using_http20:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -101,6 +106,7 @@ class Test_app_ensure_using_http20:
def test_app_http20_enabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_ensure_using_http20:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"HTTP/2.0 is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"HTTP/2.0 is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -147,6 +153,7 @@ class Test_app_ensure_using_http20:
def test_app_http20_not_enabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -183,7 +190,7 @@ class Test_app_ensure_using_http20:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_ftp_deployment_disabled:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_ftp_deployment_disabled:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_ftp_deployment_disabled:
def test_app_configurations_none(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_ftp_deployment_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -101,6 +106,7 @@ class Test_app_ftp_deployment_disabled:
def test_app_ftp_deployment_disabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_ftp_deployment_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -147,6 +153,7 @@ class Test_app_ftp_deployment_disabled:
def test_app_ftp_deploy_enabled(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -183,7 +190,7 @@ class Test_app_ftp_deployment_disabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"FTP is disabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"FTP is disabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_access_keys_configured:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_access_keys_configured:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_function_access_keys_configured:
def test_app_function_no_keys(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -98,7 +103,7 @@ class Test_app_function_access_keys_configured:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 does not have function keys configured."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have function keys configured."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -107,6 +112,7 @@ class Test_app_function_access_keys_configured:
def test_app_function_using_functions_keys(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -153,7 +159,7 @@ class Test_app_function_access_keys_configured:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 has function keys configured."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has function keys configured."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_application_insights_enabled:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_application_insights_enabled:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_application_insights_enabled:
def test_app_function_no_app_insights(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -97,7 +102,7 @@ class Test_app_function_application_insights_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 is not using Application Insights."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using Application Insights."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -106,6 +111,7 @@ class Test_app_function_application_insights_enabled:
def test_app_function_using_app_insights(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -147,7 +153,7 @@ class Test_app_function_application_insights_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 is using Application Insights."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using Application Insights."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -156,6 +162,7 @@ class Test_app_function_application_insights_enabled:
def test_app_function_using_app_insights_different_key(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -197,7 +204,7 @@ class Test_app_function_application_insights_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 is using Application Insights."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using Application Insights."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -206,6 +213,7 @@ class Test_app_function_application_insights_enabled:
def test_app_function_with_app_insights_no_key(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -247,7 +255,7 @@ class Test_app_function_application_insights_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 is not using Application Insights."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using Application Insights."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_ftps_deployment_disabled:
def test_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_ftps_deployment_disabled:
def test_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_ftps_deployment_disabled:
def test_function_ftp_deployment_enabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -97,7 +102,7 @@ class Test_app_function_ftps_deployment_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 has FTP deployment enabled"
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTP deployment enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -106,6 +111,7 @@ class Test_app_function_ftps_deployment_disabled:
def test_function_ftps_deployment_enabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -147,7 +153,7 @@ class Test_app_function_ftps_deployment_disabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 has FTPS deployment enabled"
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTPS deployment enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -156,6 +162,7 @@ class Test_app_function_ftps_deployment_disabled:
def test_function_ftp_and_ftps_deployment_disabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -197,7 +204,7 @@ class Test_app_function_ftps_deployment_disabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 has FTP and FTPS deployment disabled"
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTP and FTPS deployment disabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_identity_is_configured:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_identity_is_configured:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_identity_is_configured:
def test_app_function_no_identity(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -97,7 +102,7 @@ class Test_app_function_identity_is_configured:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 does not have a managed identity enabled."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a managed identity enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -106,6 +111,7 @@ class Test_app_function_identity_is_configured:
def test_app_function_identity_configured(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -147,7 +153,7 @@ class Test_app_function_identity_is_configured:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 has a SystemAssigned identity enabled."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a SystemAssigned identity enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.config import USER_ACCESS_ADMINISTRATOR_ROLE_ID
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_identity_without_admin_privileges:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -34,6 +37,7 @@ class Test_app_function_identity_without_admin_privileges:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -57,6 +61,7 @@ class Test_app_function_identity_without_admin_privileges:
def test_app_function_no_identity(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -98,7 +103,9 @@ class Test_app_function_identity_without_admin_privileges:
def test_app_function_no_admin_roles(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -175,7 +182,7 @@ class Test_app_function_identity_without_admin_privileges:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 has a managed identity enabled but without admin privileges."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a managed identity enabled but without admin privileges."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -184,7 +191,9 @@ class Test_app_function_identity_without_admin_privileges:
def test_app_function_admin_roles(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -212,7 +221,7 @@ class Test_app_function_identity_without_admin_privileges:
function_id = str(uuid4())
function_scope = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg/providers/Microsoft.Web/sites/function1"
app_client.functions = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
function_id: FunctionApp(
id=function_id,
name="function1",
@@ -229,11 +238,11 @@ class Test_app_function_identity_without_admin_privileges:
}
iam_client.subscriptions = {
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
}
iam_client.role_assignments = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
"role-assignment-id-2": RoleAssignment(
id="role-assignment-id-2",
name="role-assignment-name-2",
@@ -246,7 +255,7 @@ class Test_app_function_identity_without_admin_privileges:
}
iam_client.roles = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{USER_ACCESS_ADMINISTRATOR_ROLE_ID}": Role(
id=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{USER_ACCESS_ADMINISTRATOR_ROLE_ID}",
name="User Access Administrator",
@@ -263,9 +272,9 @@ class Test_app_function_identity_without_admin_privileges:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 has a managed identity enabled and it is configure with admin privileges using role User Access Administrator."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a managed identity enabled and it is configure with admin privileges using role User Access Administrator."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
assert result[0].subscription == "subscription-name-1"
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].location == "West Europe"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_latest_runtime_version:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_latest_runtime_version:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_latest_runtime_version:
def test_app_function_runtime_is_latest(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -96,7 +101,7 @@ class Test_app_function_latest_runtime_version:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
"Function function1 is using the latest runtime."
f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using the latest runtime."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -105,6 +110,7 @@ class Test_app_function_latest_runtime_version:
def test_app_function_runtime_is_not_latest(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -145,7 +151,7 @@ class Test_app_function_latest_runtime_version:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == (
"Function function1 is not using the latest runtime. The current runtime is '2' and should be '~4'."
f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using the latest runtime. The current runtime is '2' and should be '~4'."
)
assert result[0].resource_id == function_id
assert result[0].resource_name == "function1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_not_publicly_accessible:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_not_publicly_accessible:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_not_publicly_accessible:
def test_app_function_not_publicly_accessible(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -97,7 +102,7 @@ class Test_app_function_not_publicly_accessible:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 is not publicly accessible."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not publicly accessible."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -106,6 +111,7 @@ class Test_app_function_not_publicly_accessible:
def test_app_function_publicly_accessible(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -147,7 +153,7 @@ class Test_app_function_not_publicly_accessible:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 is publicly accessible."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is publicly accessible."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_function_vnet_integration_enabled:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -33,6 +36,7 @@ class Test_app_function_vnet_integration_enabled:
def test_app_subscription_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -56,6 +60,7 @@ class Test_app_function_vnet_integration_enabled:
def test_app_function_vnet_integration_enabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -97,14 +102,16 @@ class Test_app_function_vnet_integration_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Function function1 has Virtual Network integration enabled with subnet 'vnet_subnet_id' enabled."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has Virtual Network integration enabled with subnet 'vnet_subnet_id' enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
assert result[0].location == "West Europe"
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
def test_app_function_vnet_integration_disabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -146,8 +153,9 @@ class Test_app_function_vnet_integration_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== "Function function1 does not have virtual network integration enabled."
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have virtual network integration enabled."
)
assert result[0].resource_name == "function1"
assert result[0].resource_id == function_id
assert result[0].location == "West Europe"
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ class Test_app_http_logs_enabled:
def test_app_http_logs_enabled_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -33,6 +36,7 @@ class Test_app_http_logs_enabled:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_http_logs_enabled:
def test_no_diagnostics_settings(self):
app_client = mock.MagicMock()
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -93,12 +98,13 @@ class Test_app_http_logs_enabled:
assert result[0].resource_id == "resource_id"
assert (
result[0].status_extended
== f"App app1 does not have a diagnostic setting in subscription {AZURE_SUBSCRIPTION_ID}."
== f"App app1 does not have a diagnostic setting in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
def test_diagnostic_setting_configured(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -233,11 +239,12 @@ class Test_app_http_logs_enabled:
assert result[0].resource_id == "resource_id2"
assert (
result[0].status_extended
== f"App app_id-2 has HTTP Logs enabled in diagnostic setting name_diagnostic_setting2 in subscription {AZURE_SUBSCRIPTION_ID}"
== f"App app_id-2 has HTTP Logs enabled in diagnostic setting name_diagnostic_setting2 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
def test_diagnostic_setting_with_all_logs_category_group(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -296,11 +303,12 @@ class Test_app_http_logs_enabled:
assert result[0].resource_id == "resource_id3"
assert (
result[0].status_extended
== f"App app_id-3 has allLogs category group which includes HTTP Logs enabled in diagnostic setting name_diagnostic_setting3 in subscription {AZURE_SUBSCRIPTION_ID}"
== f"App app_id-3 has allLogs category group which includes HTTP Logs enabled in diagnostic setting name_diagnostic_setting3 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
def test_diagnostic_setting_with_all_logs_category_group_disabled(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -359,5 +367,5 @@ class Test_app_http_logs_enabled:
assert result[0].resource_id == "resource_id4"
assert (
result[0].status_extended
== f"App app_id-4 does not have HTTP Logs enabled in diagnostic setting name_diagnostic_setting4 in subscription {AZURE_SUBSCRIPTION_ID}"
== f"App app_id-4 does not have HTTP Logs enabled in diagnostic setting name_diagnostic_setting4 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_minimum_tls_version_12:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_minimum_tls_version_12:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_minimum_tls_version_12:
def test_app_none_configurations(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_minimum_tls_version_12:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -101,6 +106,7 @@ class Test_app_minimum_tls_version_12:
def test_app_min_tls_version_12(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_minimum_tls_version_12:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Minimum TLS version is set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Minimum TLS version is set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -147,6 +153,7 @@ class Test_app_minimum_tls_version_12:
def test_app_min_tls_version_10(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -183,7 +190,7 @@ class Test_app_minimum_tls_version_12:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -193,6 +200,7 @@ class Test_app_minimum_tls_version_12:
def test_app_min_tls_version_13(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -229,7 +237,7 @@ class Test_app_minimum_tls_version_12:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Minimum TLS version is set to 1.3 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Minimum TLS version is set to 1.3 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_app_register_with_identity:
def test_app_no_subscriptions(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {}
with (
@@ -32,6 +35,7 @@ class Test_app_register_with_identity:
def test_app_subscriptions_empty(self):
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_app_register_with_identity:
def test_app_none_configurations(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -91,7 +96,7 @@ class Test_app_register_with_identity:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}' does not have an identity configured."
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}' does not have an identity configured."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -101,6 +106,7 @@ class Test_app_register_with_identity:
def test_app_identity(self):
resource_id = f"/subscriptions/{uuid4()}"
app_client = mock.MagicMock
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -137,7 +143,7 @@ class Test_app_register_with_identity:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}' has an identity configured."
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}' has an identity configured."
)
assert result[0].resource_id == resource_id
assert result[0].resource_name == "app_id-1"
@@ -2,7 +2,9 @@ from unittest import mock
from prowler.providers.azure.services.appinsights.appinsights_service import Component
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_appinsights_ensure_is_configured:
def test_appinsights_no_subscriptions(self):
appinsights_client = mock.MagicMock
appinsights_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
appinsights_client.components = {}
with (
@@ -34,7 +39,7 @@ class Test_appinsights_ensure_is_configured:
appinsights_client = mock.MagicMock
appinsights_client.components = {AZURE_SUBSCRIPTION_ID: {}}
appinsights_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
with (
@@ -60,7 +65,7 @@ class Test_appinsights_ensure_is_configured:
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
assert (
result[0].status_extended
== f"There are no AppInsight configured in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There are no AppInsight configured in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_appinsights_configured(self):
@@ -76,7 +81,7 @@ class Test_appinsights_ensure_is_configured:
}
}
appinsights_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
with (
@@ -103,5 +108,5 @@ class Test_appinsights_ensure_is_configured:
assert result[0].location == "global"
assert (
result[0].status_extended
== f"There is at least one AppInsight configured in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is at least one AppInsight configured in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
class TestContainerRegistryAdminUserDisabled:
def test_no_container_registries(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -33,6 +38,9 @@ class TestContainerRegistryAdminUserDisabled:
def test_container_registry_admin_user_enabled(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
registry_id = str(uuid4())
with (
@@ -76,7 +84,7 @@ class TestContainerRegistryAdminUserDisabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} has its admin user enabled."
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} has its admin user enabled."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -90,6 +98,9 @@ class TestContainerRegistryAdminUserDisabled:
def test_container_registry_admin_user_disabled(self):
containerregistry_client = mock.MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -135,7 +146,7 @@ class TestContainerRegistryAdminUserDisabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} has its admin user disabled."
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} has its admin user disabled."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_containerregistry_not_publicly_accessible:
def test_no_container_registries(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -33,6 +38,9 @@ class Test_containerregistry_not_publicly_accessible:
def test_container_registry_network_access_unrestricted(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
registry_id = str(uuid4())
with (
@@ -93,7 +101,7 @@ class Test_containerregistry_not_publicly_accessible:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_ID} allows unrestricted network access."
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} allows unrestricted network access."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -107,6 +115,9 @@ class Test_containerregistry_not_publicly_accessible:
def test_container_registry_network_access_restricted(self):
containerregistry_client = mock.MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -168,7 +179,7 @@ class Test_containerregistry_not_publicly_accessible:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_ID} does not allow unrestricted network access."
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not allow unrestricted network access."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_containerregistry_uses_private_link:
def test_no_container_registries(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -33,6 +38,9 @@ class Test_containerregistry_uses_private_link:
def test_container_registry_not_uses_private_link(self):
containerregistry_client = MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
registry_id = str(uuid4())
with (
@@ -76,7 +84,7 @@ class Test_containerregistry_uses_private_link:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} does not use a private link."
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not use a private link."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -90,6 +98,9 @@ class Test_containerregistry_uses_private_link:
def test_container_registry_uses_private_link(self):
containerregistry_client = mock.MagicMock()
containerregistry_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
containerregistry_client.registries = {}
with (
@@ -141,7 +152,7 @@ class Test_containerregistry_uses_private_link:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} uses a private link."
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} uses a private link."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "mock_registry"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_cosmosdb_account_firewall_use_selected_networks:
def test_no_accounts(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cosmosdb_client.accounts = {}
with (
@@ -33,6 +36,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
def test_accounts_no_virtual_network_filter_enabled(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -71,7 +75,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} has firewall rules that allow access from all networks."
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has firewall rules that allow access from all networks."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -80,6 +84,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
def test_accounts_virtual_network_filter_enabled(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -118,7 +123,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} has firewall rules that allow access only from selected networks."
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has firewall rules that allow access only from selected networks."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_cosmosdb_account_use_aad_and_rbac:
def test_no_accounts(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cosmosdb_client.accounts = {}
with (
@@ -33,6 +36,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
def test_accounts_disable_local_auth_false(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -71,7 +75,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using AAD and RBAC"
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using AAD and RBAC"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -80,6 +84,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
def test_accounts_disable_local_auth_true(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -118,7 +123,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is using AAD and RBAC"
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using AAD and RBAC"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -5,7 +5,9 @@ from azure.mgmt.cosmosdb.models import PrivateEndpointConnection
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_cosmosdb_account_use_private_endpoints:
def test_no_accounts(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
cosmosdb_client.accounts = {}
with (
@@ -35,6 +38,7 @@ class Test_cosmosdb_account_use_private_endpoints:
def test_accounts_no_private_endpoints_connections(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -73,7 +77,7 @@ class Test_cosmosdb_account_use_private_endpoints:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using private endpoints connections"
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using private endpoints connections"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -82,6 +86,7 @@ class Test_cosmosdb_account_use_private_endpoints:
def test_accounts_private_endpoints_connections(self):
cosmosdb_client = mock.MagicMock
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
account_name = "Account Name"
account_id = str(uuid4())
cosmosdb_client.accounts = {
@@ -124,7 +129,7 @@ class Test_cosmosdb_account_use_private_endpoints:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is using private endpoints connections"
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using private endpoints connections"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == account_name
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.databricks.databricks_service import (
ManagedDiskEncryption,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_databricks_workspace_cmk_encryption_enabled:
def test_no_databricks_workspaces(self):
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {}
with (
@@ -39,6 +44,9 @@ class Test_databricks_workspace_cmk_encryption_enabled:
workspace_name = "test-workspace"
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {
AZURE_SUBSCRIPTION_ID: {
workspace_id: DatabricksWorkspace(
@@ -71,7 +79,7 @@ class Test_databricks_workspace_cmk_encryption_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} does not have customer-managed key (CMK) encryption enabled."
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have customer-managed key (CMK) encryption enabled."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == workspace_name
@@ -86,6 +94,9 @@ class Test_databricks_workspace_cmk_encryption_enabled:
key_vault_uri = "test-vault-uri"
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {
AZURE_SUBSCRIPTION_ID: {
workspace_id: DatabricksWorkspace(
@@ -122,7 +133,7 @@ class Test_databricks_workspace_cmk_encryption_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} has customer-managed key (CMK) encryption enabled with key {key_vault_uri}/{key_name}/{key_version}."
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has customer-managed key (CMK) encryption enabled with key {key_vault_uri}/{key_name}/{key_version}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == workspace_name
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.databricks.databricks_service import (
DatabricksWorkspace,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -13,6 +15,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_databricks_workspace_vnet_injection_enabled:
def test_databricks_no_workspaces(self):
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {}
with (
@@ -37,6 +42,9 @@ class Test_databricks_workspace_vnet_injection_enabled:
workspace_id = str(uuid4())
workspace_name = "test-workspace"
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {
AZURE_SUBSCRIPTION_ID: {
workspace_id: DatabricksWorkspace(
@@ -68,7 +76,7 @@ class Test_databricks_workspace_vnet_injection_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} is not deployed in a customer-managed VNet (VNet Injection is not enabled)."
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} is not deployed in a customer-managed VNet (VNet Injection is not enabled)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == workspace_name
@@ -80,6 +88,9 @@ class Test_databricks_workspace_vnet_injection_enabled:
workspace_name = "test-workspace"
vnet_id = "test-vnet-id"
databricks_client = mock.MagicMock
databricks_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
databricks_client.workspaces = {
AZURE_SUBSCRIPTION_ID: {
workspace_id: DatabricksWorkspace(
@@ -111,7 +122,7 @@ class Test_databricks_workspace_vnet_injection_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} is deployed in a customer-managed VNet ({vnet_id})."
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} is deployed in a customer-managed VNet ({vnet_id})."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == workspace_name
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
SecurityContactConfiguration,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
with (
@@ -37,6 +40,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_no_additional_emails(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -74,7 +78,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"There is not another correct email configured for subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not another correct email configured for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -83,6 +87,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
def test_defender_additional_email_configured(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -120,7 +125,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"There is another correct email configured for subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is another correct email configured for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Assesment
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
with (
@@ -33,6 +36,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_subscriptions_with_no_assessments(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
def test_defender_subscriptions_with_healthy_assessments(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
resource_id = str(uuid4())
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -86,13 +91,14 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Endpoint protection is set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Endpoint protection is set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].resource_name == "vm1"
assert result[0].resource_id == resource_id
def test_defender_subscriptions_with_unhealthy_assessments(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
resource_id = str(uuid4())
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
@@ -124,7 +130,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Endpoint protection is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Endpoint protection is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].resource_name == "vm1"
assert result[0].resource_id == resource_id
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
SecurityContactConfiguration,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_attack_path_notifications_properly_configured:
def test_no_subscriptions(self):
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
defender_client.audit_config = {}
with (
@@ -38,6 +41,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -74,7 +78,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == (
f"Attack path notifications are not enabled in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are not enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -85,6 +89,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -123,7 +128,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -134,6 +139,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -172,7 +178,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -183,6 +189,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -219,7 +226,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level Low in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level Low in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -230,6 +237,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -266,7 +274,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -277,6 +285,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -313,7 +322,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level High in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level High in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -324,6 +333,7 @@ class Test_defender_attack_path_notifications_properly_configured:
resource_id = str(uuid4())
contact_name = "default"
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -360,7 +370,7 @@ class Test_defender_attack_path_notifications_properly_configured:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == (
f"Attack path notifications are enabled with minimal risk level Critical in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
f"Attack path notifications are enabled with minimal risk level Critical in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == contact_name
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.defender.defender_service import (
AutoProvisioningSetting,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {}
with (
@@ -36,6 +39,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
"default": AutoProvisioningSetting(
@@ -67,7 +71,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF."
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -76,6 +80,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_on(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
"default": AutoProvisioningSetting(
@@ -107,7 +112,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to ON."
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -116,6 +121,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
def test_defender_auto_provisioning_log_analytics_on_and_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.auto_provisioning_settings = {
AZURE_SUBSCRIPTION_ID: {
"default": AutoProvisioningSetting(
@@ -153,7 +159,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to ON."
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -162,7 +168,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
assert result[1].status == "FAIL"
assert (
result[1].status_extended
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF."
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF."
)
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
assert result[1].resource_name == "default2"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Assesment
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_machines_no_vulnerability_assessment_solution(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Machines should have a vulnerability assessment solution": Assesment(
@@ -64,7 +68,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Vulnerability assessment is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Vulnerability assessment is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -73,6 +77,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
def test_defender_machines_vulnerability_assessment_solution(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Machines should have a vulnerability assessment solution": Assesment(
@@ -103,7 +108,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Vulnerability assessment is set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Vulnerability assessment is set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Assesment
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
with (
@@ -33,6 +36,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_empty(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -55,6 +59,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_no_assesment(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"": Assesment(
@@ -85,6 +90,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
def test_defender_subscription_assesment_unhealthy(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
@@ -128,11 +134,12 @@ class Test_defender_container_images_resolved_vulnerabilities:
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
result[0].status_extended
== f"Azure running container images have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Azure running container images have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
def test_defender_subscription_assesment_healthy(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
@@ -176,11 +183,12 @@ class Test_defender_container_images_resolved_vulnerabilities:
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
result[0].status_extended
== f"Azure running container images do not have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_ID}'."
== f"Azure running container images do not have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
)
def test_defender_subscription_assesment_not_applicable(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
@@ -4,7 +4,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_container_images_scan_enabled:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_empty(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -56,6 +60,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_no_containers(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"NotContainers": Pricing(
@@ -87,6 +92,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_no_extensions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Containers": Pricing(
@@ -118,7 +124,7 @@ class Test_defender_container_images_scan_enabled:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == (
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_ID}."
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert (
result[0].resource_id
@@ -131,6 +137,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_container_images_scan_off(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Containers": Pricing(
@@ -162,7 +169,7 @@ class Test_defender_container_images_scan_enabled:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == (
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_ID}."
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert (
result[0].resource_id
@@ -175,6 +182,7 @@ class Test_defender_container_images_scan_enabled:
def test_defender_subscription_containers_container_images_scan_on(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Containers": Pricing(
@@ -206,7 +214,7 @@ class Test_defender_container_images_scan_enabled:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == (
f"Container image scan is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
f"Container image scan is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert (
result[0].resource_id
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_app_services_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"AppServices": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan App Services"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
def test_defender_app_services_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"AppServices": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan App Services"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_no_arm(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_arm_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Arm": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan ARM"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
def test_defender_arm_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Arm": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan ARM"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_no_sql_databases(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_sql_databases_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServers": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
def test_defender_sql_databases_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServers": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_no_container_registries(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_container_registries_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Containers": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
def test_defender_container_registries_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Containers": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_no_cosmosdb(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_cosmosdb_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"CosmosDbs": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Cosmos DB"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
def test_defender_cosmosdb_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"CosmosDbs": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Cosmos DB"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_no_databases(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_sql_servers(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServers": Pricing(
@@ -66,6 +70,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_sql_server_virtual_machines(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServerVirtualMachines": Pricing(
@@ -98,6 +103,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_open_source_relation_databases(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"OpenSourceRelationalDatabases": Pricing(
@@ -130,6 +136,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_cosmosdbs(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"CosmosDbs": Pricing(
@@ -162,6 +169,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_all_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServers": Pricing(
@@ -211,7 +219,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -220,6 +228,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
def test_defender_databases_cosmosdb_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServers": Pricing(
@@ -269,7 +278,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_no_dns(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_dns_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Dns": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan DNS"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
def test_defender_dns_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"Dns": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan DNS"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_no_keyvaults(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_keyvaults_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"KeyVaults": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan KeyVaults"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
def test_defender_keyvaults_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"KeyVaults": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan KeyVaults"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_no_os_relational_databases(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_os_relational_databases_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"OpenSourceRelationalDatabases": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -77,6 +81,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
def test_defender_os_relational_databases_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"OpenSourceRelationalDatabases": Pricing(
@@ -108,7 +113,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_server_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_server_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"VirtualMachines": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_server_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_server_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"VirtualMachines": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_server_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Servers"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServerVirtualMachines": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan SQL Server VMs"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"SqlServerVirtualMachines": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan SQL Server VMs"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Pricing
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_no_server(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_server_pricing_tier_not_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"StorageAccounts": Pricing(
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Storage Accounts"
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
def test_defender_server_pricing_tier_standard(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.pricings = {
AZURE_SUBSCRIPTION_ID: {
"StorageAccounts": Pricing(
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "Defender plan Storage Accounts"
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.defender.defender_service import (
IoTSecuritySolution,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {}
with (
@@ -36,7 +39,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_no_iot_hub_solutions(self):
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -58,7 +61,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"No IoT Security Solutions found in the subscription {AZURE_SUBSCRIPTION_ID}."
== f"No IoT Security Solutions found in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
@@ -66,6 +69,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_iot_hub_solution_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
resource_id: IoTSecuritySolution(
@@ -94,7 +98,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"The security solution iot_sec_solution is disabled in subscription {AZURE_SUBSCRIPTION_ID}"
== f"The security solution iot_sec_solution is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
assert result[0].resource_name == "iot_sec_solution"
assert result[0].resource_id == resource_id
@@ -102,6 +106,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
def test_defender_iot_hub_solution_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
resource_id: IoTSecuritySolution(
@@ -130,7 +135,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"The security solution iot_sec_solution is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
== f"The security solution iot_sec_solution is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].resource_name == "iot_sec_solution"
assert result[0].resource_id == resource_id
@@ -140,6 +145,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
resource_id_enabled = str(uuid4())
resource_id_disabled = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
resource_id_enabled: IoTSecuritySolution(
@@ -175,7 +181,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"The security solution iot_sec_solution_enabled is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
== f"The security solution iot_sec_solution_enabled is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].resource_name == "iot_sec_solution_enabled"
assert result[0].resource_id == resource_id_enabled
@@ -184,7 +190,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
assert result[1].status == "FAIL"
assert (
result[1].status_extended
== f"The security solution iot_sec_solution_disabled is disabled in subscription {AZURE_SUBSCRIPTION_ID}"
== f"The security solution iot_sec_solution_disabled is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
assert result[1].resource_name == "iot_sec_solution_disabled"
assert result[1].resource_id == resource_id_disabled
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Setting
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_mcas_is_enabled:
def test_defender_no_settings(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
"MCAS": Setting(
@@ -66,7 +70,7 @@ class Test_defender_ensure_mcas_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Cloud Apps is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Cloud Apps is disabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "MCAS"
@@ -75,6 +79,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
"MCAS": Setting(
@@ -107,7 +112,7 @@ class Test_defender_ensure_mcas_is_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Microsoft Defender for Cloud Apps is enabled for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Cloud Apps is enabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "MCAS"
@@ -116,7 +121,7 @@ class Test_defender_ensure_mcas_is_enabled:
def test_defender_mcas_no_settings(self):
defender_client = mock.MagicMock
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -138,7 +143,7 @@ class Test_defender_ensure_mcas_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Cloud Apps not exists for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Cloud Apps not exists for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
SecurityContactConfiguration,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
with (
@@ -37,6 +40,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_critical(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -74,7 +78,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -83,6 +87,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_high(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -121,7 +126,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Notifications are enabled for alerts with a minimum severity of high or lower (High) in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Notifications are enabled for alerts with a minimum severity of high or lower (High) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -130,6 +135,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_severity_alerts_low(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -168,7 +174,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Notifications are enabled for alerts with a minimum severity of high or lower (Low) in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Notifications are enabled for alerts with a minimum severity of high or lower (Low) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -176,6 +182,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
def test_defender_default_security_contact_not_found(self):
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default": SecurityContactConfiguration(
@@ -212,7 +219,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
SecurityContactConfiguration,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_notify_emails_to_owners:
def test_defender_no_subscriptions(self):
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {}
with (
@@ -37,6 +40,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_no_notify_emails_to_owners(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -76,6 +80,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_notify_emails_to_owners_off(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -113,7 +118,7 @@ class Test_defender_ensure_notify_emails_to_owners:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"The Owner role is not notified for subscription {AZURE_SUBSCRIPTION_ID}."
== f"The Owner role is not notified for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -122,6 +127,7 @@ class Test_defender_ensure_notify_emails_to_owners:
def test_defender_notify_emails_to_owners(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock()
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.security_contact_configurations = {
AZURE_SUBSCRIPTION_ID: {
resource_id: SecurityContactConfiguration(
@@ -159,7 +165,7 @@ class Test_defender_ensure_notify_emails_to_owners:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"The Owner role is notified for subscription {AZURE_SUBSCRIPTION_ID}."
== f"The Owner role is notified for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "default"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Assesment
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_system_updates_are_applied:
def test_defender_no_app_services(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_system_updates_are_applied:
def test_defender_machines_no_log_analytics_installed(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Log Analytics agent should be installed on virtual machines": Assesment(
@@ -74,7 +78,7 @@ class Test_defender_ensure_system_updates_are_applied:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -85,6 +89,7 @@ class Test_defender_ensure_system_updates_are_applied:
):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Log Analytics agent should be installed on virtual machines": Assesment(
@@ -125,7 +130,7 @@ class Test_defender_ensure_system_updates_are_applied:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -134,6 +139,7 @@ class Test_defender_ensure_system_updates_are_applied:
def test_defender_machines_no_system_updates_installed(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Log Analytics agent should be installed on virtual machines": Assesment(
@@ -174,7 +180,7 @@ class Test_defender_ensure_system_updates_are_applied:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -185,6 +191,7 @@ class Test_defender_ensure_system_updates_are_applied:
):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.assessments = {
AZURE_SUBSCRIPTION_ID: {
"Log Analytics agent should be installed on virtual machines": Assesment(
@@ -225,7 +232,7 @@ class Test_defender_ensure_system_updates_are_applied:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"System updates are applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
== f"System updates are applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "vm1"
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.defender.defender_service import Setting
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_defender_ensure_wdatp_is_enabled:
def test_defender_no_settings(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {}
with (
@@ -34,6 +37,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_disabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
"WDATP": Setting(
@@ -66,7 +70,7 @@ class Test_defender_ensure_wdatp_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Endpoint integration is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Endpoint integration is disabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "WDATP"
@@ -75,6 +79,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_enabled(self):
resource_id = str(uuid4())
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.settings = {
AZURE_SUBSCRIPTION_ID: {
"WDATP": Setting(
@@ -107,7 +112,7 @@ class Test_defender_ensure_wdatp_is_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Microsoft Defender for Endpoint integration is enabled for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Endpoint integration is enabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "WDATP"
@@ -116,7 +121,7 @@ class Test_defender_ensure_wdatp_is_enabled:
def test_defender_wdatp_no_settings(self):
defender_client = mock.MagicMock
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -138,7 +143,7 @@ class Test_defender_ensure_wdatp_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Endpoint integration not exists for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Endpoint integration not exists for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.config import VIRTUAL_MACHINE_ADMINISTRATOR_LOGIN_ROLE_ID
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
DOMAIN,
set_mocked_azure_provider,
)
@@ -12,7 +14,9 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_iam_no_roles(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
entra_client = mock.MagicMock
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -37,8 +41,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
with (
@@ -98,7 +104,7 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"User test can access VMs in subscription {AZURE_SUBSCRIPTION_ID} but it has MFA."
== f"User test can access VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY} but it has MFA."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "test"
@@ -106,8 +112,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_mfa(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
with (
@@ -167,7 +175,7 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"User test without MFA can access VMs in subscription {AZURE_SUBSCRIPTION_ID}"
== f"User test without MFA can access VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "test"
@@ -175,8 +183,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_user(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
with (
@@ -227,8 +237,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
def test_entra_user_with_vm_access_has_mfa_no_role(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_assigment_id = str(uuid4())
entra_client = mock.MagicMock
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
user_id = str(uuid4())
with (
@@ -4,7 +4,9 @@ from azure.mgmt.authorization.v2022_04_01.models import Permission
from prowler.providers.azure.services.iam.iam_service import Role
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
def test_iam_no_roles(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {}
with (
@@ -36,6 +39,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
AZURE_SUBSCRIPTION_ID: {
@@ -76,7 +80,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has permission to administer resource locks."
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has permission to administer resource locks."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -91,6 +95,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
AZURE_SUBSCRIPTION_ID: {
@@ -124,7 +129,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has no permission to administer resource locks."
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has no permission to administer resource locks."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -139,6 +144,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
self,
):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
role_name2 = "test-role2"
defender_client.custom_roles = {
@@ -194,7 +200,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has permission to administer resource locks."
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has permission to administer resource locks."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -206,6 +212,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
def test_iam_custom_roles_empty_list_but_with_key(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.iam.iam_service import Role, RoleAssignment
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_role_user_access_admin_restricted:
def test_iam_no_role_assignments(self):
iam_client = mock.MagicMock
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
iam_client.role_assignments = {}
iam_client.roles = {}
@@ -40,11 +43,11 @@ class Test_iam_role_user_access_admin_restricted:
role_name = "User Access Administrator"
iam_client.subscriptions = {
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
}
iam_client.role_assignments = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
role_assignment_id: RoleAssignment(
id=role_assignment_id,
name="test-assignment",
@@ -56,7 +59,7 @@ class Test_iam_role_user_access_admin_restricted:
}
}
iam_client.roles = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{role_id}": Role(
id=role_id,
name=role_name,
@@ -87,9 +90,9 @@ class Test_iam_role_user_access_admin_restricted:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Role assignment test-assignment in subscription subscription-name-1 grants User Access Administrator role to User {agent_id}."
== f"Role assignment test-assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY} grants User Access Administrator role to User {agent_id}."
)
assert result[0].subscription == "subscription-name-1"
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_id == role_assignment_id
def test_iam_non_user_access_administrator_role_assigned(self):
@@ -100,11 +103,11 @@ class Test_iam_role_user_access_admin_restricted:
role_name = "Reader"
iam_client.subscriptions = {
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
}
iam_client.role_assignments = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
role_assignment_id: RoleAssignment(
id=role_assignment_id,
name="test-assignment",
@@ -116,7 +119,7 @@ class Test_iam_role_user_access_admin_restricted:
}
}
iam_client.roles = {
"subscription-name-1": {
AZURE_SUBSCRIPTION_ID: {
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{role_id}": Role(
id=role_id,
name=role_name,
@@ -147,7 +150,7 @@ class Test_iam_role_user_access_admin_restricted:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== "Role assignment test-assignment in subscription subscription-name-1 does not grant User Access Administrator role."
== f"Role assignment test-assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not grant User Access Administrator role."
)
assert result[0].subscription == "subscription-name-1"
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_id == role_assignment_id
@@ -4,7 +4,9 @@ from azure.mgmt.authorization.v2022_04_01.models import Permission
from prowler.providers.azure.services.iam.iam_service import Role
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_no_roles(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
defender_client.custom_roles = {}
with (
@@ -34,6 +37,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_custom_owner_role_created_with_all(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
AZURE_SUBSCRIPTION_ID: {
@@ -67,7 +71,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} is a custom owner role."
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is a custom owner role."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -80,6 +84,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
def test_iam_custom_owner_role_created_with_no_permissions(self):
defender_client = mock.MagicMock
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
role_name = "test-role"
defender_client.custom_roles = {
AZURE_SUBSCRIPTION_ID: {
@@ -113,7 +118,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} is not a custom owner role."
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not a custom owner role."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert (
@@ -2,7 +2,9 @@ from unittest import mock
from uuid import uuid4
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_access_only_through_private_endpoints:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -32,6 +35,7 @@ class Test_keyvault_access_only_through_private_endpoints:
def test_key_vaults_no_private_endpoints(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -78,6 +82,7 @@ class Test_keyvault_access_only_through_private_endpoints:
def test_key_vaults_with_private_endpoints_public_access_enabled(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -127,7 +132,7 @@ class Test_keyvault_access_only_through_private_endpoints:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has public network access enabled while using private endpoints."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled while using private endpoints."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -136,6 +141,7 @@ class Test_keyvault_access_only_through_private_endpoints:
def test_key_vaults_with_private_endpoints_public_access_disabled(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -185,7 +191,7 @@ class Test_keyvault_access_only_through_private_endpoints:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has public network access disabled and is using private endpoints."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access disabled and is using private endpoints."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_key_expiration_set_in_non_rbac:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
def test_no_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -75,6 +79,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
def test_key_vaults_invalid_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_name = "Key Name"
@@ -127,7 +132,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == key_name
@@ -136,6 +141,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
def test_key_vaults_valid_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_name = "Key Name"
@@ -188,7 +194,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == key_name
@@ -197,6 +203,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
def test_disabled_key_skipped(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -248,6 +255,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
def test_multiple_keys_mixed_expiration(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_with_expiry = "key_with_expiry"
@@ -4,7 +4,9 @@ from azure.keyvault.keys import KeyRotationLifetimeAction, KeyRotationPolicy
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_key_rotation_enabled:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_key_rotation_enabled:
def test_no_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -75,6 +79,7 @@ class Test_keyvault_key_rotation_enabled:
def test_key_without_rotation_policy(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "keyvault_name"
key_name = "key_name"
@@ -128,7 +133,7 @@ class Test_keyvault_key_rotation_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have a rotation policy set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a rotation policy set."
)
assert result[0].resource_name == key_name
assert result[0].resource_id == "id"
@@ -137,6 +142,7 @@ class Test_keyvault_key_rotation_enabled:
def test_key_with_rotation_policy(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "keyvault_name"
key_name = "key_name"
@@ -198,7 +204,7 @@ class Test_keyvault_key_rotation_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has a rotation policy set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a rotation policy set."
)
assert result[0].resource_name == key_name
assert result[0].resource_id == "id"
@@ -207,6 +213,7 @@ class Test_keyvault_key_rotation_enabled:
def test_multiple_keys_mixed_rotation_policies(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "keyvault_name"
key_with_rotation = "key_with_rotation"
key_without_rotation = "key_without_rotation"
@@ -306,6 +313,7 @@ class Test_keyvault_key_rotation_enabled:
def test_rotation_action_not_first_in_lifetime_actions(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "keyvault_name"
key_name = "key_name"
@@ -372,5 +380,5 @@ class Test_keyvault_key_rotation_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has a rotation policy set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a rotation policy set."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.keyvault.v2023_07_01.models import VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_logging_enabled:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -37,6 +40,7 @@ class Test_keyvault_logging_enabled:
def test_no_diagnostic_settings(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -83,13 +87,14 @@ class Test_keyvault_logging_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} does not have a diagnostic setting with audit logging."
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a diagnostic setting with audit logging."
)
assert result[0].resource_name == "name_keyvault"
assert result[0].resource_id == "id"
def test_diagnostic_setting_without_audit_logging(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -158,13 +163,14 @@ class Test_keyvault_logging_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} does not have a diagnostic setting with audit logging."
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a diagnostic setting with audit logging."
)
assert result[0].resource_name == "name_keyvault"
assert result[0].resource_id == "id"
def test_diagnostic_setting_with_audit_logging(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -233,13 +239,14 @@ class Test_keyvault_logging_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} has a diagnostic setting with audit logging."
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} has a diagnostic setting with audit logging."
)
assert result[0].resource_name == "name_keyvault"
assert result[0].resource_id == "id"
def test_multiple_diagnostic_settings_one_compliant(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -329,6 +336,7 @@ class Test_keyvault_logging_enabled:
def test_multiple_vaults_mixed(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_non_rbac_secret_expiration_set:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
def test_no_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -76,6 +80,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
def test_key_vaults_invalid_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret_name = "Secret"
@@ -128,7 +133,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == secret_name
@@ -137,6 +142,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
def test_key_vaults_invalid_multiple_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret1_name = "Secret1"
@@ -202,6 +208,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
def test_key_vaults_valid_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret_name = "name"
@@ -254,7 +261,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == secret_name
@@ -263,6 +270,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
def test_disabled_secret_skipped(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -7,7 +7,9 @@ from azure.mgmt.keyvault.v2023_07_01.models import (
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -15,6 +17,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_private_endpoints:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -37,6 +40,7 @@ class Test_keyvault_private_endpoints:
def test_key_vaults_no_private_endpoints(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -82,7 +86,7 @@ class Test_keyvault_private_endpoints:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using private endpoints."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using private endpoints."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -91,6 +95,7 @@ class Test_keyvault_private_endpoints:
def test_key_vaults_using_private_endpoints(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
private_endpoint = PrivateEndpointConnectionItem(
@@ -141,7 +146,7 @@ class Test_keyvault_private_endpoints:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is using private endpoints."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using private endpoints."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_rbac_enabled:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_enabled:
def test_key_vaults_no_rbac(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -77,7 +81,7 @@ class Test_keyvault_rbac_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using RBAC for access control."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using RBAC for access control."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -86,6 +90,7 @@ class Test_keyvault_rbac_enabled:
def test_key_vaults_rbac(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -129,7 +134,7 @@ class Test_keyvault_rbac_enabled:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is using RBAC for access control."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using RBAC for access control."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_rbac_key_expiration_set:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_key_expiration_set:
def test_no_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -75,6 +79,7 @@ class Test_keyvault_rbac_key_expiration_set:
def test_key_vaults_invalid_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_name = "Key Name"
@@ -127,7 +132,7 @@ class Test_keyvault_rbac_key_expiration_set:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == key_name
@@ -136,6 +141,7 @@ class Test_keyvault_rbac_key_expiration_set:
def test_key_vaults_valid_keys(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_name = "Key Name"
@@ -188,7 +194,7 @@ class Test_keyvault_rbac_key_expiration_set:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == key_name
@@ -197,6 +203,7 @@ class Test_keyvault_rbac_key_expiration_set:
def test_disabled_key_skipped(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -248,6 +255,7 @@ class Test_keyvault_rbac_key_expiration_set:
def test_multiple_keys_mixed_expiration(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
key_with_expiry = "key_with_expiry"
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_keyvault_rbac_secret_expiration_set:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_secret_expiration_set:
def test_no_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -75,6 +79,7 @@ class Test_keyvault_rbac_secret_expiration_set:
def test_key_vaults_invalid_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret_name = "Secret"
@@ -127,7 +132,7 @@ class Test_keyvault_rbac_secret_expiration_set:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == secret_name
@@ -136,6 +141,7 @@ class Test_keyvault_rbac_secret_expiration_set:
def test_key_vaults_invalid_multiple_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret1_name = "Secret1"
@@ -201,6 +207,7 @@ class Test_keyvault_rbac_secret_expiration_set:
def test_key_vaults_valid_secrets(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
secret_name = "name"
@@ -253,7 +260,7 @@ class Test_keyvault_rbac_secret_expiration_set:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == secret_name
@@ -262,6 +269,7 @@ class Test_keyvault_rbac_secret_expiration_set:
def test_disabled_secret_skipped(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -4,7 +4,9 @@ from uuid import uuid4
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -13,6 +15,7 @@ class Test_keyvault_recoverable:
def test_no_key_vaults(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_client.key_vaults = {}
with (
@@ -35,6 +38,7 @@ class Test_keyvault_recoverable:
def test_key_vaults_no_purge(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -80,7 +84,7 @@ class Test_keyvault_recoverable:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not recoverable."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not recoverable."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -89,6 +93,7 @@ class Test_keyvault_recoverable:
def test_key_vaults_no_soft_delete(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -149,7 +154,7 @@ class Test_keyvault_recoverable:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not recoverable."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not recoverable."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -158,6 +163,7 @@ class Test_keyvault_recoverable:
def test_key_vaults_valid_configuration(self):
keyvault_client = mock.MagicMock
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
keyvault_name = "Keyvault Name"
keyvault_id = str(uuid4())
@@ -211,7 +217,7 @@ class Test_keyvault_recoverable:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is recoverable."
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is recoverable."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == keyvault_name
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_policy_assignment:
def test_monitor_alert_create_policy_assignment_no_subscriptions(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
@@ -34,7 +37,7 @@ class Test_monitor_alert_create_policy_assignment:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -58,11 +61,12 @@ class Test_monitor_alert_create_policy_assignment:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -125,5 +129,5 @@ class Test_monitor_alert_create_policy_assignment:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_nsg:
def test_monitor_alert_create_update_nsg_no_subscriptions(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_nsg:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_nsg:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -123,5 +127,5 @@ class Test_monitor_alert_create_update_nsg:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_security_solution:
def test_monitor_alert_create_update_public_ip_address_rule_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_security_solution:
def test_monitor_alert_create_update_security_solution_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_sqlserver_fr:
def test_monitor_alert_create_update_sqlserver_fr_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_sqlserver_fr:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_sqlserver_fr:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_sqlserver_fr:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_delete_nsg:
def test_monitor_alert_delete_nsg_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_delete_nsg:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_delete_nsg:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_delete_nsg:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_delete_policy_assignment:
def test_monitor_alert_delete_policy_assignment_no_subscriptions(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
@@ -34,7 +37,7 @@ class Test_monitor_alert_delete_policy_assignment:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -58,11 +61,12 @@ class Test_monitor_alert_delete_policy_assignment:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -125,5 +129,5 @@ class Test_monitor_alert_delete_policy_assignment:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_security_solution:
def test_monitor_alert_delete_public_ip_address_rule_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_create_update_security_solution:
def test_monitor_alert_delete_security_solution_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from unittest import mock
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_delete_sqlserver_fr:
def test_monitor_alert_delete_sqlserver_fr_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -33,7 +36,7 @@ class Test_monitor_alert_delete_sqlserver_fr:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -57,11 +60,12 @@ class Test_monitor_alert_delete_sqlserver_fr:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -124,5 +128,5 @@ class Test_monitor_alert_delete_sqlserver_fr:
assert result[0].resource_id == "id2"
assert (
result[0].status_extended
== f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -9,6 +11,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_monitor_alert_service_health_exists:
def test_monitor_alert_service_health_exists_no_subscriptions(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.alert_rules = {}
with (
mock.patch(
@@ -31,7 +34,7 @@ class Test_monitor_alert_service_health_exists:
def test_no_alert_rules(self):
monitor_client = mock.MagicMock()
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -55,11 +58,12 @@ class Test_monitor_alert_service_health_exists:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -108,11 +112,12 @@ class Test_monitor_alert_service_health_exists:
assert result[0].resource_id == "id1"
assert (
result[0].status_extended
== f"There is an activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is an activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_alert_rules_configured_but_disabled(self):
monitor_client = mock.MagicMock()
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -153,7 +158,7 @@ class Test_monitor_alert_service_health_exists:
]
}
monitor_client.subscriptions = {
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
}
check = monitor_alert_service_health_exists()
result = check.execute()
@@ -164,5 +169,5 @@ class Test_monitor_alert_service_health_exists:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
self,
):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {}
with (
@@ -34,7 +37,7 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
def test_no_diagnostic_settings(self):
monitor_client = mock.MagicMock
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -58,11 +61,12 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
assert (
result[0].status_extended
== f"No diagnostic setting captures all appropriate categories (Administrative, Security, Alert, Policy) in subscription {AZURE_SUBSCRIPTION_ID}."
== f"No diagnostic setting captures all appropriate categories (Administrative, Security, Alert, Policy) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_diagnostic_settings_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -128,5 +132,5 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
assert result[0].resource_name == "name"
assert (
result[0].status_extended
== f"Diagnostic setting name captures appropriate categories in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Diagnostic setting name captures appropriate categories in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ class Test_monitor_diagnostic_settings_exists:
self,
):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {}
with (
@@ -34,7 +37,7 @@ class Test_monitor_diagnostic_settings_exists:
def test_no_diagnostic_settings(self):
monitor_client = mock.MagicMock
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
@@ -58,12 +61,14 @@ class Test_monitor_diagnostic_settings_exists:
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
assert (
result[0].status_extended
== f"No diagnostic settings found in subscription {AZURE_SUBSCRIPTION_ID}."
== f"No diagnostic settings found in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_diagnostic_settings_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
storage_client = mock.MagicMock
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -196,5 +201,5 @@ class Test_monitor_diagnostic_settings_exists:
assert result[0].resource_id == "id"
assert (
result[0].status_extended
== f"Diagnostic setting name found in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Diagnostic setting name found in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
self,
):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {}
with (
@@ -33,6 +36,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
def test_no_diagnostic_settings(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
with (
mock.patch(
@@ -54,7 +58,9 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
def test_diagnostic_settings_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
storage_client = mock.MagicMock
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -191,7 +197,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
)
assert (
result[0].status_extended
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity log in subscription {AZURE_SUBSCRIPTION_ID} is encrypted with Customer Managed Key or not necessary."
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity log in subscription {AZURE_SUBSCRIPTION_DISPLAY} is encrypted with Customer Managed Key or not necessary."
)
assert result[1].status == "FAIL"
assert result[1].resource_name == "storageaccountname2"
@@ -202,5 +208,5 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
)
assert (
result[1].status_extended
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity log in subscription {AZURE_SUBSCRIPTION_ID} is not encrypted with Customer Managed Key."
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity log in subscription {AZURE_SUBSCRIPTION_DISPLAY} is not encrypted with Customer Managed Key."
)
@@ -1,7 +1,9 @@
from unittest import mock
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -11,6 +13,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
self,
):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {}
with (
@@ -33,6 +36,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
def test_no_diagnostic_settings(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
with (
mock.patch(
@@ -54,7 +58,9 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
def test_diagnostic_settings_configured(self):
monitor_client = mock.MagicMock
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
storage_client = mock.MagicMock
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -190,7 +196,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
assert result[0].resource_name == "storageaccountname1"
assert (
result[0].status_extended
== f"Blob public access enabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Blob public access enabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
assert result[1].status == "PASS"
@@ -202,5 +208,5 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
assert result[1].resource_name == "storageaccountname2"
assert (
result[1].status_extended
== f"Blob public access disabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Blob public access disabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
FlexibleServer,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_mysql_flexible_server_audit_log_connection_activated:
def test_mysql_no_subscriptions(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {}
with (
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
def test_mysql_no_servers(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
def test_mysql_audit_log_connection_activated_lowercase(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
)
assert (
result[0].status_extended
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_audit_log_connection_not_connection(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
)
assert (
result[0].status_extended
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_audit_log_connection_activated(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -206,12 +213,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
)
assert (
result[0].status_extended
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_audit_log_connection_activated_with_other_options(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -257,5 +265,5 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
)
assert (
result[0].status_extended
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
FlexibleServer,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_mysql_flexible_server_audit_log_enabled:
def test_mysql_no_subscriptions(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {}
with (
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_audit_log_enabled:
def test_mysql_no_servers(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_audit_log_enabled:
def test_mysql_audit_log_enabled_lowercase(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_audit_log_enabled:
)
assert (
result[0].status_extended
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_audit_log_disabled(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_audit_log_enabled:
)
assert (
result[0].status_extended
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_audit_log_enabled(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -206,5 +213,5 @@ class Test_mysql_flexible_server_audit_log_enabled:
)
assert (
result[0].status_extended
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
FlexibleServer,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_mysql_flexible_server_minimum_tls_version_12:
def test_mysql_no_subscriptions(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {}
with (
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
def test_mysql_no_servers(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
def test_mysql_no_tls_configuration(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -94,12 +99,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
assert result[0].location == "location"
assert (
result[0].status_extended
== f"TLS version is not configured in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"TLS version is not configured in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_flexible_server_minimum_tls_version_12(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -144,12 +150,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
)
assert (
result[0].status_extended
== f"TLS version is TLSv1.2 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. This version of TLS is considered secure."
== f"TLS version is TLSv1.2 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. This version of TLS is considered secure."
)
def test_mysql_tls_version_is_1_3(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -194,12 +201,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
)
assert (
result[0].status_extended
== f"TLS version is TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. This version of TLS is considered secure."
== f"TLS version is TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. This version of TLS is considered secure."
)
def test_mysql_tls_version_is_not_1_2(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -244,12 +252,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
)
assert (
result[0].status_extended
== f"TLS version is TLSv1.1 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. There is at leat one version of TLS that is considered insecure."
== f"TLS version is TLSv1.1 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. There is at leat one version of TLS that is considered insecure."
)
def test_mysql_tls_version_is_1_1_and_1_3(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -294,5 +303,5 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
)
assert (
result[0].status_extended
== f"TLS version is TLSv1.1,TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. There is at leat one version of TLS that is considered insecure."
== f"TLS version is TLSv1.1,TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. There is at leat one version of TLS that is considered insecure."
)
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
FlexibleServer,
)
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
class Test_mysql_flexible_server_ssl_connection_enabled:
def test_mysql_no_subscriptions(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {}
with (
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
def test_mysql_no_servers(self):
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
with (
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
def test_mysql_connection_enabled(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
)
assert (
result[0].status_extended
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_connection_enabled_lowercase(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
)
assert (
result[0].status_extended
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_ssl_connection_disabled(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -206,12 +213,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
)
assert (
result[0].status_extended
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_ssl_connection_no_configuration(self):
server_name = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id": FlexibleServer(
@@ -248,13 +256,14 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
assert result[0].location == "location"
assert (
result[0].status_extended
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
def test_mysql_ssl_connection_enabled_and_disabled(self):
server_name_1 = str(uuid4())
server_name_2 = str(uuid4())
mysql_client = mock.MagicMock
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
mysql_client.flexible_servers = {
AZURE_SUBSCRIPTION_ID: {
"/subscriptions/resource_id1": FlexibleServer(
@@ -313,7 +322,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
)
assert (
result[0].status_extended
== f"SSL connection is enabled for server {server_name_1} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is enabled for server {server_name_1} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[1].status == "FAIL"
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
@@ -325,5 +334,5 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
)
assert (
result[1].status_extended
== f"SSL connection is disabled for server {server_name_2} in subscription {AZURE_SUBSCRIPTION_ID}."
== f"SSL connection is disabled for server {server_name_2} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
@@ -3,7 +3,9 @@ from uuid import uuid4
from prowler.providers.azure.services.network.network_service import BastionHost
from tests.providers.azure.azure_fixtures import (
AZURE_SUBSCRIPTION_DISPLAY,
AZURE_SUBSCRIPTION_ID,
AZURE_SUBSCRIPTION_NAME,
set_mocked_azure_provider,
)
@@ -12,7 +14,7 @@ class Test_network_bastion_host_exists:
def test_no_bastion_hosts(self):
network_client = mock.MagicMock
network_client.bastion_hosts = {AZURE_SUBSCRIPTION_ID: []}
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
with (
mock.patch(
@@ -38,7 +40,7 @@ class Test_network_bastion_host_exists:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Bastion Host from subscription {AZURE_SUBSCRIPTION_ID} does not exist"
== f"Bastion Host from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not exist"
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
@@ -46,6 +48,7 @@ class Test_network_bastion_host_exists:
def test_network_bastion_host_exists(self):
network_client = mock.MagicMock
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
bastion_host_name = "Bastion Host Name"
bastion_host_id = str(uuid4())
@@ -83,7 +86,7 @@ class Test_network_bastion_host_exists:
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Bastion Host {bastion_host_name} exists in subscription {AZURE_SUBSCRIPTION_ID}."
== f"Bastion Host {bastion_host_name} exists in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == bastion_host_name
Loaded 100 of 339 files, more files were not shown because too many files have changed in this diff. Show more