mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-11-10 11:51:29 +00:00
fix(sdk): scan every Azure subscription when display names collide (#10718)
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com> Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
339 files changed
+3210
-1235
No files matched your search
@@ -1149,6 +1149,40 @@ class TestCheck:
|
||||
)
|
||||
assert findings[0].muted is True
|
||||
|
||||
def test_execute_azure_mutelist_passes_subscription_id_and_name(self):
|
||||
"""Test that execute() passes Azure subscription ID and display name."""
|
||||
subscription_id = "12345678-1234-1234-1234-123456789012"
|
||||
subscription_name = "subscription_1"
|
||||
|
||||
finding = Mock()
|
||||
finding.status = "PASS"
|
||||
finding.muted = False
|
||||
finding.subscription = subscription_id
|
||||
|
||||
check = Mock()
|
||||
check.CheckID = "azure_test_check"
|
||||
check.execute = Mock(return_value=[finding])
|
||||
|
||||
provider = mock.MagicMock()
|
||||
provider.type = "azure"
|
||||
provider.identity.subscriptions = {subscription_id: subscription_name}
|
||||
provider.mutelist.mutelist = {"Accounts": {subscription_name: {}}}
|
||||
provider.mutelist.is_finding_muted = Mock(return_value=True)
|
||||
|
||||
findings = execute(
|
||||
check=check,
|
||||
global_provider=provider,
|
||||
custom_checks_metadata=None,
|
||||
output_options=None,
|
||||
)
|
||||
|
||||
provider.mutelist.is_finding_muted.assert_called_once_with(
|
||||
subscription_id=subscription_id,
|
||||
subscription_name=subscription_name,
|
||||
finding=finding,
|
||||
)
|
||||
assert findings[0].muted is True
|
||||
|
||||
def test_execute_check_exception_only_logs(self, caplog):
|
||||
caplog.set_level(ERROR)
|
||||
|
||||
|
||||
@@ -331,8 +331,8 @@ class TestFinding:
|
||||
assert finding_output.auth_method == "mock_identity_type: mock_identity_id"
|
||||
assert finding_output.account_organization_uid == "mock_tenant_id_1"
|
||||
assert finding_output.account_organization_name == "mock_tenant_domain"
|
||||
assert finding_output.account_uid == "mock_subscription_name"
|
||||
assert finding_output.account_name == "mock_subscription_id"
|
||||
assert finding_output.account_uid == "mock_subscription_id"
|
||||
assert finding_output.account_name == "mock_subscription_name"
|
||||
assert finding_output.resource_name == "test_resource_name"
|
||||
assert finding_output.resource_uid == "test_resource_id"
|
||||
assert finding_output.region == "us-west-1"
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
from types import SimpleNamespace
|
||||
|
||||
from prowler.lib.outputs.summary_table import display_summary_table
|
||||
|
||||
|
||||
class TestDisplaySummaryTable:
|
||||
def test_azure_summary_shows_display_name_and_subscription_id(self, capsys):
|
||||
provider = SimpleNamespace(
|
||||
type="azure",
|
||||
identity=SimpleNamespace(
|
||||
tenant_domain="tenant.example.com",
|
||||
tenant_ids=["tenant-id"],
|
||||
subscriptions={
|
||||
"subscription-id-1": "Duplicate Subscription",
|
||||
"subscription-id-2": "Duplicate Subscription",
|
||||
},
|
||||
),
|
||||
)
|
||||
output_options = SimpleNamespace(
|
||||
output_directory="out",
|
||||
output_filename="report",
|
||||
output_modes=[],
|
||||
)
|
||||
findings = [
|
||||
SimpleNamespace(
|
||||
status="PASS",
|
||||
muted=False,
|
||||
check_metadata=SimpleNamespace(
|
||||
ServiceName="network",
|
||||
Provider="azure",
|
||||
Severity="low",
|
||||
),
|
||||
)
|
||||
]
|
||||
|
||||
display_summary_table(findings, provider, output_options)
|
||||
|
||||
captured = capsys.readouterr()
|
||||
|
||||
assert "Subscriptions scanned:" in captured.out
|
||||
assert "Duplicate Subscription (subscription-id-1)" in captured.out
|
||||
assert "Duplicate Subscription (subscription-id-2)" in captured.out
|
||||
@@ -8,6 +8,7 @@ from prowler.providers.azure.models import AzureIdentityInfo, AzureRegionConfig
|
||||
|
||||
AZURE_SUBSCRIPTION_ID = str(uuid4())
|
||||
AZURE_SUBSCRIPTION_NAME = "Subscription Name"
|
||||
AZURE_SUBSCRIPTION_DISPLAY = f"{AZURE_SUBSCRIPTION_NAME} ({AZURE_SUBSCRIPTION_ID})"
|
||||
|
||||
# Azure Identity
|
||||
IDENTITY_ID = "00000000-0000-0000-0000-000000000000"
|
||||
|
||||
@@ -3,6 +3,7 @@ from uuid import uuid4
|
||||
|
||||
import pytest
|
||||
from azure.core.credentials import AccessToken
|
||||
from azure.core.exceptions import HttpResponseError
|
||||
from azure.identity import DefaultAzureCredential
|
||||
from mock import MagicMock
|
||||
|
||||
@@ -432,8 +433,29 @@ class TestAzureProvider:
|
||||
)
|
||||
|
||||
def test_test_connection_with_ClientAuthenticationError(self):
|
||||
with pytest.raises(AzureHTTPResponseError) as exception:
|
||||
tenant_id = str(uuid4())
|
||||
tenant_id = str(uuid4())
|
||||
error_message = (
|
||||
"Authentication failed: Unable to get authority configuration for "
|
||||
f"https://login.microsoftonline.com/{tenant_id}."
|
||||
)
|
||||
|
||||
with (
|
||||
patch(
|
||||
"prowler.providers.azure.azure_provider.AzureProvider.setup_session"
|
||||
) as mock_setup_session,
|
||||
patch(
|
||||
"prowler.providers.azure.azure_provider.SubscriptionClient"
|
||||
) as mock_subscription_client,
|
||||
pytest.raises(AzureHTTPResponseError) as exception,
|
||||
):
|
||||
mock_setup_session.return_value = MagicMock()
|
||||
mock_client = MagicMock()
|
||||
mock_client.subscriptions = MagicMock()
|
||||
mock_client.subscriptions.list.side_effect = HttpResponseError(
|
||||
message=error_message
|
||||
)
|
||||
mock_subscription_client.return_value = mock_client
|
||||
|
||||
AzureProvider.test_connection(
|
||||
browser_auth=True,
|
||||
tenant_id=tenant_id,
|
||||
@@ -441,9 +463,8 @@ class TestAzureProvider:
|
||||
)
|
||||
|
||||
assert exception.type == AzureHTTPResponseError
|
||||
assert (
|
||||
exception.value.args[0]
|
||||
== f"[2010] Error in HTTP response from Azure - Authentication failed: Unable to get authority configuration for https://login.microsoftonline.com/{tenant_id}. Authority would typically be in a format of https://login.microsoftonline.com/your_tenant or https://tenant_name.ciamlogin.com or https://tenant_name.b2clogin.com/tenant.onmicrosoft.com/policy. Also please double check your tenant name or GUID is correct."
|
||||
assert exception.value.args[0] == (
|
||||
f"[2010] Error in HTTP response from Azure - {error_message}"
|
||||
)
|
||||
|
||||
def test_test_connection_without_any_method(self):
|
||||
@@ -527,3 +548,176 @@ class TestAzureProvider:
|
||||
regions = azure_provider.get_regions(subscription_ids=subscription_ids)
|
||||
|
||||
assert regions == expected_regions
|
||||
|
||||
|
||||
class TestAzureProviderSetupIdentitySubscriptions:
|
||||
"""Regression tests ensuring identity.subscriptions preserves every
|
||||
subscription even when multiple Azure subscriptions share the same
|
||||
display_name (which is permitted by Azure)."""
|
||||
|
||||
@staticmethod
|
||||
def _mock_subscription(display_name, subscription_id):
|
||||
mock_subscription = MagicMock()
|
||||
mock_subscription.display_name = display_name
|
||||
mock_subscription.subscription_id = subscription_id
|
||||
return mock_subscription
|
||||
|
||||
@staticmethod
|
||||
def _build_subscriptions_client_mock(list_result=None, get_map=None):
|
||||
"""Construct a fully explicit SubscriptionClient mock so the tests do
|
||||
not depend on MagicMock auto-attribute behavior, which makes the suite
|
||||
sensitive to shared state across test files."""
|
||||
subscriptions_operations = MagicMock()
|
||||
subscriptions_operations.list = MagicMock(return_value=list_result or [])
|
||||
if get_map is not None:
|
||||
subscriptions_operations.get = MagicMock(
|
||||
side_effect=lambda subscription_id: get_map[subscription_id]
|
||||
)
|
||||
else:
|
||||
subscriptions_operations.get = MagicMock()
|
||||
|
||||
tenants_operations = MagicMock()
|
||||
tenants_operations.list = MagicMock(return_value=[])
|
||||
|
||||
client_instance = MagicMock()
|
||||
client_instance.subscriptions = subscriptions_operations
|
||||
client_instance.tenants = tenants_operations
|
||||
|
||||
client_class = MagicMock(return_value=client_instance)
|
||||
return client_class
|
||||
|
||||
@staticmethod
|
||||
def _build_provider():
|
||||
"""Create an AzureProvider instance ready to invoke setup_identity
|
||||
with auth flags left False so the AAD lookup branches are skipped and
|
||||
the test focuses on the subscription resolution logic."""
|
||||
with patch.object(AzureProvider, "__init__", return_value=None):
|
||||
azure_provider = AzureProvider()
|
||||
azure_provider._session = MagicMock()
|
||||
azure_provider._region_config = AzureRegionConfig(
|
||||
name="AzureCloud",
|
||||
authority=None,
|
||||
base_url="https://management.azure.com",
|
||||
credential_scopes=["https://management.azure.com/.default"],
|
||||
)
|
||||
return azure_provider
|
||||
|
||||
def test_setup_identity_auto_discovery_preserves_unique_display_names(self):
|
||||
first_id = str(uuid4())
|
||||
second_id = str(uuid4())
|
||||
client_class = self._build_subscriptions_client_mock(
|
||||
list_result=[
|
||||
self._mock_subscription("Unique Name One", first_id),
|
||||
self._mock_subscription("Unique Name Two", second_id),
|
||||
]
|
||||
)
|
||||
with patch(
|
||||
"prowler.providers.azure.azure_provider.SubscriptionClient",
|
||||
client_class,
|
||||
):
|
||||
azure_provider = self._build_provider()
|
||||
|
||||
identity = azure_provider.setup_identity(
|
||||
az_cli_auth=False,
|
||||
sp_env_auth=False,
|
||||
browser_auth=False,
|
||||
managed_identity_auth=False,
|
||||
subscription_ids=[],
|
||||
client_id=None,
|
||||
)
|
||||
|
||||
assert identity.subscriptions == {
|
||||
first_id: "Unique Name One",
|
||||
second_id: "Unique Name Two",
|
||||
}
|
||||
|
||||
def test_setup_identity_auto_discovery_preserves_duplicate_display_names(
|
||||
self,
|
||||
):
|
||||
shared_name = "Shared Display Name"
|
||||
first_id = str(uuid4())
|
||||
second_id = str(uuid4())
|
||||
client_class = self._build_subscriptions_client_mock(
|
||||
list_result=[
|
||||
self._mock_subscription(shared_name, first_id),
|
||||
self._mock_subscription(shared_name, second_id),
|
||||
]
|
||||
)
|
||||
with patch(
|
||||
"prowler.providers.azure.azure_provider.SubscriptionClient",
|
||||
client_class,
|
||||
):
|
||||
azure_provider = self._build_provider()
|
||||
|
||||
identity = azure_provider.setup_identity(
|
||||
az_cli_auth=False,
|
||||
sp_env_auth=False,
|
||||
browser_auth=False,
|
||||
managed_identity_auth=False,
|
||||
subscription_ids=[],
|
||||
client_id=None,
|
||||
)
|
||||
|
||||
assert identity.subscriptions == {
|
||||
first_id: shared_name,
|
||||
second_id: shared_name,
|
||||
}
|
||||
|
||||
def test_setup_identity_filtered_preserves_unique_display_names(self):
|
||||
first_id = str(uuid4())
|
||||
second_id = str(uuid4())
|
||||
client_class = self._build_subscriptions_client_mock(
|
||||
get_map={
|
||||
first_id: self._mock_subscription("Unique Name One", first_id),
|
||||
second_id: self._mock_subscription("Unique Name Two", second_id),
|
||||
}
|
||||
)
|
||||
with patch(
|
||||
"prowler.providers.azure.azure_provider.SubscriptionClient",
|
||||
client_class,
|
||||
):
|
||||
azure_provider = self._build_provider()
|
||||
|
||||
identity = azure_provider.setup_identity(
|
||||
az_cli_auth=False,
|
||||
sp_env_auth=False,
|
||||
browser_auth=False,
|
||||
managed_identity_auth=False,
|
||||
subscription_ids=[first_id, second_id],
|
||||
client_id=None,
|
||||
)
|
||||
|
||||
assert identity.subscriptions == {
|
||||
first_id: "Unique Name One",
|
||||
second_id: "Unique Name Two",
|
||||
}
|
||||
|
||||
def test_setup_identity_filtered_preserves_duplicate_display_names(self):
|
||||
shared_name = "Shared Display Name"
|
||||
first_id = str(uuid4())
|
||||
second_id = str(uuid4())
|
||||
client_class = self._build_subscriptions_client_mock(
|
||||
get_map={
|
||||
first_id: self._mock_subscription(shared_name, first_id),
|
||||
second_id: self._mock_subscription(shared_name, second_id),
|
||||
}
|
||||
)
|
||||
with patch(
|
||||
"prowler.providers.azure.azure_provider.SubscriptionClient",
|
||||
client_class,
|
||||
):
|
||||
azure_provider = self._build_provider()
|
||||
|
||||
identity = azure_provider.setup_identity(
|
||||
az_cli_auth=False,
|
||||
sp_env_auth=False,
|
||||
browser_auth=False,
|
||||
managed_identity_auth=False,
|
||||
subscription_ids=[first_id, second_id],
|
||||
client_id=None,
|
||||
)
|
||||
|
||||
assert identity.subscriptions == {
|
||||
first_id: shared_name,
|
||||
second_id: shared_name,
|
||||
}
|
||||
@@ -64,10 +64,12 @@ class TestAzureMutelist:
|
||||
finding.status = "FAIL"
|
||||
finding.resource_name = "test_resource"
|
||||
finding.resource_tags = {}
|
||||
finding.subscription = "subscription_1"
|
||||
finding.subscription = "12345678-1234-1234-1234-123456789012"
|
||||
|
||||
assert mutelist.is_finding_muted(
|
||||
finding, "12345678-1234-1234-1234-123456789012"
|
||||
finding,
|
||||
"12345678-1234-1234-1234-123456789012",
|
||||
"subscription_1",
|
||||
)
|
||||
|
||||
def test_is_finding_muted_subscription_id(self):
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.aisearch.aisearch_service import AISearchService
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_AISearch_service_not_publicly_accessible:
|
||||
def test_aisearch_sevice_no_aisearch_services(self):
|
||||
aisearch_client = mock.MagicMock
|
||||
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aisearch_client.aisearch_services = {}
|
||||
|
||||
with (
|
||||
@@ -35,6 +38,7 @@ class Test_AISearch_service_not_publicly_accessible:
|
||||
aisearch_service_id = str(uuid4())
|
||||
aisearch_service_name = "Test AISearch Service"
|
||||
aisearch_client = mock.MagicMock
|
||||
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aisearch_client.aisearch_services = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
aisearch_service_id: AISearchService(
|
||||
@@ -66,7 +70,7 @@ class Test_AISearch_service_not_publicly_accessible:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_ID} allows public access."
|
||||
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} allows public access."
|
||||
)
|
||||
assert result[0].resource_id == aisearch_service_id
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
@@ -77,6 +81,7 @@ class Test_AISearch_service_not_publicly_accessible:
|
||||
aisearch_service_id = str(uuid4())
|
||||
aisearch_service_name = "Test Search Service"
|
||||
aisearch_client = mock.MagicMock
|
||||
aisearch_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aisearch_client.aisearch_services = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
aisearch_service_id: AISearchService(
|
||||
@@ -108,7 +113,7 @@ class Test_AISearch_service_not_publicly_accessible:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_ID} does not allows public access."
|
||||
== f"AISearch Service {aisearch_service_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not allows public access."
|
||||
)
|
||||
assert result[0].resource_id == aisearch_service_id
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
|
||||
+8
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.aks.aks_service import Cluster
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_aks_cluster_rbac_enabled:
|
||||
def test_aks_no_subscriptions(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_aks_cluster_rbac_enabled:
|
||||
|
||||
def test_aks_subscription_empty(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_aks_cluster_rbac_enabled:
|
||||
|
||||
def test_aks_cluster_rbac_enabled(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -91,7 +96,7 @@ class Test_aks_cluster_rbac_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"RBAC is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"RBAC is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
assert result[0].resource_id == cluster_id
|
||||
@@ -100,6 +105,7 @@ class Test_aks_cluster_rbac_enabled:
|
||||
|
||||
def test_aks_rbac_not_enabled(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -136,7 +142,7 @@ class Test_aks_cluster_rbac_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"RBAC is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"RBAC is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
assert result[0].resource_id == cluster_id
|
||||
|
||||
+10
-3
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.aks.aks_service import Cluster
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_aks_clusters_created_with_private_nodes:
|
||||
def test_aks_no_subscriptions(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
|
||||
def test_aks_subscription_empty(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
|
||||
def test_aks_cluster_no_private_nodes(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -91,7 +96,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
@@ -100,6 +105,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
|
||||
def test_aks_cluster_private_nodes(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -136,7 +142,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Cluster 'cluster_name' was created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Cluster 'cluster_name' was created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
@@ -145,6 +151,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
|
||||
def test_aks_cluster_public_and_private_nodes(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -185,7 +192,7 @@ class Test_aks_clusters_created_with_private_nodes:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Cluster 'cluster_name' was not created with private nodes in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
|
||||
+10
-3
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.aks.aks_service import Cluster
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_aks_clusters_public_access_disabled:
|
||||
def test_aks_no_subscriptions(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
|
||||
def test_aks_subscription_empty(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
|
||||
def test_aks_cluster_public_fqdn(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -91,7 +96,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
@@ -100,6 +105,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
|
||||
def test_aks_cluster_private_fqdn(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -136,7 +142,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Public access to nodes is disabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Public access to nodes is disabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
@@ -145,6 +151,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
|
||||
def test_aks_cluster_private_fqdn_with_public_ip(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -181,7 +188,7 @@ class Test_aks_clusters_public_access_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'"
|
||||
== f"Public access to nodes is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'"
|
||||
)
|
||||
assert result[0].resource_id == cluster_id
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
|
||||
+8
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.aks.aks_service import Cluster
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_aks_network_policy_enabled:
|
||||
def test_aks_no_subscriptions(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_aks_network_policy_enabled:
|
||||
|
||||
def test_aks_subscription_empty(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_aks_network_policy_enabled:
|
||||
|
||||
def test_aks_network_policy_enabled(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -91,7 +96,7 @@ class Test_aks_network_policy_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Network policy is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Network policy is enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
assert result[0].resource_id == cluster_id
|
||||
@@ -100,6 +105,7 @@ class Test_aks_network_policy_enabled:
|
||||
|
||||
def test_aks_network_policy_disabled(self):
|
||||
aks_client = mock.MagicMock
|
||||
aks_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cluster_id = str(uuid4())
|
||||
aks_client.clusters = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -136,7 +142,7 @@ class Test_aks_network_policy_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Network policy is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Network policy is not enabled for cluster 'cluster_name' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "cluster_name"
|
||||
assert result[0].resource_id == cluster_id
|
||||
|
||||
@@ -8,6 +8,7 @@ from azure.monitor.query import LogsQueryResult
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -193,6 +194,9 @@ class Test_APIM_Service(TestCase):
|
||||
|
||||
# Properly mock the nested client structure
|
||||
mock_client = mock.MagicMock()
|
||||
mock_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
mock_workspaces = mock.MagicMock()
|
||||
mock_workspaces.get.return_value = mock_workspace
|
||||
mock_client.workspaces = mock_workspaces
|
||||
@@ -246,6 +250,9 @@ class Test_APIM_Service(TestCase):
|
||||
|
||||
# Properly mock the nested client structure
|
||||
mock_client = mock.MagicMock()
|
||||
mock_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
mock_client.query_workspace.return_value = mock_response
|
||||
mock_logsquery_client.clients = {AZURE_SUBSCRIPTION_ID: mock_client}
|
||||
|
||||
|
||||
+106
-4
@@ -2,7 +2,9 @@ from datetime import datetime
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -139,10 +141,18 @@ def mock_get_llm_operations_logs_no_workspace(subscription, instance, minutes):
|
||||
return []
|
||||
|
||||
|
||||
def mock_get_llm_operations_logs_by_subscription(subscription, instance, minutes):
|
||||
"""Return different logs per subscription to validate isolation."""
|
||||
if subscription == AZURE_SUBSCRIPTION_ID:
|
||||
return mock_get_llm_operations_logs_attacker(subscription, instance, minutes)
|
||||
return mock_get_llm_operations_logs_2_operations(subscription, instance, minutes)
|
||||
|
||||
|
||||
class Test_apim_threat_detection_llm_jacking:
|
||||
def test_no_apim_instances(self):
|
||||
"""Test when there are no APIM instances"""
|
||||
apim_client = mock.MagicMock()
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.instances = {}
|
||||
apim_client.audit_config = {
|
||||
"apim_threat_detection_llm_jacking_threshold": 0.1,
|
||||
@@ -175,6 +185,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
def test_no_potential_llm_jacking(self):
|
||||
"""Test when no potential LLM jacking is detected"""
|
||||
apim_client = mock.MagicMock()
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.instances = {
|
||||
AZURE_SUBSCRIPTION_ID: [
|
||||
mock.MagicMock(
|
||||
@@ -184,7 +195,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
)
|
||||
]
|
||||
}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.audit_config = {
|
||||
"apim_threat_detection_llm_jacking_threshold": 0.9,
|
||||
"apim_threat_detection_llm_jacking_minutes": 1440,
|
||||
@@ -240,6 +251,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
def test_potential_llm_jacking_detected(self):
|
||||
"""Test when potential LLM jacking is detected"""
|
||||
apim_client = mock.MagicMock()
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.instances = {
|
||||
AZURE_SUBSCRIPTION_ID: [
|
||||
mock.MagicMock(
|
||||
@@ -286,6 +298,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
"Potential LLM Jacking attack detected from IP address 10.0.0.50"
|
||||
in result[0].status_extended
|
||||
)
|
||||
assert AZURE_SUBSCRIPTION_DISPLAY in result[0].status_extended
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource["name"] == "10.0.0.50"
|
||||
assert result[0].resource["id"] == "10.0.0.50"
|
||||
@@ -293,6 +306,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
def test_higher_threshold_no_detection(self):
|
||||
"""Test when threshold is higher and no attack is detected"""
|
||||
apim_client = mock.MagicMock()
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.instances = {
|
||||
AZURE_SUBSCRIPTION_ID: [
|
||||
mock.MagicMock(
|
||||
@@ -302,7 +316,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
)
|
||||
]
|
||||
}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.audit_config = {
|
||||
"apim_threat_detection_llm_jacking_threshold": 0.9,
|
||||
"apim_threat_detection_llm_jacking_minutes": 1440,
|
||||
@@ -367,7 +381,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
)
|
||||
]
|
||||
}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.audit_config = {
|
||||
"apim_threat_detection_llm_jacking_threshold": 0.9,
|
||||
"apim_threat_detection_llm_jacking_minutes": 1440,
|
||||
@@ -423,6 +437,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
def test_multiple_subscriptions(self):
|
||||
"""Test with multiple subscriptions"""
|
||||
apim_client = mock.MagicMock()
|
||||
apim_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
apim_client.instances = {
|
||||
AZURE_SUBSCRIPTION_ID: [
|
||||
mock.MagicMock(
|
||||
@@ -440,7 +455,7 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
],
|
||||
}
|
||||
apim_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
|
||||
"another-subscription": "another-subscription-id",
|
||||
}
|
||||
apim_client.audit_config = {
|
||||
@@ -496,3 +511,90 @@ class Test_apim_threat_detection_llm_jacking:
|
||||
"No potential LLM Jacking attacks detected"
|
||||
in report.status_extended
|
||||
)
|
||||
|
||||
def test_multiple_subscriptions_keep_findings_isolated(self):
|
||||
"""Ensure findings from one subscription do not leak into another."""
|
||||
apim_client = mock.MagicMock()
|
||||
second_subscription_id = "another-subscription"
|
||||
second_subscription_name = "another-subscription-id"
|
||||
apim_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
|
||||
second_subscription_id: second_subscription_name,
|
||||
}
|
||||
apim_client.instances = {
|
||||
AZURE_SUBSCRIPTION_ID: [
|
||||
mock.MagicMock(
|
||||
id="/subscriptions/test-sub/resourceGroups/test-rg/providers/Microsoft.ApiManagement/service/test-apim",
|
||||
name="test-apim",
|
||||
log_analytics_workspace_id="/subscriptions/test-sub/resourceGroups/test-rg/providers/Microsoft.OperationalInsights/workspaces/test-workspace",
|
||||
)
|
||||
],
|
||||
second_subscription_id: [
|
||||
mock.MagicMock(
|
||||
id="/subscriptions/another-sub/resourceGroups/test-rg/providers/Microsoft.ApiManagement/service/another-apim",
|
||||
name="another-apim",
|
||||
log_analytics_workspace_id="/subscriptions/another-sub/resourceGroups/test-rg/providers/Microsoft.OperationalInsights/workspaces/another-workspace",
|
||||
)
|
||||
],
|
||||
}
|
||||
apim_client.audit_config = {
|
||||
"apim_threat_detection_llm_jacking_threshold": 0.2,
|
||||
"apim_threat_detection_llm_jacking_minutes": 1440,
|
||||
"apim_threat_detection_llm_jacking_actions": [
|
||||
"ChatCompletions_Create",
|
||||
"ImageGenerations_Create",
|
||||
"Completions_Create",
|
||||
"Embeddings_Create",
|
||||
"FineTuning_Jobs_Create",
|
||||
"Models_List",
|
||||
"Deployments_List",
|
||||
"Deployments_Get",
|
||||
"Deployments_Create",
|
||||
"Deployments_Delete",
|
||||
"Messages_Create",
|
||||
"Claude_Create",
|
||||
"GenerateContent",
|
||||
"GenerateText",
|
||||
"GenerateImage",
|
||||
"Llama_Create",
|
||||
"CodeLlama_Create",
|
||||
"Gemini_Generate",
|
||||
"Claude_Generate",
|
||||
"Llama_Generate",
|
||||
],
|
||||
}
|
||||
apim_client.get_llm_operations_logs = (
|
||||
mock_get_llm_operations_logs_by_subscription
|
||||
)
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
return_value=set_mocked_azure_provider(),
|
||||
),
|
||||
mock.patch(
|
||||
"prowler.providers.azure.services.apim.apim_threat_detection_llm_jacking.apim_threat_detection_llm_jacking.apim_client",
|
||||
new=apim_client,
|
||||
),
|
||||
):
|
||||
from prowler.providers.azure.services.apim.apim_threat_detection_llm_jacking.apim_threat_detection_llm_jacking import (
|
||||
apim_threat_detection_llm_jacking,
|
||||
)
|
||||
|
||||
check = apim_threat_detection_llm_jacking()
|
||||
result = check.execute()
|
||||
|
||||
assert len(result) == 2
|
||||
|
||||
report_by_subscription = {report.subscription: report for report in result}
|
||||
|
||||
assert report_by_subscription[AZURE_SUBSCRIPTION_ID].status == "FAIL"
|
||||
assert (
|
||||
AZURE_SUBSCRIPTION_DISPLAY
|
||||
in report_by_subscription[AZURE_SUBSCRIPTION_ID].status_extended
|
||||
)
|
||||
assert report_by_subscription[second_subscription_id].status == "PASS"
|
||||
assert (
|
||||
f"{second_subscription_name} ({second_subscription_id})"
|
||||
in report_by_subscription[second_subscription_id].status_extended
|
||||
)
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_client_certificates_on:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_client_certificates_on:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_client_certificates_on:
|
||||
def test_app_client_certificates_on(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_client_certificates_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Clients are required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Clients are required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -101,6 +106,7 @@ class Test_app_client_certificates_on:
|
||||
def test_app_client_certificates_off(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_client_certificates_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Clients are not required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Clients are not required to present a certificate for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_auth_is_set_up:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_auth_is_set_up:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_auth_is_set_up:
|
||||
def test_app_auth_enabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_ensure_auth_is_set_up:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Authentication is set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Authentication is set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
assert result[0].resource_id == resource_id
|
||||
@@ -101,6 +106,7 @@ class Test_app_ensure_auth_is_set_up:
|
||||
def test_app_auth_disabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_ensure_auth_is_set_up:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Authentication is not set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Authentication is not set up for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
assert result[0].resource_id == resource_id
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_http_is_redirected_to_https:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_http_is_redirected_to_https:
|
||||
|
||||
def test_app_subscriptions_empty_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_http_is_redirected_to_https:
|
||||
def test_app_http_to_https(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_ensure_http_is_redirected_to_https:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"HTTP is not redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"HTTP is not redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
assert result[0].resource_id == resource_id
|
||||
@@ -101,6 +106,7 @@ class Test_app_ensure_http_is_redirected_to_https:
|
||||
def test_app_http_to_https_enabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_ensure_http_is_redirected_to_https:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"HTTP is redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"HTTP is redirected to HTTPS for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
assert result[0].resource_id == resource_id
|
||||
|
||||
+14
-4
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_configurations_none(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -92,6 +97,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_linux_java_version_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"java_latest_version": "17"}
|
||||
|
||||
@@ -132,7 +138,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -142,6 +148,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_linux_java_version_not_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"java_latest_version": "17"}
|
||||
|
||||
@@ -182,7 +189,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Java version is set to 'Tomcat|9.0-java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Java version is set to 'Tomcat|9.0-java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -192,6 +199,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_windows_java_version_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"java_latest_version": "17"}
|
||||
|
||||
@@ -232,7 +240,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Java version is set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -242,6 +250,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_windows_java_version_not_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.audit_config = {"java_latest_version": "17"}
|
||||
|
||||
with (
|
||||
@@ -281,7 +290,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Java version is set to 'java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Java version is set to 'java11', but should be set to 'java 17' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -291,6 +300,7 @@ class Test_app_ensure_java_version_is_latest:
|
||||
def test_app_linux_php_version_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"java_latest_version": "17"}
|
||||
|
||||
|
||||
+9
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_php_version_is_latest:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
def test_app_configurations_none(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -92,6 +97,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
def test_app_php_version_not_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"php_latest_version": "8.2"}
|
||||
|
||||
@@ -130,7 +136,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"PHP version is set to 'php|8.0', the latest version that you could use is the '8.2' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"PHP version is set to 'php|8.0', the latest version that you could use is the '8.2' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -140,6 +146,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
def test_app_php_version_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"php_latest_version": "8.2"}
|
||||
|
||||
@@ -178,7 +185,7 @@ class Test_app_ensure_php_version_is_latest:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"PHP version is set to '8.2' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"PHP version is set to '8.2' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+9
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_python_version_is_latest:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
def test_app_configurations_none(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -91,6 +96,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
def test_app_python_version_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"python_latest_version": "3.12"}
|
||||
|
||||
@@ -129,7 +135,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Python version is set to '3.12' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Python version is set to '3.12' for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -139,6 +145,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
def test_app_python_version_not_latest(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
app_client.audit_config = {"python_latest_version": "3.12"}
|
||||
|
||||
@@ -177,7 +184,7 @@ class Test_app_ensure_python_version_is_latest:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Python version is 'python|3.10', the latest version that you could use is the '3.12' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Python version is 'python|3.10', the latest version that you could use is the '3.12' version, for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+10
-3
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ensure_using_http20:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ensure_using_http20:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ensure_using_http20:
|
||||
def test_app_configurations_none(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_ensure_using_http20:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -101,6 +106,7 @@ class Test_app_ensure_using_http20:
|
||||
def test_app_http20_enabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_ensure_using_http20:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"HTTP/2.0 is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"HTTP/2.0 is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -147,6 +153,7 @@ class Test_app_ensure_using_http20:
|
||||
def test_app_http20_not_enabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -183,7 +190,7 @@ class Test_app_ensure_using_http20:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"HTTP/2.0 is not enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+10
-3
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_ftp_deployment_disabled:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
def test_app_configurations_none(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -101,6 +106,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
def test_app_ftp_deployment_disabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"FTP is enabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -147,6 +153,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
def test_app_ftp_deploy_enabled(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -183,7 +190,7 @@ class Test_app_ftp_deployment_disabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"FTP is disabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"FTP is disabled for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_access_keys_configured:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_access_keys_configured:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_function_access_keys_configured:
|
||||
|
||||
def test_app_function_no_keys(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -98,7 +103,7 @@ class Test_app_function_access_keys_configured:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 does not have function keys configured."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have function keys configured."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -107,6 +112,7 @@ class Test_app_function_access_keys_configured:
|
||||
|
||||
def test_app_function_using_functions_keys(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.functions = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -153,7 +159,7 @@ class Test_app_function_access_keys_configured:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has function keys configured."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has function keys configured."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
|
||||
+12
-4
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_application_insights_enabled:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_application_insights_enabled:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_application_insights_enabled:
|
||||
|
||||
def test_app_function_no_app_insights(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -97,7 +102,7 @@ class Test_app_function_application_insights_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is not using Application Insights."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using Application Insights."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -106,6 +111,7 @@ class Test_app_function_application_insights_enabled:
|
||||
|
||||
def test_app_function_using_app_insights(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -147,7 +153,7 @@ class Test_app_function_application_insights_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is using Application Insights."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using Application Insights."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -156,6 +162,7 @@ class Test_app_function_application_insights_enabled:
|
||||
|
||||
def test_app_function_using_app_insights_different_key(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -197,7 +204,7 @@ class Test_app_function_application_insights_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is using Application Insights."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using Application Insights."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -206,6 +213,7 @@ class Test_app_function_application_insights_enabled:
|
||||
|
||||
def test_app_function_with_app_insights_no_key(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -247,7 +255,7 @@ class Test_app_function_application_insights_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is not using Application Insights."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using Application Insights."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
|
||||
+10
-3
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_ftps_deployment_disabled:
|
||||
def test_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
|
||||
def test_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
|
||||
def test_function_ftp_deployment_enabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -97,7 +102,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has FTP deployment enabled"
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTP deployment enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
@@ -106,6 +111,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
|
||||
def test_function_ftps_deployment_enabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -147,7 +153,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has FTPS deployment enabled"
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTPS deployment enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
@@ -156,6 +162,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
|
||||
def test_function_ftp_and_ftps_deployment_disabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -197,7 +204,7 @@ class Test_app_function_ftps_deployment_disabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has FTP and FTPS deployment disabled"
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has FTP and FTPS deployment disabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_identity_is_configured:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_identity_is_configured:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_identity_is_configured:
|
||||
|
||||
def test_app_function_no_identity(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -97,7 +102,7 @@ class Test_app_function_identity_is_configured:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 does not have a managed identity enabled."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a managed identity enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
@@ -106,6 +111,7 @@ class Test_app_function_identity_is_configured:
|
||||
|
||||
def test_app_function_identity_configured(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -147,7 +153,7 @@ class Test_app_function_identity_is_configured:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has a SystemAssigned identity enabled."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a SystemAssigned identity enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
|
||||
+16
-7
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.config import USER_ACCESS_ADMINISTRATOR_ROLE_ID
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_identity_without_admin_privileges:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -34,6 +37,7 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -57,6 +61,7 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
|
||||
def test_app_function_no_identity(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -98,7 +103,9 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
|
||||
def test_app_function_no_admin_roles(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -175,7 +182,7 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has a managed identity enabled but without admin privileges."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a managed identity enabled but without admin privileges."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -184,7 +191,9 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
|
||||
def test_app_function_admin_roles(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -212,7 +221,7 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
function_id = str(uuid4())
|
||||
function_scope = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg/providers/Microsoft.Web/sites/function1"
|
||||
app_client.functions = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
function_id: FunctionApp(
|
||||
id=function_id,
|
||||
name="function1",
|
||||
@@ -229,11 +238,11 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
}
|
||||
|
||||
iam_client.subscriptions = {
|
||||
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
|
||||
}
|
||||
|
||||
iam_client.role_assignments = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"role-assignment-id-2": RoleAssignment(
|
||||
id="role-assignment-id-2",
|
||||
name="role-assignment-name-2",
|
||||
@@ -246,7 +255,7 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
}
|
||||
|
||||
iam_client.roles = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{USER_ACCESS_ADMINISTRATOR_ROLE_ID}": Role(
|
||||
id=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{USER_ACCESS_ADMINISTRATOR_ROLE_ID}",
|
||||
name="User Access Administrator",
|
||||
@@ -263,9 +272,9 @@ class Test_app_function_identity_without_admin_privileges:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has a managed identity enabled and it is configure with admin privileges using role User Access Administrator."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a managed identity enabled and it is configure with admin privileges using role User Access Administrator."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].subscription == "subscription-name-1"
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].location == "West Europe"
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_latest_runtime_version:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_latest_runtime_version:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_latest_runtime_version:
|
||||
|
||||
def test_app_function_runtime_is_latest(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -96,7 +101,7 @@ class Test_app_function_latest_runtime_version:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
"Function function1 is using the latest runtime."
|
||||
f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using the latest runtime."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
@@ -105,6 +110,7 @@ class Test_app_function_latest_runtime_version:
|
||||
|
||||
def test_app_function_runtime_is_not_latest(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -145,7 +151,7 @@ class Test_app_function_latest_runtime_version:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
"Function function1 is not using the latest runtime. The current runtime is '2' and should be '~4'."
|
||||
f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using the latest runtime. The current runtime is '2' and should be '~4'."
|
||||
)
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].resource_name == "function1"
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_not_publicly_accessible:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_not_publicly_accessible:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_not_publicly_accessible:
|
||||
|
||||
def test_app_function_not_publicly_accessible(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -97,7 +102,7 @@ class Test_app_function_not_publicly_accessible:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is not publicly accessible."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not publicly accessible."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
@@ -106,6 +111,7 @@ class Test_app_function_not_publicly_accessible:
|
||||
|
||||
def test_app_function_publicly_accessible(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -147,7 +153,7 @@ class Test_app_function_not_publicly_accessible:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 is publicly accessible."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} is publicly accessible."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
|
||||
+10
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_function_vnet_integration_enabled:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,6 +36,7 @@ class Test_app_function_vnet_integration_enabled:
|
||||
|
||||
def test_app_subscription_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -56,6 +60,7 @@ class Test_app_function_vnet_integration_enabled:
|
||||
|
||||
def test_app_function_vnet_integration_enabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -97,14 +102,16 @@ class Test_app_function_vnet_integration_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 has Virtual Network integration enabled with subnet 'vnet_subnet_id' enabled."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} has Virtual Network integration enabled with subnet 'vnet_subnet_id' enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].location == "West Europe"
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
|
||||
def test_app_function_vnet_integration_disabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -146,8 +153,9 @@ class Test_app_function_vnet_integration_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Function function1 does not have virtual network integration enabled."
|
||||
== f"Function function1 from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have virtual network integration enabled."
|
||||
)
|
||||
assert result[0].resource_name == "function1"
|
||||
assert result[0].resource_id == function_id
|
||||
assert result[0].location == "West Europe"
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
+12
-4
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ class Test_app_http_logs_enabled:
|
||||
|
||||
def test_app_http_logs_enabled_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_app_http_logs_enabled:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_http_logs_enabled:
|
||||
|
||||
def test_no_diagnostics_settings(self):
|
||||
app_client = mock.MagicMock()
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -93,12 +98,13 @@ class Test_app_http_logs_enabled:
|
||||
assert result[0].resource_id == "resource_id"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App app1 does not have a diagnostic setting in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"App app1 does not have a diagnostic setting in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
|
||||
def test_diagnostic_setting_configured(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -233,11 +239,12 @@ class Test_app_http_logs_enabled:
|
||||
assert result[0].resource_id == "resource_id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App app_id-2 has HTTP Logs enabled in diagnostic setting name_diagnostic_setting2 in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"App app_id-2 has HTTP Logs enabled in diagnostic setting name_diagnostic_setting2 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
|
||||
def test_diagnostic_setting_with_all_logs_category_group(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -296,11 +303,12 @@ class Test_app_http_logs_enabled:
|
||||
assert result[0].resource_id == "resource_id3"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App app_id-3 has allLogs category group which includes HTTP Logs enabled in diagnostic setting name_diagnostic_setting3 in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"App app_id-3 has allLogs category group which includes HTTP Logs enabled in diagnostic setting name_diagnostic_setting3 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
|
||||
def test_diagnostic_setting_with_all_logs_category_group_disabled(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -359,5 +367,5 @@ class Test_app_http_logs_enabled:
|
||||
assert result[0].resource_id == "resource_id4"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App app_id-4 does not have HTTP Logs enabled in diagnostic setting name_diagnostic_setting4 in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"App app_id-4 does not have HTTP Logs enabled in diagnostic setting name_diagnostic_setting4 in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
+12
-4
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_minimum_tls_version_12:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_minimum_tls_version_12:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_minimum_tls_version_12:
|
||||
def test_app_none_configurations(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_minimum_tls_version_12:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -101,6 +106,7 @@ class Test_app_minimum_tls_version_12:
|
||||
def test_app_min_tls_version_12(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_minimum_tls_version_12:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Minimum TLS version is set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Minimum TLS version is set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -147,6 +153,7 @@ class Test_app_minimum_tls_version_12:
|
||||
def test_app_min_tls_version_10(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -183,7 +190,7 @@ class Test_app_minimum_tls_version_12:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Minimum TLS version is not set to 1.2 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -193,6 +200,7 @@ class Test_app_minimum_tls_version_12:
|
||||
def test_app_min_tls_version_13(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -229,7 +237,7 @@ class Test_app_minimum_tls_version_12:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Minimum TLS version is set to 1.3 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Minimum TLS version is set to 1.3 for app 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_app_register_with_identity:
|
||||
def test_app_no_subscriptions(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_app_register_with_identity:
|
||||
|
||||
def test_app_subscriptions_empty(self):
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
app_client.apps = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_app_register_with_identity:
|
||||
def test_app_none_configurations(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -91,7 +96,7 @@ class Test_app_register_with_identity:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}' does not have an identity configured."
|
||||
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}' does not have an identity configured."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
@@ -101,6 +106,7 @@ class Test_app_register_with_identity:
|
||||
def test_app_identity(self):
|
||||
resource_id = f"/subscriptions/{uuid4()}"
|
||||
app_client = mock.MagicMock
|
||||
app_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -137,7 +143,7 @@ class Test_app_register_with_identity:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_ID}' has an identity configured."
|
||||
== f"App 'app_id-1' in subscription '{AZURE_SUBSCRIPTION_DISPLAY}' has an identity configured."
|
||||
)
|
||||
assert result[0].resource_id == resource_id
|
||||
assert result[0].resource_name == "app_id-1"
|
||||
|
||||
+9
-4
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
|
||||
from prowler.providers.azure.services.appinsights.appinsights_service import Component
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_appinsights_ensure_is_configured:
|
||||
def test_appinsights_no_subscriptions(self):
|
||||
appinsights_client = mock.MagicMock
|
||||
appinsights_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
appinsights_client.components = {}
|
||||
|
||||
with (
|
||||
@@ -34,7 +39,7 @@ class Test_appinsights_ensure_is_configured:
|
||||
appinsights_client = mock.MagicMock
|
||||
appinsights_client.components = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
appinsights_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
|
||||
with (
|
||||
@@ -60,7 +65,7 @@ class Test_appinsights_ensure_is_configured:
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There are no AppInsight configured in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There are no AppInsight configured in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_appinsights_configured(self):
|
||||
@@ -76,7 +81,7 @@ class Test_appinsights_ensure_is_configured:
|
||||
}
|
||||
}
|
||||
appinsights_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
|
||||
with (
|
||||
@@ -103,5 +108,5 @@ class Test_appinsights_ensure_is_configured:
|
||||
assert result[0].location == "global"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is at least one AppInsight configured in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is at least one AppInsight configured in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+13
-2
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class TestContainerRegistryAdminUserDisabled:
|
||||
def test_no_container_registries(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +38,9 @@ class TestContainerRegistryAdminUserDisabled:
|
||||
|
||||
def test_container_registry_admin_user_enabled(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
registry_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -76,7 +84,7 @@ class TestContainerRegistryAdminUserDisabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} has its admin user enabled."
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} has its admin user enabled."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
@@ -90,6 +98,9 @@ class TestContainerRegistryAdminUserDisabled:
|
||||
|
||||
def test_container_registry_admin_user_disabled(self):
|
||||
containerregistry_client = mock.MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -135,7 +146,7 @@ class TestContainerRegistryAdminUserDisabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} has its admin user disabled."
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} has its admin user disabled."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
|
||||
+13
-2
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_containerregistry_not_publicly_accessible:
|
||||
def test_no_container_registries(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +38,9 @@ class Test_containerregistry_not_publicly_accessible:
|
||||
|
||||
def test_container_registry_network_access_unrestricted(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
registry_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -93,7 +101,7 @@ class Test_containerregistry_not_publicly_accessible:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_ID} allows unrestricted network access."
|
||||
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} allows unrestricted network access."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
@@ -107,6 +115,9 @@ class Test_containerregistry_not_publicly_accessible:
|
||||
|
||||
def test_container_registry_network_access_restricted(self):
|
||||
containerregistry_client = mock.MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -168,7 +179,7 @@ class Test_containerregistry_not_publicly_accessible:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_ID} does not allow unrestricted network access."
|
||||
== f"Container Registry {containerregistry_client.registries[AZURE_SUBSCRIPTION_ID][registry_id].name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not allow unrestricted network access."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
|
||||
+13
-2
@@ -3,7 +3,9 @@ from unittest.mock import MagicMock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_containerregistry_uses_private_link:
|
||||
def test_no_container_registries(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +38,9 @@ class Test_containerregistry_uses_private_link:
|
||||
|
||||
def test_container_registry_not_uses_private_link(self):
|
||||
containerregistry_client = MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
registry_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -76,7 +84,7 @@ class Test_containerregistry_uses_private_link:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} does not use a private link."
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not use a private link."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
@@ -90,6 +98,9 @@ class Test_containerregistry_uses_private_link:
|
||||
|
||||
def test_container_registry_uses_private_link(self):
|
||||
containerregistry_client = mock.MagicMock()
|
||||
containerregistry_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
containerregistry_client.registries = {}
|
||||
|
||||
with (
|
||||
@@ -141,7 +152,7 @@ class Test_containerregistry_uses_private_link:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_ID} uses a private link."
|
||||
== f"Container Registry mock_registry from subscription {AZURE_SUBSCRIPTION_DISPLAY} uses a private link."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "mock_registry"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_cosmosdb_account_firewall_use_selected_networks:
|
||||
def test_no_accounts(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cosmosdb_client.accounts = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
|
||||
|
||||
def test_accounts_no_virtual_network_filter_enabled(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -71,7 +75,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} has firewall rules that allow access from all networks."
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has firewall rules that allow access from all networks."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
@@ -80,6 +84,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
|
||||
|
||||
def test_accounts_virtual_network_filter_enabled(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -118,7 +123,7 @@ class Test_cosmosdb_account_firewall_use_selected_networks:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} has firewall rules that allow access only from selected networks."
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has firewall rules that allow access only from selected networks."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_cosmosdb_account_use_aad_and_rbac:
|
||||
def test_no_accounts(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cosmosdb_client.accounts = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
|
||||
|
||||
def test_accounts_disable_local_auth_false(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -71,7 +75,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using AAD and RBAC"
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using AAD and RBAC"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
@@ -80,6 +84,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
|
||||
|
||||
def test_accounts_disable_local_auth_true(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -118,7 +123,7 @@ class Test_cosmosdb_account_use_aad_and_rbac:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is using AAD and RBAC"
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using AAD and RBAC"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
|
||||
+7
-2
@@ -5,7 +5,9 @@ from azure.mgmt.cosmosdb.models import PrivateEndpointConnection
|
||||
|
||||
from prowler.providers.azure.services.cosmosdb.cosmosdb_service import Account
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_cosmosdb_account_use_private_endpoints:
|
||||
def test_no_accounts(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
cosmosdb_client.accounts = {}
|
||||
|
||||
with (
|
||||
@@ -35,6 +38,7 @@ class Test_cosmosdb_account_use_private_endpoints:
|
||||
|
||||
def test_accounts_no_private_endpoints_connections(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -73,7 +77,7 @@ class Test_cosmosdb_account_use_private_endpoints:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using private endpoints connections"
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using private endpoints connections"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
@@ -82,6 +86,7 @@ class Test_cosmosdb_account_use_private_endpoints:
|
||||
|
||||
def test_accounts_private_endpoints_connections(self):
|
||||
cosmosdb_client = mock.MagicMock
|
||||
cosmosdb_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
account_name = "Account Name"
|
||||
account_id = str(uuid4())
|
||||
cosmosdb_client.accounts = {
|
||||
@@ -124,7 +129,7 @@ class Test_cosmosdb_account_use_private_endpoints:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_ID} is using private endpoints connections"
|
||||
== f"CosmosDB account {account_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using private endpoints connections"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == account_name
|
||||
|
||||
+13
-2
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.databricks.databricks_service import (
|
||||
ManagedDiskEncryption,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_databricks_workspace_cmk_encryption_enabled:
|
||||
def test_no_databricks_workspaces(self):
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {}
|
||||
|
||||
with (
|
||||
@@ -39,6 +44,9 @@ class Test_databricks_workspace_cmk_encryption_enabled:
|
||||
workspace_name = "test-workspace"
|
||||
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
workspace_id: DatabricksWorkspace(
|
||||
@@ -71,7 +79,7 @@ class Test_databricks_workspace_cmk_encryption_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} does not have customer-managed key (CMK) encryption enabled."
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have customer-managed key (CMK) encryption enabled."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == workspace_name
|
||||
@@ -86,6 +94,9 @@ class Test_databricks_workspace_cmk_encryption_enabled:
|
||||
key_vault_uri = "test-vault-uri"
|
||||
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
workspace_id: DatabricksWorkspace(
|
||||
@@ -122,7 +133,7 @@ class Test_databricks_workspace_cmk_encryption_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} has customer-managed key (CMK) encryption enabled with key {key_vault_uri}/{key_name}/{key_version}."
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has customer-managed key (CMK) encryption enabled with key {key_vault_uri}/{key_name}/{key_version}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == workspace_name
|
||||
|
||||
+13
-2
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.databricks.databricks_service import (
|
||||
DatabricksWorkspace,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -13,6 +15,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_databricks_workspace_vnet_injection_enabled:
|
||||
def test_databricks_no_workspaces(self):
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +42,9 @@ class Test_databricks_workspace_vnet_injection_enabled:
|
||||
workspace_id = str(uuid4())
|
||||
workspace_name = "test-workspace"
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
workspace_id: DatabricksWorkspace(
|
||||
@@ -68,7 +76,7 @@ class Test_databricks_workspace_vnet_injection_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} is not deployed in a customer-managed VNet (VNet Injection is not enabled)."
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} is not deployed in a customer-managed VNet (VNet Injection is not enabled)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == workspace_name
|
||||
@@ -80,6 +88,9 @@ class Test_databricks_workspace_vnet_injection_enabled:
|
||||
workspace_name = "test-workspace"
|
||||
vnet_id = "test-vnet-id"
|
||||
databricks_client = mock.MagicMock
|
||||
databricks_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
databricks_client.workspaces = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
workspace_id: DatabricksWorkspace(
|
||||
@@ -111,7 +122,7 @@ class Test_databricks_workspace_vnet_injection_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_ID} is deployed in a customer-managed VNet ({vnet_id})."
|
||||
== f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} is deployed in a customer-managed VNet ({vnet_id})."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == workspace_name
|
||||
|
||||
+7
-2
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
SecurityContactConfiguration,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_additional_email_configured_with_a_security_contact:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +40,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
|
||||
def test_defender_no_additional_emails(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -74,7 +78,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not another correct email configured for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not another correct email configured for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -83,6 +87,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
|
||||
def test_defender_additional_email_configured(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -120,7 +125,7 @@ class Test_defender_additional_email_configured_with_a_security_contact:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is another correct email configured for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is another correct email configured for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
|
||||
+8
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Assesment
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_assessments_vm_endpoint_protection_installed:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
|
||||
|
||||
def test_defender_subscriptions_with_no_assessments(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
|
||||
|
||||
def test_defender_subscriptions_with_healthy_assessments(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
resource_id = str(uuid4())
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -86,13 +91,14 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Endpoint protection is set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Endpoint protection is set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].resource_name == "vm1"
|
||||
assert result[0].resource_id == resource_id
|
||||
|
||||
def test_defender_subscriptions_with_unhealthy_assessments(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
resource_id = str(uuid4())
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -124,7 +130,7 @@ class Test_defender_assessments_vm_endpoint_protection_installed:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Endpoint protection is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Endpoint protection is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].resource_name == "vm1"
|
||||
assert result[0].resource_id == resource_id
|
||||
+17
-7
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
SecurityContactConfiguration,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_attack_path_notifications_properly_configured:
|
||||
def test_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {}
|
||||
defender_client.audit_config = {}
|
||||
with (
|
||||
@@ -38,6 +41,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -74,7 +78,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are not enabled in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are not enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -85,6 +89,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -123,7 +128,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -134,6 +139,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -172,7 +178,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -183,6 +189,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -219,7 +226,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level Low in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level Low in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -230,6 +237,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -266,7 +274,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level Medium in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -277,6 +285,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -313,7 +322,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level High in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level High in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
@@ -324,6 +333,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
resource_id = str(uuid4())
|
||||
contact_name = "default"
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -360,7 +370,7 @@ class Test_defender_attack_path_notifications_properly_configured:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
f"Attack path notifications are enabled with minimal risk level Critical in subscription {AZURE_SUBSCRIPTION_ID} for security contact {contact_name}."
|
||||
f"Attack path notifications are enabled with minimal risk level Critical in subscription {AZURE_SUBSCRIPTION_DISPLAY} for security contact {contact_name}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == contact_name
|
||||
|
||||
+10
-4
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
AutoProvisioningSetting,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
def test_defender_no_app_services(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.auto_provisioning_settings = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
def test_defender_auto_provisioning_log_analytics_off(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.auto_provisioning_settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"default": AutoProvisioningSetting(
|
||||
@@ -67,7 +71,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF."
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -76,6 +80,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
def test_defender_auto_provisioning_log_analytics_on(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.auto_provisioning_settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"default": AutoProvisioningSetting(
|
||||
@@ -107,7 +112,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to ON."
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -116,6 +121,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
def test_defender_auto_provisioning_log_analytics_on_and_off(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.auto_provisioning_settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"default": AutoProvisioningSetting(
|
||||
@@ -153,7 +159,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to ON."
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -162,7 +168,7 @@ class Test_defender_auto_provisioning_log_analytics_agent_vms_on:
|
||||
assert result[1].status == "FAIL"
|
||||
assert (
|
||||
result[1].status_extended
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF."
|
||||
== f"Defender Auto Provisioning Log Analytics Agents from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF."
|
||||
)
|
||||
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[1].resource_name == "default2"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Assesment
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
|
||||
def test_defender_no_app_services(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
|
||||
def test_defender_machines_no_vulnerability_assessment_solution(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Machines should have a vulnerability assessment solution": Assesment(
|
||||
@@ -64,7 +68,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Vulnerability assessment is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Vulnerability assessment is not set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
@@ -73,6 +77,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
|
||||
def test_defender_machines_vulnerability_assessment_solution(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Machines should have a vulnerability assessment solution": Assesment(
|
||||
@@ -103,7 +108,7 @@ class Test_defender_auto_provisioning_vulnerabilty_assessments_machines_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Vulnerability assessment is set up in all VMs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Vulnerability assessment is set up in all VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
|
||||
+10
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Assesment
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_container_images_resolved_vulnerabilities:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
|
||||
|
||||
def test_defender_subscription_empty(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -55,6 +59,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
|
||||
|
||||
def test_defender_subscription_no_assesment(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"": Assesment(
|
||||
@@ -85,6 +90,7 @@ class Test_defender_container_images_resolved_vulnerabilities:
|
||||
|
||||
def test_defender_subscription_assesment_unhealthy(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
|
||||
@@ -128,11 +134,12 @@ class Test_defender_container_images_resolved_vulnerabilities:
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Azure running container images have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Azure running container images have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
|
||||
def test_defender_subscription_assesment_healthy(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
|
||||
@@ -176,11 +183,12 @@ class Test_defender_container_images_resolved_vulnerabilities:
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Azure running container images do not have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_ID}'."
|
||||
== f"Azure running container images do not have unresolved vulnerabilities in subscription '{AZURE_SUBSCRIPTION_DISPLAY}'."
|
||||
)
|
||||
|
||||
def test_defender_subscription_assesment_not_applicable(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)": Assesment(
|
||||
|
||||
+11
-3
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_container_images_scan_enabled:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
|
||||
def test_defender_subscription_empty(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -56,6 +60,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
|
||||
def test_defender_subscription_no_containers(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"NotContainers": Pricing(
|
||||
@@ -87,6 +92,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
|
||||
def test_defender_subscription_containers_no_extensions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Containers": Pricing(
|
||||
@@ -118,7 +124,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert (
|
||||
result[0].resource_id
|
||||
@@ -131,6 +137,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
|
||||
def test_defender_subscription_containers_container_images_scan_off(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Containers": Pricing(
|
||||
@@ -162,7 +169,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "FAIL"
|
||||
assert result[0].status_extended == (
|
||||
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
f"Container image scan is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert (
|
||||
result[0].resource_id
|
||||
@@ -175,6 +182,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
|
||||
def test_defender_subscription_containers_container_images_scan_on(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Containers": Pricing(
|
||||
@@ -206,7 +214,7 @@ class Test_defender_container_images_scan_enabled:
|
||||
assert len(result) == 1
|
||||
assert result[0].status == "PASS"
|
||||
assert result[0].status_extended == (
|
||||
f"Container image scan is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
f"Container image scan is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert (
|
||||
result[0].resource_id
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_app_services_is_on:
|
||||
def test_defender_no_app_services(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
|
||||
def test_defender_app_services_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"AppServices": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan App Services"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
|
||||
def test_defender_app_services_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"AppServices": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_app_services_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for App Services from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan App Services"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_arm_is_on:
|
||||
def test_defender_no_arm(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
|
||||
def test_defender_arm_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Arm": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan ARM"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
|
||||
def test_defender_arm_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Arm": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_arm_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for ARM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan ARM"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
|
||||
def test_defender_no_sql_databases(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
|
||||
def test_defender_sql_databases_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServers": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
|
||||
def test_defender_sql_databases_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServers": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_azure_sql_databases_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Azure SQL DB Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_containers_is_on:
|
||||
def test_defender_no_container_registries(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
|
||||
def test_defender_container_registries_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Containers": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
|
||||
def test_defender_container_registries_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Containers": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_containers_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Containers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_cosmosdb_is_on:
|
||||
def test_defender_no_cosmosdb(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
|
||||
def test_defender_cosmosdb_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"CosmosDbs": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Cosmos DB"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
|
||||
def test_defender_cosmosdb_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"CosmosDbs": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_cosmosdb_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Cosmos DB from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Cosmos DB"
|
||||
|
||||
+11
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_no_databases(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_sql_servers(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServers": Pricing(
|
||||
@@ -66,6 +70,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_sql_server_virtual_machines(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServerVirtualMachines": Pricing(
|
||||
@@ -98,6 +103,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_open_source_relation_databases(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"OpenSourceRelationalDatabases": Pricing(
|
||||
@@ -130,6 +136,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_cosmosdbs(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"CosmosDbs": Pricing(
|
||||
@@ -162,6 +169,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_all_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServers": Pricing(
|
||||
@@ -211,7 +219,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
@@ -220,6 +228,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
def test_defender_databases_cosmosdb_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServers": Pricing(
|
||||
@@ -269,7 +278,7 @@ class Test_defender_ensure_defender_for_databases_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_dns_is_on:
|
||||
def test_defender_no_dns(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
|
||||
def test_defender_dns_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Dns": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan DNS"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
|
||||
def test_defender_dns_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Dns": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_dns_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for DNS from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan DNS"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_keyvault_is_on:
|
||||
def test_defender_no_keyvaults(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
|
||||
def test_defender_keyvaults_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"KeyVaults": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan KeyVaults"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
|
||||
def test_defender_keyvaults_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"KeyVaults": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_keyvault_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for KeyVaults from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan KeyVaults"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_os_relational_databases_is_on:
|
||||
def test_defender_no_os_relational_databases(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
|
||||
def test_defender_os_relational_databases_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"OpenSourceRelationalDatabases": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
@@ -77,6 +81,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
|
||||
def test_defender_os_relational_databases_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"OpenSourceRelationalDatabases": Pricing(
|
||||
@@ -108,7 +113,7 @@ class Test_defender_ensure_defender_for_os_relational_databases_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Open-Source Relational Databases from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_server_is_on:
|
||||
def test_defender_no_server(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_server_is_on:
|
||||
def test_defender_server_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"VirtualMachines": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_server_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_server_is_on:
|
||||
def test_defender_server_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"VirtualMachines": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_server_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Servers from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Servers"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_sql_servers_is_on:
|
||||
def test_defender_no_server(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
|
||||
def test_defender_server_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServerVirtualMachines": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan SQL Server VMs"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
|
||||
def test_defender_server_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"SqlServerVirtualMachines": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_sql_servers_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for SQL Server VMs from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan SQL Server VMs"
|
||||
|
||||
+7
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Pricing
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_defender_for_storage_is_on:
|
||||
def test_defender_no_server(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
|
||||
def test_defender_server_pricing_tier_not_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"StorageAccounts": Pricing(
|
||||
@@ -65,7 +69,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_ID} is set to OFF (pricing tier not standard)."
|
||||
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Storage Accounts"
|
||||
@@ -74,6 +78,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
|
||||
def test_defender_server_pricing_tier_standard(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.pricings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"StorageAccounts": Pricing(
|
||||
@@ -105,7 +110,7 @@ class Test_defender_ensure_defender_for_storage_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_ID} is set to ON (pricing tier standard)."
|
||||
== f"Defender plan Defender for Storage Accounts from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "Defender plan Storage Accounts"
|
||||
|
||||
+12
-6
@@ -5,7 +5,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
IoTSecuritySolution,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -13,6 +15,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.iot_security_solutions = {}
|
||||
|
||||
with (
|
||||
@@ -36,7 +39,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
def test_defender_no_iot_hub_solutions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.iot_security_solutions = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -58,7 +61,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"No IoT Security Solutions found in the subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"No IoT Security Solutions found in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
@@ -66,6 +69,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
def test_defender_iot_hub_solution_disabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.iot_security_solutions = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: IoTSecuritySolution(
|
||||
@@ -94,7 +98,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"The security solution iot_sec_solution is disabled in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"The security solution iot_sec_solution is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
assert result[0].resource_name == "iot_sec_solution"
|
||||
assert result[0].resource_id == resource_id
|
||||
@@ -102,6 +106,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
def test_defender_iot_hub_solution_enabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.iot_security_solutions = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: IoTSecuritySolution(
|
||||
@@ -130,7 +135,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"The security solution iot_sec_solution is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"The security solution iot_sec_solution is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].resource_name == "iot_sec_solution"
|
||||
assert result[0].resource_id == resource_id
|
||||
@@ -140,6 +145,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
resource_id_enabled = str(uuid4())
|
||||
resource_id_disabled = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.iot_security_solutions = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id_enabled: IoTSecuritySolution(
|
||||
@@ -175,7 +181,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"The security solution iot_sec_solution_enabled is enabled in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"The security solution iot_sec_solution_enabled is enabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].resource_name == "iot_sec_solution_enabled"
|
||||
assert result[0].resource_id == resource_id_enabled
|
||||
@@ -184,7 +190,7 @@ class Test_defender_ensure_iot_hub_defender_is_on:
|
||||
assert result[1].status == "FAIL"
|
||||
assert (
|
||||
result[1].status_extended
|
||||
== f"The security solution iot_sec_solution_disabled is disabled in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"The security solution iot_sec_solution_disabled is disabled in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
assert result[1].resource_name == "iot_sec_solution_disabled"
|
||||
assert result[1].resource_id == resource_id_disabled
|
||||
|
||||
+9
-4
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Setting
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_mcas_is_enabled:
|
||||
def test_defender_no_settings(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
def test_defender_mcas_disabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"MCAS": Setting(
|
||||
@@ -66,7 +70,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Cloud Apps is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Cloud Apps is disabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "MCAS"
|
||||
@@ -75,6 +79,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
def test_defender_mcas_enabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"MCAS": Setting(
|
||||
@@ -107,7 +112,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Cloud Apps is enabled for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Cloud Apps is enabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "MCAS"
|
||||
@@ -116,7 +121,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
def test_defender_mcas_no_settings(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -138,7 +143,7 @@ class Test_defender_ensure_mcas_is_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Cloud Apps not exists for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Cloud Apps not exists for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
|
||||
+11
-4
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
SecurityContactConfiguration,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +40,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
def test_defender_severity_alerts_critical(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -74,7 +78,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -83,6 +87,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
def test_defender_severity_alerts_high(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -121,7 +126,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Notifications are enabled for alerts with a minimum severity of high or lower (High) in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Notifications are enabled for alerts with a minimum severity of high or lower (High) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -130,6 +135,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
def test_defender_severity_alerts_low(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -168,7 +174,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Notifications are enabled for alerts with a minimum severity of high or lower (Low) in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Notifications are enabled for alerts with a minimum severity of high or lower (Low) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -176,6 +182,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
|
||||
def test_defender_default_security_contact_not_found(self):
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default": SecurityContactConfiguration(
|
||||
@@ -212,7 +219,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
|
||||
+8
-2
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.defender.defender_service import (
|
||||
SecurityContactConfiguration,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_notify_emails_to_owners:
|
||||
def test_defender_no_subscriptions(self):
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +40,7 @@ class Test_defender_ensure_notify_emails_to_owners:
|
||||
def test_defender_no_notify_emails_to_owners(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -76,6 +80,7 @@ class Test_defender_ensure_notify_emails_to_owners:
|
||||
def test_defender_notify_emails_to_owners_off(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -113,7 +118,7 @@ class Test_defender_ensure_notify_emails_to_owners:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"The Owner role is not notified for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"The Owner role is not notified for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
@@ -122,6 +127,7 @@ class Test_defender_ensure_notify_emails_to_owners:
|
||||
def test_defender_notify_emails_to_owners(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock()
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.security_contact_configurations = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
resource_id: SecurityContactConfiguration(
|
||||
@@ -159,7 +165,7 @@ class Test_defender_ensure_notify_emails_to_owners:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"The Owner role is notified for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"The Owner role is notified for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "default"
|
||||
|
||||
+11
-4
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Assesment
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_system_updates_are_applied:
|
||||
def test_defender_no_app_services(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
def test_defender_machines_no_log_analytics_installed(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Log Analytics agent should be installed on virtual machines": Assesment(
|
||||
@@ -74,7 +78,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
@@ -85,6 +89,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Log Analytics agent should be installed on virtual machines": Assesment(
|
||||
@@ -125,7 +130,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
@@ -134,6 +139,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
def test_defender_machines_no_system_updates_installed(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Log Analytics agent should be installed on virtual machines": Assesment(
|
||||
@@ -174,7 +180,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"System updates are not applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
@@ -185,6 +191,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.assessments = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"Log Analytics agent should be installed on virtual machines": Assesment(
|
||||
@@ -225,7 +232,7 @@ class Test_defender_ensure_system_updates_are_applied:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"System updates are applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"System updates are applied for all the VMs in the subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "vm1"
|
||||
|
||||
+9
-4
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.defender.defender_service import Setting
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_defender_ensure_wdatp_is_enabled:
|
||||
def test_defender_no_settings(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
def test_defender_wdatp_disabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"WDATP": Setting(
|
||||
@@ -66,7 +70,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Endpoint integration is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Endpoint integration is disabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "WDATP"
|
||||
@@ -75,6 +79,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
def test_defender_wdatp_enabled(self):
|
||||
resource_id = str(uuid4())
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.settings = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"WDATP": Setting(
|
||||
@@ -107,7 +112,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Endpoint integration is enabled for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Endpoint integration is enabled for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "WDATP"
|
||||
@@ -116,7 +121,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
def test_defender_wdatp_no_settings(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.settings = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -138,7 +143,7 @@ class Test_defender_ensure_wdatp_is_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Microsoft Defender for Endpoint integration not exists for subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Microsoft Defender for Endpoint integration not exists for subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
|
||||
+14
-2
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.config import VIRTUAL_MACHINE_ADMINISTRATOR_LOGIN_ROLE_ID
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
DOMAIN,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
@@ -12,7 +14,9 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
def test_iam_no_roles(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -37,8 +41,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
|
||||
def test_entra_user_with_vm_access_has_mfa(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_assigment_id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
user_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -98,7 +104,7 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"User test can access VMs in subscription {AZURE_SUBSCRIPTION_ID} but it has MFA."
|
||||
== f"User test can access VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY} but it has MFA."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "test"
|
||||
@@ -106,8 +112,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
|
||||
def test_entra_user_with_vm_access_has_mfa_no_mfa(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_assigment_id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
user_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -167,7 +175,7 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"User test without MFA can access VMs in subscription {AZURE_SUBSCRIPTION_ID}"
|
||||
== f"User test without MFA can access VMs in subscription {AZURE_SUBSCRIPTION_DISPLAY}"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == "test"
|
||||
@@ -175,8 +183,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
|
||||
def test_entra_user_with_vm_access_has_mfa_no_user(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_assigment_id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
user_id = str(uuid4())
|
||||
|
||||
with (
|
||||
@@ -227,8 +237,10 @@ class Test_iam_assignment_priviledge_access_vm_has_mfa:
|
||||
|
||||
def test_entra_user_with_vm_access_has_mfa_no_role(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_assigment_id = str(uuid4())
|
||||
entra_client = mock.MagicMock
|
||||
entra_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
user_id = str(uuid4())
|
||||
|
||||
with (
|
||||
|
||||
+10
-3
@@ -4,7 +4,9 @@ from azure.mgmt.authorization.v2022_04_01.models import Permission
|
||||
|
||||
from prowler.providers.azure.services.iam.iam_service import Role
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
def test_iam_no_roles(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.custom_roles = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
self,
|
||||
):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_name = "test-role"
|
||||
defender_client.custom_roles = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -76,7 +80,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has permission to administer resource locks."
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has permission to administer resource locks."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
@@ -91,6 +95,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
self,
|
||||
):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_name = "test-role"
|
||||
defender_client.custom_roles = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -124,7 +129,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has no permission to administer resource locks."
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has no permission to administer resource locks."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
@@ -139,6 +144,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
self,
|
||||
):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_name = "test-role"
|
||||
role_name2 = "test-role2"
|
||||
defender_client.custom_roles = {
|
||||
@@ -194,7 +200,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} has permission to administer resource locks."
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has permission to administer resource locks."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
@@ -206,6 +212,7 @@ class Test_iam_custom_role_has_permissions_to_administer_resource_locks:
|
||||
|
||||
def test_iam_custom_roles_empty_list_but_with_key(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.custom_roles = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
|
||||
+13
-10
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.iam.iam_service import Role, RoleAssignment
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_iam_role_user_access_admin_restricted:
|
||||
def test_iam_no_role_assignments(self):
|
||||
iam_client = mock.MagicMock
|
||||
iam_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
iam_client.role_assignments = {}
|
||||
iam_client.roles = {}
|
||||
|
||||
@@ -40,11 +43,11 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
role_name = "User Access Administrator"
|
||||
|
||||
iam_client.subscriptions = {
|
||||
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
|
||||
}
|
||||
|
||||
iam_client.role_assignments = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
role_assignment_id: RoleAssignment(
|
||||
id=role_assignment_id,
|
||||
name="test-assignment",
|
||||
@@ -56,7 +59,7 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
}
|
||||
}
|
||||
iam_client.roles = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{role_id}": Role(
|
||||
id=role_id,
|
||||
name=role_name,
|
||||
@@ -87,9 +90,9 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role assignment test-assignment in subscription subscription-name-1 grants User Access Administrator role to User {agent_id}."
|
||||
== f"Role assignment test-assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY} grants User Access Administrator role to User {agent_id}."
|
||||
)
|
||||
assert result[0].subscription == "subscription-name-1"
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_id == role_assignment_id
|
||||
|
||||
def test_iam_non_user_access_administrator_role_assigned(self):
|
||||
@@ -100,11 +103,11 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
role_name = "Reader"
|
||||
|
||||
iam_client.subscriptions = {
|
||||
"subscription-name-1": AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME,
|
||||
}
|
||||
|
||||
iam_client.role_assignments = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
role_assignment_id: RoleAssignment(
|
||||
id=role_assignment_id,
|
||||
name="test-assignment",
|
||||
@@ -116,7 +119,7 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
}
|
||||
}
|
||||
iam_client.roles = {
|
||||
"subscription-name-1": {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Authorization/roleDefinitions/{role_id}": Role(
|
||||
id=role_id,
|
||||
name=role_name,
|
||||
@@ -147,7 +150,7 @@ class Test_iam_role_user_access_admin_restricted:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== "Role assignment test-assignment in subscription subscription-name-1 does not grant User Access Administrator role."
|
||||
== f"Role assignment test-assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not grant User Access Administrator role."
|
||||
)
|
||||
assert result[0].subscription == "subscription-name-1"
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_id == role_assignment_id
|
||||
+7
-2
@@ -4,7 +4,9 @@ from azure.mgmt.authorization.v2022_04_01.models import Permission
|
||||
|
||||
from prowler.providers.azure.services.iam.iam_service import Role
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_iam_subscription_roles_owner_custom_not_created:
|
||||
def test_iam_no_roles(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
defender_client.custom_roles = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
|
||||
|
||||
def test_iam_custom_owner_role_created_with_all(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_name = "test-role"
|
||||
defender_client.custom_roles = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -67,7 +71,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} is a custom owner role."
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is a custom owner role."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
@@ -80,6 +84,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
|
||||
|
||||
def test_iam_custom_owner_role_created_with_no_permissions(self):
|
||||
defender_client = mock.MagicMock
|
||||
defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
role_name = "test-role"
|
||||
defender_client.custom_roles = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
@@ -113,7 +118,7 @@ class Test_iam_subscription_roles_owner_custom_not_created:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_ID} is not a custom owner role."
|
||||
== f"Role {role_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not a custom owner role."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
|
||||
+8
-2
@@ -2,7 +2,9 @@ from unittest import mock
|
||||
from uuid import uuid4
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -10,6 +12,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_access_only_through_private_endpoints:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -32,6 +35,7 @@ class Test_keyvault_access_only_through_private_endpoints:
|
||||
|
||||
def test_key_vaults_no_private_endpoints(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -78,6 +82,7 @@ class Test_keyvault_access_only_through_private_endpoints:
|
||||
|
||||
def test_key_vaults_with_private_endpoints_public_access_enabled(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -127,7 +132,7 @@ class Test_keyvault_access_only_through_private_endpoints:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has public network access enabled while using private endpoints."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled while using private endpoints."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
@@ -136,6 +141,7 @@ class Test_keyvault_access_only_through_private_endpoints:
|
||||
|
||||
def test_key_vaults_with_private_endpoints_public_access_disabled(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -185,7 +191,7 @@ class Test_keyvault_access_only_through_private_endpoints:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has public network access disabled and is using private endpoints."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access disabled and is using private endpoints."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
|
||||
+10
-2
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
|
||||
def test_no_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -75,6 +79,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
|
||||
def test_key_vaults_invalid_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_name = "Key Name"
|
||||
@@ -127,7 +132,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == key_name
|
||||
@@ -136,6 +141,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
|
||||
def test_key_vaults_valid_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_name = "Key Name"
|
||||
@@ -188,7 +194,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == key_name
|
||||
@@ -197,6 +203,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
|
||||
def test_disabled_key_skipped(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -248,6 +255,7 @@ class Test_keyvault_key_expiration_set_in_non_rbac:
|
||||
|
||||
def test_multiple_keys_mixed_expiration(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_with_expiry = "key_with_expiry"
|
||||
|
||||
+11
-3
@@ -4,7 +4,9 @@ from azure.keyvault.keys import KeyRotationLifetimeAction, KeyRotationPolicy
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_key_rotation_enabled:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
|
||||
def test_no_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -75,6 +79,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
|
||||
def test_key_without_rotation_policy(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "keyvault_name"
|
||||
key_name = "key_name"
|
||||
|
||||
@@ -128,7 +133,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have a rotation policy set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a rotation policy set."
|
||||
)
|
||||
assert result[0].resource_name == key_name
|
||||
assert result[0].resource_id == "id"
|
||||
@@ -137,6 +142,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
|
||||
def test_key_with_rotation_policy(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "keyvault_name"
|
||||
key_name = "key_name"
|
||||
|
||||
@@ -198,7 +204,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has a rotation policy set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a rotation policy set."
|
||||
)
|
||||
assert result[0].resource_name == key_name
|
||||
assert result[0].resource_id == "id"
|
||||
@@ -207,6 +213,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
|
||||
def test_multiple_keys_mixed_rotation_policies(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "keyvault_name"
|
||||
key_with_rotation = "key_with_rotation"
|
||||
key_without_rotation = "key_without_rotation"
|
||||
@@ -306,6 +313,7 @@ class Test_keyvault_key_rotation_enabled:
|
||||
|
||||
def test_rotation_action_not_first_in_lifetime_actions(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "keyvault_name"
|
||||
key_name = "key_name"
|
||||
|
||||
@@ -372,5 +380,5 @@ class Test_keyvault_key_rotation_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has a rotation policy set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has a rotation policy set."
|
||||
)
|
||||
+11
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_logging_enabled:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +40,7 @@ class Test_keyvault_logging_enabled:
|
||||
|
||||
def test_no_diagnostic_settings(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -83,13 +87,14 @@ class Test_keyvault_logging_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} does not have a diagnostic setting with audit logging."
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a diagnostic setting with audit logging."
|
||||
)
|
||||
assert result[0].resource_name == "name_keyvault"
|
||||
assert result[0].resource_id == "id"
|
||||
|
||||
def test_diagnostic_setting_without_audit_logging(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -158,13 +163,14 @@ class Test_keyvault_logging_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} does not have a diagnostic setting with audit logging."
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have a diagnostic setting with audit logging."
|
||||
)
|
||||
assert result[0].resource_name == "name_keyvault"
|
||||
assert result[0].resource_id == "id"
|
||||
|
||||
def test_diagnostic_setting_with_audit_logging(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -233,13 +239,14 @@ class Test_keyvault_logging_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_ID} has a diagnostic setting with audit logging."
|
||||
== f"Key Vault name_keyvault in subscription {AZURE_SUBSCRIPTION_DISPLAY} has a diagnostic setting with audit logging."
|
||||
)
|
||||
assert result[0].resource_name == "name_keyvault"
|
||||
assert result[0].resource_id == "id"
|
||||
|
||||
def test_multiple_diagnostic_settings_one_compliant(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -329,6 +336,7 @@ class Test_keyvault_logging_enabled:
|
||||
|
||||
def test_multiple_vaults_mixed(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
|
||||
+10
-2
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
|
||||
def test_no_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -76,6 +80,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_invalid_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret_name = "Secret"
|
||||
@@ -128,7 +133,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == secret_name
|
||||
@@ -137,6 +142,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_invalid_multiple_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret1_name = "Secret1"
|
||||
@@ -202,6 +208,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_valid_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret_name = "name"
|
||||
@@ -254,7 +261,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == secret_name
|
||||
@@ -263,6 +270,7 @@ class Test_keyvault_non_rbac_secret_expiration_set:
|
||||
|
||||
def test_disabled_secret_skipped(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
|
||||
+7
-2
@@ -7,7 +7,9 @@ from azure.mgmt.keyvault.v2023_07_01.models import (
|
||||
)
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -15,6 +17,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_private_endpoints:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -37,6 +40,7 @@ class Test_keyvault_private_endpoints:
|
||||
|
||||
def test_key_vaults_no_private_endpoints(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -82,7 +86,7 @@ class Test_keyvault_private_endpoints:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using private endpoints."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using private endpoints."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
@@ -91,6 +95,7 @@ class Test_keyvault_private_endpoints:
|
||||
|
||||
def test_key_vaults_using_private_endpoints(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
private_endpoint = PrivateEndpointConnectionItem(
|
||||
@@ -141,7 +146,7 @@ class Test_keyvault_private_endpoints:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is using private endpoints."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using private endpoints."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
|
||||
+7
-2
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_rbac_enabled:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_enabled:
|
||||
|
||||
def test_key_vaults_no_rbac(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -77,7 +81,7 @@ class Test_keyvault_rbac_enabled:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not using RBAC for access control."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not using RBAC for access control."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
@@ -86,6 +90,7 @@ class Test_keyvault_rbac_enabled:
|
||||
|
||||
def test_key_vaults_rbac(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -129,7 +134,7 @@ class Test_keyvault_rbac_enabled:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is using RBAC for access control."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is using RBAC for access control."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
|
||||
+10
-2
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import KeyAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_rbac_key_expiration_set:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
|
||||
def test_no_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -75,6 +79,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
|
||||
def test_key_vaults_invalid_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_name = "Key Name"
|
||||
@@ -127,7 +132,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == key_name
|
||||
@@ -136,6 +141,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
|
||||
def test_key_vaults_valid_keys(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_name = "Key Name"
|
||||
@@ -188,7 +194,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
|
||||
== f"Key {key_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == key_name
|
||||
@@ -197,6 +203,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
|
||||
def test_disabled_key_skipped(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -248,6 +255,7 @@ class Test_keyvault_rbac_key_expiration_set:
|
||||
|
||||
def test_multiple_keys_mixed_expiration(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
key_with_expiry = "key_with_expiry"
|
||||
|
||||
+10
-2
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,6 +14,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_keyvault_rbac_secret_expiration_set:
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -34,6 +37,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
|
||||
def test_no_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -75,6 +79,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_invalid_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret_name = "Secret"
|
||||
@@ -127,7 +132,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} does not have an expiration date set."
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == secret_name
|
||||
@@ -136,6 +141,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_invalid_multiple_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret1_name = "Secret1"
|
||||
@@ -201,6 +207,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
|
||||
def test_key_vaults_valid_secrets(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
secret_name = "name"
|
||||
@@ -253,7 +260,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} has an expiration date set."
|
||||
== f"Secret {secret_name} in Key Vault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has an expiration date set."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == secret_name
|
||||
@@ -262,6 +269,7 @@ class Test_keyvault_rbac_secret_expiration_set:
|
||||
|
||||
def test_disabled_secret_skipped(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
|
||||
+9
-3
@@ -4,7 +4,9 @@ from uuid import uuid4
|
||||
from azure.mgmt.keyvault.v2023_07_01.models import SecretAttributes, VaultProperties
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -13,6 +15,7 @@ class Test_keyvault_recoverable:
|
||||
|
||||
def test_no_key_vaults(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_client.key_vaults = {}
|
||||
|
||||
with (
|
||||
@@ -35,6 +38,7 @@ class Test_keyvault_recoverable:
|
||||
|
||||
def test_key_vaults_no_purge(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -80,7 +84,7 @@ class Test_keyvault_recoverable:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not recoverable."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not recoverable."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
@@ -89,6 +93,7 @@ class Test_keyvault_recoverable:
|
||||
|
||||
def test_key_vaults_no_soft_delete(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -149,7 +154,7 @@ class Test_keyvault_recoverable:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is not recoverable."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is not recoverable."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
@@ -158,6 +163,7 @@ class Test_keyvault_recoverable:
|
||||
|
||||
def test_key_vaults_valid_configuration(self):
|
||||
keyvault_client = mock.MagicMock
|
||||
keyvault_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
keyvault_name = "Keyvault Name"
|
||||
keyvault_id = str(uuid4())
|
||||
|
||||
@@ -211,7 +217,7 @@ class Test_keyvault_recoverable:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_ID} is recoverable."
|
||||
== f"Keyvault {keyvault_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} is recoverable."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == keyvault_name
|
||||
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_policy_assignment:
|
||||
def test_monitor_alert_create_policy_assignment_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
|
||||
with (
|
||||
@@ -34,7 +37,7 @@ class Test_monitor_alert_create_policy_assignment:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -58,11 +61,12 @@ class Test_monitor_alert_create_policy_assignment:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -125,5 +129,5 @@ class Test_monitor_alert_create_policy_assignment:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_nsg:
|
||||
def test_monitor_alert_create_update_nsg_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_nsg:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_nsg:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -123,5 +127,5 @@ class Test_monitor_alert_create_update_nsg:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_security_solution:
|
||||
def test_monitor_alert_create_update_public_ip_address_rule_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_security_solution:
|
||||
def test_monitor_alert_create_update_security_solution_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_sqlserver_fr:
|
||||
def test_monitor_alert_create_update_sqlserver_fr_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_sqlserver_fr:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_sqlserver_fr:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_sqlserver_fr:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_delete_nsg:
|
||||
def test_monitor_alert_delete_nsg_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_delete_nsg:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_delete_nsg:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_delete_nsg:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_delete_policy_assignment:
|
||||
def test_monitor_alert_delete_policy_assignment_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
|
||||
with (
|
||||
@@ -34,7 +37,7 @@ class Test_monitor_alert_delete_policy_assignment:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -58,11 +61,12 @@ class Test_monitor_alert_delete_policy_assignment:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -125,5 +129,5 @@ class Test_monitor_alert_delete_policy_assignment:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_security_solution:
|
||||
def test_monitor_alert_delete_public_ip_address_rule_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_create_update_security_solution:
|
||||
def test_monitor_alert_delete_security_solution_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_create_update_security_solution:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -3,7 +3,9 @@ from unittest import mock
|
||||
from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_delete_sqlserver_fr:
|
||||
def test_monitor_alert_delete_sqlserver_fr_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -33,7 +36,7 @@ class Test_monitor_alert_delete_sqlserver_fr:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -57,11 +60,12 @@ class Test_monitor_alert_delete_sqlserver_fr:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -124,5 +128,5 @@ class Test_monitor_alert_delete_sqlserver_fr:
|
||||
assert result[0].resource_id == "id2"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+10
-5
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -9,6 +11,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_monitor_alert_service_health_exists:
|
||||
def test_monitor_alert_service_health_exists_no_subscriptions(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.alert_rules = {}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -31,7 +34,7 @@ class Test_monitor_alert_service_health_exists:
|
||||
def test_no_alert_rules(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.alert_rules = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -55,11 +58,12 @@ class Test_monitor_alert_service_health_exists:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -108,11 +112,12 @@ class Test_monitor_alert_service_health_exists:
|
||||
assert result[0].resource_id == "id1"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is an activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is an activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_alert_rules_configured_but_disabled(self):
|
||||
monitor_client = mock.MagicMock()
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -153,7 +158,7 @@ class Test_monitor_alert_service_health_exists:
|
||||
]
|
||||
}
|
||||
monitor_client.subscriptions = {
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID
|
||||
AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
|
||||
}
|
||||
check = monitor_alert_service_health_exists()
|
||||
result = check.execute()
|
||||
@@ -164,5 +169,5 @@ class Test_monitor_alert_service_health_exists:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"There is no activity log alert for Service Health in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+7
-3
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
|
||||
self,
|
||||
):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {}
|
||||
|
||||
with (
|
||||
@@ -34,7 +37,7 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
|
||||
def test_no_diagnostic_settings(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -58,11 +61,12 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"No diagnostic setting captures all appropriate categories (Administrative, Security, Alert, Policy) in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"No diagnostic setting captures all appropriate categories (Administrative, Security, Alert, Policy) in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_diagnostic_settings_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -128,5 +132,5 @@ class Test_monitor_diagnostic_setting_with_appropriate_categories:
|
||||
assert result[0].resource_name == "name"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Diagnostic setting name captures appropriate categories in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Diagnostic setting name captures appropriate categories in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+8
-3
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ class Test_monitor_diagnostic_settings_exists:
|
||||
self,
|
||||
):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {}
|
||||
|
||||
with (
|
||||
@@ -34,7 +37,7 @@ class Test_monitor_diagnostic_settings_exists:
|
||||
def test_no_diagnostic_settings(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
with (
|
||||
mock.patch(
|
||||
"prowler.providers.common.provider.Provider.get_global_provider",
|
||||
@@ -58,12 +61,14 @@ class Test_monitor_diagnostic_settings_exists:
|
||||
assert result[0].resource_id == f"/subscriptions/{AZURE_SUBSCRIPTION_ID}"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"No diagnostic settings found in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"No diagnostic settings found in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_diagnostic_settings_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
storage_client = mock.MagicMock
|
||||
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -196,5 +201,5 @@ class Test_monitor_diagnostic_settings_exists:
|
||||
assert result[0].resource_id == "id"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Diagnostic setting name found in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Diagnostic setting name found in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+8
-2
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
|
||||
self,
|
||||
):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
|
||||
|
||||
def test_no_diagnostic_settings(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -54,7 +58,9 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
|
||||
|
||||
def test_diagnostic_settings_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
storage_client = mock.MagicMock
|
||||
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -191,7 +197,7 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity log in subscription {AZURE_SUBSCRIPTION_ID} is encrypted with Customer Managed Key or not necessary."
|
||||
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity log in subscription {AZURE_SUBSCRIPTION_DISPLAY} is encrypted with Customer Managed Key or not necessary."
|
||||
)
|
||||
assert result[1].status == "FAIL"
|
||||
assert result[1].resource_name == "storageaccountname2"
|
||||
@@ -202,5 +208,5 @@ class Test_monitor_storage_account_with_activity_logs_cmk_encrypted:
|
||||
)
|
||||
assert (
|
||||
result[1].status_extended
|
||||
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity log in subscription {AZURE_SUBSCRIPTION_ID} is not encrypted with Customer Managed Key."
|
||||
== f"Storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity log in subscription {AZURE_SUBSCRIPTION_DISPLAY} is not encrypted with Customer Managed Key."
|
||||
)
|
||||
+8
-2
@@ -1,7 +1,9 @@
|
||||
from unittest import mock
|
||||
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -11,6 +13,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
|
||||
self,
|
||||
):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {}
|
||||
|
||||
with (
|
||||
@@ -33,6 +36,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
|
||||
|
||||
def test_no_diagnostic_settings(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
monitor_client.diagnostics_settings = {AZURE_SUBSCRIPTION_ID: []}
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -54,7 +58,9 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
|
||||
|
||||
def test_diagnostic_settings_configured(self):
|
||||
monitor_client = mock.MagicMock
|
||||
monitor_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
storage_client = mock.MagicMock
|
||||
storage_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -190,7 +196,7 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
|
||||
assert result[0].resource_name == "storageaccountname1"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Blob public access enabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Blob public access enabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][0].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[1].status == "PASS"
|
||||
@@ -202,5 +208,5 @@ class Test_monitor_storage_account_with_activity_logs_is_private:
|
||||
assert result[1].resource_name == "storageaccountname2"
|
||||
assert (
|
||||
result[1].status_extended
|
||||
== f"Blob public access disabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Blob public access disabled in storage account {storage_client.storage_accounts[AZURE_SUBSCRIPTION_ID][1].name} storing activity logs in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+12
-4
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
|
||||
FlexibleServer,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
def test_mysql_no_subscriptions(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
|
||||
def test_mysql_no_servers(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
def test_mysql_audit_log_connection_activated_lowercase(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_audit_log_connection_not_connection(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_audit_log_connection_activated(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -206,12 +213,13 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_audit_log_connection_activated_with_other_options(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -257,5 +265,5 @@ class Test_mysql_flexible_server_audit_log_connection_activated:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+10
-3
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
|
||||
FlexibleServer,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_mysql_flexible_server_audit_log_enabled:
|
||||
def test_mysql_no_subscriptions(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_audit_log_enabled:
|
||||
|
||||
def test_mysql_no_servers(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_audit_log_enabled:
|
||||
def test_mysql_audit_log_enabled_lowercase(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_audit_log_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_audit_log_disabled(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_audit_log_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_audit_log_enabled(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -206,5 +213,5 @@ class Test_mysql_flexible_server_audit_log_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Audit log is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+14
-5
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
|
||||
FlexibleServer,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
def test_mysql_no_subscriptions(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
|
||||
def test_mysql_no_servers(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
def test_mysql_no_tls_configuration(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -94,12 +99,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
assert result[0].location == "location"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"TLS version is not configured in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"TLS version is not configured in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_flexible_server_minimum_tls_version_12(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -144,12 +150,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"TLS version is TLSv1.2 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. This version of TLS is considered secure."
|
||||
== f"TLS version is TLSv1.2 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. This version of TLS is considered secure."
|
||||
)
|
||||
|
||||
def test_mysql_tls_version_is_1_3(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -194,12 +201,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"TLS version is TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. This version of TLS is considered secure."
|
||||
== f"TLS version is TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. This version of TLS is considered secure."
|
||||
)
|
||||
|
||||
def test_mysql_tls_version_is_not_1_2(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -244,12 +252,13 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"TLS version is TLSv1.1 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. There is at leat one version of TLS that is considered insecure."
|
||||
== f"TLS version is TLSv1.1 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. There is at leat one version of TLS that is considered insecure."
|
||||
)
|
||||
|
||||
def test_mysql_tls_version_is_1_1_and_1_3(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -294,5 +303,5 @@ class Test_mysql_flexible_server_minimum_tls_version_12:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"TLS version is TLSv1.1,TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}. There is at leat one version of TLS that is considered insecure."
|
||||
== f"TLS version is TLSv1.1,TLSv1.3 in server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}. There is at leat one version of TLS that is considered insecure."
|
||||
)
|
||||
+15
-6
@@ -6,7 +6,9 @@ from prowler.providers.azure.services.mysql.mysql_service import (
|
||||
FlexibleServer,
|
||||
)
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -14,6 +16,7 @@ from tests.providers.azure.azure_fixtures import (
|
||||
class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
def test_mysql_no_subscriptions(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {}
|
||||
|
||||
with (
|
||||
@@ -36,6 +39,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
|
||||
def test_mysql_no_servers(self):
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {AZURE_SUBSCRIPTION_ID: {}}
|
||||
|
||||
with (
|
||||
@@ -59,6 +63,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
def test_mysql_connection_enabled(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -104,12 +109,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_connection_enabled_lowercase(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -155,12 +161,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_ssl_connection_disabled(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -206,12 +213,13 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_ssl_connection_no_configuration(self):
|
||||
server_name = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id": FlexibleServer(
|
||||
@@ -248,13 +256,14 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
assert result[0].location == "location"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
|
||||
def test_mysql_ssl_connection_enabled_and_disabled(self):
|
||||
server_name_1 = str(uuid4())
|
||||
server_name_2 = str(uuid4())
|
||||
mysql_client = mock.MagicMock
|
||||
mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
mysql_client.flexible_servers = {
|
||||
AZURE_SUBSCRIPTION_ID: {
|
||||
"/subscriptions/resource_id1": FlexibleServer(
|
||||
@@ -313,7 +322,7 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
)
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"SSL connection is enabled for server {server_name_1} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is enabled for server {server_name_1} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[1].status == "FAIL"
|
||||
assert result[1].subscription == AZURE_SUBSCRIPTION_ID
|
||||
@@ -325,5 +334,5 @@ class Test_mysql_flexible_server_ssl_connection_enabled:
|
||||
)
|
||||
assert (
|
||||
result[1].status_extended
|
||||
== f"SSL connection is disabled for server {server_name_2} in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"SSL connection is disabled for server {server_name_2} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
+6
-3
@@ -3,7 +3,9 @@ from uuid import uuid4
|
||||
|
||||
from prowler.providers.azure.services.network.network_service import BastionHost
|
||||
from tests.providers.azure.azure_fixtures import (
|
||||
AZURE_SUBSCRIPTION_DISPLAY,
|
||||
AZURE_SUBSCRIPTION_ID,
|
||||
AZURE_SUBSCRIPTION_NAME,
|
||||
set_mocked_azure_provider,
|
||||
)
|
||||
|
||||
@@ -12,7 +14,7 @@ class Test_network_bastion_host_exists:
|
||||
def test_no_bastion_hosts(self):
|
||||
network_client = mock.MagicMock
|
||||
network_client.bastion_hosts = {AZURE_SUBSCRIPTION_ID: []}
|
||||
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_ID}
|
||||
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
|
||||
with (
|
||||
mock.patch(
|
||||
@@ -38,7 +40,7 @@ class Test_network_bastion_host_exists:
|
||||
assert result[0].status == "FAIL"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Bastion Host from subscription {AZURE_SUBSCRIPTION_ID} does not exist"
|
||||
== f"Bastion Host from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not exist"
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == AZURE_SUBSCRIPTION_ID
|
||||
@@ -46,6 +48,7 @@ class Test_network_bastion_host_exists:
|
||||
|
||||
def test_network_bastion_host_exists(self):
|
||||
network_client = mock.MagicMock
|
||||
network_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
|
||||
bastion_host_name = "Bastion Host Name"
|
||||
bastion_host_id = str(uuid4())
|
||||
|
||||
@@ -83,7 +86,7 @@ class Test_network_bastion_host_exists:
|
||||
assert result[0].status == "PASS"
|
||||
assert (
|
||||
result[0].status_extended
|
||||
== f"Bastion Host {bastion_host_name} exists in subscription {AZURE_SUBSCRIPTION_ID}."
|
||||
== f"Bastion Host {bastion_host_name} exists in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
|
||||
)
|
||||
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
|
||||
assert result[0].resource_name == bastion_host_name
|
||||
|
||||
Loaded 100 of 339 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user