feat(storage): extract Storage resource metadata automated (#6563)

Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py

@@ -7,13 +7,13 @@ class storage_blob_public_access_level_is_disabled(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "FAIL"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has allow blob public access enabled."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
+
                 if not storage_account.allow_blob_public_access:
                     report.status = "PASS"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has allow blob public access disabled."

prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py

@@ -7,13 +7,13 @@ class storage_default_network_access_rule_is_denied(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has network access rule set to Deny."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
+
                 if storage_account.network_rule_set.default_action == "Allow":
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has network access rule set to Allow."

prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py

@@ -7,13 +7,13 @@ class storage_ensure_azure_services_are_trusted_to_access_is_enabled(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} allows trusted Microsoft services to access this storage account."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
+
                 if "AzureServices" not in storage_account.network_rule_set.bypass:
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not allow trusted Microsoft services to access this storage account."

prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py

@@ -7,13 +7,13 @@ class storage_ensure_encryption_with_customer_managed_keys(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} encrypts with CMKs."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
+
                 if storage_account.encryption_type != "Microsoft.Keyvault":
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not encrypt with CMKs."

prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py

@@ -7,13 +7,13 @@ class storage_ensure_minimum_tls_version_12(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has TLS version set to 1.2."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
+
                 if storage_account.minimum_tls_version != "TLS1_2":
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not have TLS version set to 1.2."

prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py

@@ -7,11 +7,10 @@ class storage_ensure_private_endpoints_in_storage_accounts(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
-                report.location = storage_account.location
                 if storage_account.private_endpoint_connections:
                     report.status = "PASS"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has private endpoint connections."

prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py

@@ -8,11 +8,10 @@ class storage_ensure_soft_delete_is_enabled(Check):
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
                 if storage_account.blob_properties:
-                    report = Check_Report_Azure(self.metadata())
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource_metadata=storage_account
+                    )
                     report.subscription = subscription
-                    report.resource_name = storage_account.name
-                    report.resource_id = storage_account.id
-                    report.location = storage_account.location
                     if getattr(
                         storage_account.blob_properties.container_delete_retention_policy,
                         "enabled",

prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py

@@ -7,13 +7,12 @@ class storage_infrastructure_encryption_is_enabled(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has infrastructure encryption enabled."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
                 if not storage_account.infrastructure_encryption:
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has infrastructure encryption disabled."

prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py

@@ -7,11 +7,10 @@ class storage_key_rotation_90_days(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
-                report.location = storage_account.location
                 if not storage_account.key_expiration_period_in_days:
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has no key expiration period set."

prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py

@@ -7,13 +7,12 @@ class storage_secure_transfer_required_is_enabled(Check):
         findings = []
         for subscription, storage_accounts in storage_client.storage_accounts.items():
             for storage_account in storage_accounts:
-                report = Check_Report_Azure(self.metadata())
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource_metadata=storage_account
+                )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.location = storage_account.location
                 report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required enabled."
-                report.resource_name = storage_account.name
-                report.resource_id = storage_account.id
                 if not storage_account.enable_https_traffic_only:
                     report.status = "FAIL"
                     report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required disabled."