From de76a168c0c1ca77cd6263d36bc57cbfec38c558 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Thu, 16 Jan 2025 17:44:43 +0100 Subject: [PATCH] feat(storage): extract Storage resource metadata automated (#6563) Co-authored-by: Sergio Garcia --- .../storage_blob_public_access_level_is_disabled.py | 8 ++++---- .../storage_default_network_access_rule_is_denied.py | 8 ++++---- ...ure_azure_services_are_trusted_to_access_is_enabled.py | 8 ++++---- ...torage_ensure_encryption_with_customer_managed_keys.py | 8 ++++---- .../storage_ensure_minimum_tls_version_12.py | 8 ++++---- ...torage_ensure_private_endpoints_in_storage_accounts.py | 7 +++---- .../storage_ensure_soft_delete_is_enabled.py | 7 +++---- .../storage_infrastructure_encryption_is_enabled.py | 7 +++---- .../storage_key_rotation_90_days.py | 7 +++---- .../storage_secure_transfer_required_is_enabled.py | 7 +++---- 10 files changed, 35 insertions(+), 40 deletions(-) diff --git a/prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py b/prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py index a0507b3dfa..81ce442ae6 100644 --- a/prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py +++ b/prowler/providers/azure/services/storage/storage_blob_public_access_level_is_disabled/storage_blob_public_access_level_is_disabled.py @@ -7,13 +7,13 @@ class storage_blob_public_access_level_is_disabled(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "FAIL" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has allow blob public access enabled." - report.resource_name = storage_account.name - report.resource_id = storage_account.id + if not storage_account.allow_blob_public_access: report.status = "PASS" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has allow blob public access disabled." diff --git a/prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py b/prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py index 2b426e12f7..dcb79d1e67 100644 --- a/prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py +++ b/prowler/providers/azure/services/storage/storage_default_network_access_rule_is_denied/storage_default_network_access_rule_is_denied.py @@ -7,13 +7,13 @@ class storage_default_network_access_rule_is_denied(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has network access rule set to Deny." - report.resource_name = storage_account.name - report.resource_id = storage_account.id + if storage_account.network_rule_set.default_action == "Allow": report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has network access rule set to Allow." diff --git a/prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py b/prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py index dca6e61dfb..9a136052e6 100644 --- a/prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py +++ b/prowler/providers/azure/services/storage/storage_ensure_azure_services_are_trusted_to_access_is_enabled/storage_ensure_azure_services_are_trusted_to_access_is_enabled.py @@ -7,13 +7,13 @@ class storage_ensure_azure_services_are_trusted_to_access_is_enabled(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} allows trusted Microsoft services to access this storage account." - report.resource_name = storage_account.name - report.resource_id = storage_account.id + if "AzureServices" not in storage_account.network_rule_set.bypass: report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not allow trusted Microsoft services to access this storage account." diff --git a/prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py b/prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py index 5b4d9271a5..370bb3bd6c 100644 --- a/prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py +++ b/prowler/providers/azure/services/storage/storage_ensure_encryption_with_customer_managed_keys/storage_ensure_encryption_with_customer_managed_keys.py @@ -7,13 +7,13 @@ class storage_ensure_encryption_with_customer_managed_keys(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} encrypts with CMKs." - report.resource_name = storage_account.name - report.resource_id = storage_account.id + if storage_account.encryption_type != "Microsoft.Keyvault": report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not encrypt with CMKs." diff --git a/prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py b/prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py index 15b47f0bac..2f8f049b12 100644 --- a/prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py +++ b/prowler/providers/azure/services/storage/storage_ensure_minimum_tls_version_12/storage_ensure_minimum_tls_version_12.py @@ -7,13 +7,13 @@ class storage_ensure_minimum_tls_version_12(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has TLS version set to 1.2." - report.resource_name = storage_account.name - report.resource_id = storage_account.id + if storage_account.minimum_tls_version != "TLS1_2": report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} does not have TLS version set to 1.2." diff --git a/prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py b/prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py index 68778ff335..7805875531 100644 --- a/prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py +++ b/prowler/providers/azure/services/storage/storage_ensure_private_endpoints_in_storage_accounts/storage_ensure_private_endpoints_in_storage_accounts.py @@ -7,11 +7,10 @@ class storage_ensure_private_endpoints_in_storage_accounts(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription - report.resource_name = storage_account.name - report.resource_id = storage_account.id - report.location = storage_account.location if storage_account.private_endpoint_connections: report.status = "PASS" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has private endpoint connections." diff --git a/prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py b/prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py index 82906b1368..2b16f23941 100644 --- a/prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py +++ b/prowler/providers/azure/services/storage/storage_ensure_soft_delete_is_enabled/storage_ensure_soft_delete_is_enabled.py @@ -8,11 +8,10 @@ class storage_ensure_soft_delete_is_enabled(Check): for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: if storage_account.blob_properties: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription - report.resource_name = storage_account.name - report.resource_id = storage_account.id - report.location = storage_account.location if getattr( storage_account.blob_properties.container_delete_retention_policy, "enabled", diff --git a/prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py b/prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py index 1413fb5ae8..7113bfca44 100644 --- a/prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py +++ b/prowler/providers/azure/services/storage/storage_infrastructure_encryption_is_enabled/storage_infrastructure_encryption_is_enabled.py @@ -7,13 +7,12 @@ class storage_infrastructure_encryption_is_enabled(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has infrastructure encryption enabled." - report.resource_name = storage_account.name - report.resource_id = storage_account.id if not storage_account.infrastructure_encryption: report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has infrastructure encryption disabled." diff --git a/prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py b/prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py index 4625e14a37..caf4f173e7 100644 --- a/prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py +++ b/prowler/providers/azure/services/storage/storage_key_rotation_90_days/storage_key_rotation_90_days.py @@ -7,11 +7,10 @@ class storage_key_rotation_90_days(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription - report.resource_name = storage_account.name - report.resource_id = storage_account.id - report.location = storage_account.location if not storage_account.key_expiration_period_in_days: report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has no key expiration period set." diff --git a/prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py b/prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py index a8039542fb..893906d1b8 100644 --- a/prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py +++ b/prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/storage_secure_transfer_required_is_enabled.py @@ -7,13 +7,12 @@ class storage_secure_transfer_required_is_enabled(Check): findings = [] for subscription, storage_accounts in storage_client.storage_accounts.items(): for storage_account in storage_accounts: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription report.status = "PASS" - report.location = storage_account.location report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required enabled." - report.resource_name = storage_account.name - report.resource_id = storage_account.id if not storage_account.enable_https_traffic_only: report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required disabled."