From e420ff31d104bd2b9f3222d34ad3b71bc535d38e Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Fri, 14 Mar 2025 13:23:51 +0100 Subject: [PATCH] Revert "refactor: rename entra_policy_ensure_default_user_cannot_create_tenants" This reverts commit 55a8310334420cbb246f64e21615fcc5718d8d32. --- .../__init__.py | 0 ...t_user_cannot_create_tenants.metadata.json | 30 ++++ ...sure_default_user_cannot_create_tenants.py | 33 ++++ .../__init__.py | 0 ..._user_cannot_create_tenants.metadata.json} | 2 +- ...ure_default_user_cannot_create_tenants.py} | 2 +- ...default_user_cannot_create_tenants_test.py | 152 ++++++++++++++++++ ...efault_user_cannot_create_tenants_test.py} | 26 +-- 8 files changed, 230 insertions(+), 15 deletions(-) rename prowler/providers/{microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants => azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants}/__init__.py (100%) create mode 100644 prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json create mode 100644 prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py create mode 100644 prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py rename prowler/providers/microsoft365/services/entra/{entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json => entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json} (95%) rename prowler/providers/microsoft365/services/entra/{entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py => entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py} (96%) create mode 100644 tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py rename tests/providers/microsoft365/services/entra/{entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py => entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py} (75%) diff --git a/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/__init__.py b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py similarity index 100% rename from prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/__init__.py rename to prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py diff --git a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json new file mode 100644 index 0000000000..4d7a2d7bd9 --- /dev/null +++ b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants", + "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'", + "CheckType": [], + "ServiceName": "entra", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "#microsoft.graph.authorizationPolicy", + "Description": "Require administrators or appropriately delegated users to create new tenants.", + "Risk": "It is recommended to only allow an administrator to create new tenants. This prevent users from creating new Azure AD or Azure AD B2C tenants and ensures that only authorized users are able to do so.", + "RelatedUrl": "https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. From Azure Home select the Portal Menu 2. Select Azure Active Directory 3. Select Users 4. Select User settings 5. Set 'Restrict non-admin users from creating' tenants to 'Yes'", + "Url": "https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#tenant-creator" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Enforcing this setting will ensure that only authorized users are able to create new tenants." +} diff --git a/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py new file mode 100644 index 0000000000..6f621d1042 --- /dev/null +++ b/prowler/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py @@ -0,0 +1,33 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.entra.entra_client import entra_client + + +class entra_policy_ensure_default_user_cannot_create_tenants(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for tenant_domain, auth_policy in entra_client.authorization_policy.items(): + report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy) + report.subscription = f"Tenant: {tenant_domain}" + report.resource_name = getattr(auth_policy, "name", "Authorization Policy") + report.resource_id = getattr(auth_policy, "id", "authorizationPolicy") + report.status = "FAIL" + report.status_extended = ( + "Tenants creation is not disabled for non-admin users." + ) + + if getattr( + auth_policy, "default_user_role_permissions", None + ) and not getattr( + auth_policy.default_user_role_permissions, + "allowed_to_create_tenants", + True, + ): + report.status = "PASS" + report.status_extended = ( + "Tenants creation is disabled for non-admin users." + ) + + findings.append(report) + + return findings diff --git a/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json similarity index 95% rename from prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json rename to prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json index 3144ad0123..12a0da5cf9 100644 --- a/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.metadata.json +++ b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.metadata.json @@ -1,6 +1,6 @@ { "Provider": "microsoft365", - "CheckID": "entra_authpolicy_ensure_default_user_cannot_create_tenants", + "CheckID": "entra_policy_ensure_default_user_cannot_create_tenants", "CheckTitle": "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'", "CheckType": [], "ServiceName": "entra", diff --git a/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py similarity index 96% rename from prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py rename to prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py index 1157d6b5ee..de2c2112eb 100644 --- a/prowler/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants.py +++ b/prowler/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants.py @@ -4,7 +4,7 @@ from prowler.lib.check.models import Check, CheckReportMicrosoft365 from prowler.providers.microsoft365.services.entra.entra_client import entra_client -class entra_authpolicy_ensure_default_user_cannot_create_tenants(Check): +class entra_policy_ensure_default_user_cannot_create_tenants(Check): """Check if default users are restricted from creating tenants. This check verifies whether the authorization policy prevents non-admin users diff --git a/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py new file mode 100644 index 0000000000..7e97b4558d --- /dev/null +++ b/tests/providers/azure/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/entra_policy_ensure_default_user_cannot_create_tenants_test.py @@ -0,0 +1,152 @@ +from unittest import mock +from uuid import uuid4 + +from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provider + + +class Test_entra_policy_ensure_default_user_cannot_create_tenants: + def test_entra_no_tenants(self): + entra_client = mock.MagicMock + entra_client.authorization_policy = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + new=entra_client, + ), + ): + from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, + ) + + check = entra_policy_ensure_default_user_cannot_create_tenants() + result = check.execute() + assert len(result) == 0 + + def test_entra_empty_tenant(self): + entra_client = mock.MagicMock + entra_client.authorization_policy = {DOMAIN: {}} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + new=entra_client, + ), + ): + from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, + ) + + check = entra_policy_ensure_default_user_cannot_create_tenants() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == f"Tenant: {DOMAIN}" + assert result[0].resource_name == "Authorization Policy" + assert result[0].resource_id == "authorizationPolicy" + assert ( + result[0].status_extended + == "Tenants creation is not disabled for non-admin users." + ) + + def test_entra_default_user_role_permissions_not_allowed_to_create_tenants(self): + id = str(uuid4()) + entra_client = mock.MagicMock + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + new=entra_client, + ), + ): + from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, + ) + from prowler.providers.azure.services.entra.entra_service import ( + AuthorizationPolicy, + DefaultUserRolePermissions, + ) + + entra_client.authorization_policy = { + DOMAIN: AuthorizationPolicy( + id=id, + name="Test", + description="Test", + default_user_role_permissions=DefaultUserRolePermissions( + allowed_to_create_tenants=False + ), + guest_invite_settings="everyone", + guest_user_role_id=uuid4(), + ) + } + + check = entra_policy_ensure_default_user_cannot_create_tenants() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "Tenants creation is disabled for non-admin users." + ) + assert result[0].resource_name == "Test" + assert result[0].resource_id == id + assert result[0].subscription == f"Tenant: {DOMAIN}" + + def test_entra_default_user_role_permissions_allowed_to_create_tenants(self): + id = str(uuid4()) + entra_client = mock.MagicMock + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", + new=entra_client, + ), + ): + from prowler.providers.azure.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, + ) + from prowler.providers.azure.services.entra.entra_service import ( + AuthorizationPolicy, + DefaultUserRolePermissions, + ) + + entra_client.authorization_policy = { + DOMAIN: AuthorizationPolicy( + id=id, + name="Test", + description="Test", + default_user_role_permissions=DefaultUserRolePermissions( + allowed_to_create_tenants=True + ), + guest_invite_settings="everyone", + guest_user_role_id=uuid4(), + ) + } + + check = entra_policy_ensure_default_user_cannot_create_tenants() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Tenants creation is not disabled for non-admin users." + ) + assert result[0].resource_name == "Test" + assert result[0].resource_id == id + assert result[0].subscription == f"Tenant: {DOMAIN}" diff --git a/tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py b/tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py similarity index 75% rename from tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py rename to tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py index a89fbb1f84..5c615b1da0 100644 --- a/tests/providers/microsoft365/services/entra/entra_authpolicy_ensure_default_user_cannot_create_tenants/entra_authpolicy_ensure_default_user_cannot_create_tenants_test.py +++ b/tests/providers/microsoft365/services/entra/entra_policy_ensure_default_user_cannot_create_tenants/microsoft365_entra_policy_ensure_default_user_cannot_create_tenants_test.py @@ -10,7 +10,7 @@ from tests.providers.microsoft365.microsoft365_fixtures import ( ) -class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: +class Test_entra_policy_ensure_default_user_cannot_create_tenants: def test_entra_empty_tenant(self): entra_client = mock.MagicMock entra_client.authorization_policy = {} @@ -21,15 +21,15 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( - entra_authpolicy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, ) - check = entra_authpolicy_ensure_default_user_cannot_create_tenants() + check = entra_policy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" @@ -52,12 +52,12 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( - entra_authpolicy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, ) entra_client.authorization_policy = AuthorizationPolicy( @@ -69,7 +69,7 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: ), ) - check = entra_authpolicy_ensure_default_user_cannot_create_tenants() + check = entra_policy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "FAIL" @@ -92,12 +92,12 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: return_value=set_mocked_microsoft365_provider(), ), mock.patch( - "prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_client", + "prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants.entra_client", new=entra_client, ), ): - from prowler.providers.microsoft365.services.entra.entra_authpolicy_ensure_default_user_cannot_create_tenants.entra_authpolicy_ensure_default_user_cannot_create_tenants import ( - entra_authpolicy_ensure_default_user_cannot_create_tenants, + from prowler.providers.microsoft365.services.entra.entra_policy_ensure_default_user_cannot_create_tenants.entra_policy_ensure_default_user_cannot_create_tenants import ( + entra_policy_ensure_default_user_cannot_create_tenants, ) entra_client.authorization_policy = AuthorizationPolicy( @@ -109,7 +109,7 @@ class Test_entra_authpolicy_ensure_default_user_cannot_create_tenants: ), ) - check = entra_authpolicy_ensure_default_user_cannot_create_tenants() + check = entra_policy_ensure_default_user_cannot_create_tenants() result = check.execute() assert len(result) == 1 assert result[0].status == "PASS"