Skip to content

Commit

Permalink
feat(arm): CKV_AZURE_88 convert to arm check (#5465)
Browse files Browse the repository at this point in the history 
* convert to arm check

* a comma too far

* adjust check logic

* fix lint

---------

Co-authored-by: Anton Grübel <[email protected]>
  • Loading branch information
@JamesWoolfenden @gruebel
JamesWoolfenden and gruebel committed Sep 27, 2023
1 parent c64513e commit 2e66ec6
Show file tree
Hide file tree
Showing 6 changed files with 628 additions and 44 deletions.
28 changes: 28 additions & 0 deletions checkov/arm/checks/resource/AppServiceUsedAzureFiles.py
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
from __future__ import annotations

from typing import Any

from checkov.arm.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckCategories, CheckResult


class AppServiceUsedAzureFiles(BaseResourceCheck):
def __init__(self) -> None:
name = "Ensure that app services use Azure Files"
id = "CKV_AZURE_88"
supported_resources = ("Microsoft.Web/sites/config",)
categories = (CheckCategories.GENERAL_SECURITY,)
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)

def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
properties = conf.get('properties')
if properties and isinstance(properties, dict):
azureStorageAccounts = properties.get("azureStorageAccounts")
if azureStorageAccounts and isinstance(azureStorageAccounts, dict):
for account_data in azureStorageAccounts.values():
if isinstance(account_data, dict) and account_data.get('type') == "AzureFiles":
return CheckResult.PASSED
return CheckResult.FAILED


check = AppServiceUsedAzureFiles()
189 changes: 189 additions & 0 deletions ...hecks/resource/example_AppServiceUsedAzureFiles/AppServiceEnableFailedRequest-failed.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,189 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"sites_pike_name": {
"defaultValue": "pike",
"type": "String"
},
"serverfarms_example_serviceplan_externalid": {
"defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan",
"type": "String"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Web/sites",
"apiVersion": "2022-09-01",
"name": "[parameters('sites_pike_name')]",
"location": "UK South",
"kind": "app,linux",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"enabled": true,
"hostNameSslStates": [
{
"name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]",
"sslState": "Disabled",
"hostType": "Standard"
},
{
"name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]",
"sslState": "Disabled",
"hostType": "Repository"
}
],
"serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]",
"reserved": true,
"isXenon": false,
"hyperV": false,
"vnetRouteAllEnabled": false,
"vnetImagePullEnabled": false,
"vnetContentShareEnabled": false,
"siteConfig": {
"numberOfWorkers": 1,
"acrUseManagedIdentityCreds": false,
"alwaysOn": false,
"http20Enabled": true,
"functionAppScaleLimit": 0,
"minimumElasticInstanceCount": 0
},
"scmSiteAlsoStopped": false,
"clientAffinityEnabled": false,
"clientCertEnabled": true,
"clientCertMode": "Required",
"hostNamesDisabled": false,
"customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5",
"containerSize": 0,
"dailyMemoryTimeQuota": 0,
"httpsOnly": true,
"redundancyMode": "None",
"storageAccountRequired": false,
"keyVaultReferenceIdentity": "SystemAssigned"
}
},
{
"type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
"apiVersion": "2022-09-01",
"name": "[concat(parameters('sites_pike_name'), '/ftp')]",
"location": "UK South",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]"
],
"properties": {
"allow": true
}
},
{
"type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
"apiVersion": "2022-09-01",
"name": "[concat(parameters('sites_pike_name'), '/scm')]",
"location": "UK South",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]"
],
"properties": {
"allow": true
}
},
{
"type": "Microsoft.Web/sites/config",
"apiVersion": "2022-09-01",
"name": "failed",
"location": "UK South",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]"
],
"properties": {
"numberOfWorkers": 1,
"defaultDocuments": [],
"netFrameworkVersion": "v4.0",
"requestTracingEnabled": false,
"requestTracingExpirationTime": "9999-12-31T23:59:00Z",
"remoteDebuggingEnabled": false,
"remoteDebuggingVersion": "VS2019",
"httpLoggingEnabled": true,
"acrUseManagedIdentityCreds": false,
"logsDirectorySizeLimit": 25,
"detailedErrorLoggingEnabled": true,
"publishingUsername": "$pike",
"scmType": "None",
"use32BitWorkerProcess": false,
"webSocketsEnabled": false,
"alwaysOn": false,
"managedPipelineMode": "Integrated",
"virtualApplications": [
{
"virtualPath": "/",
"physicalPath": "site\\wwwroot",
"preloadEnabled": false
}
],
"loadBalancing": "LeastRequests",
"experiments": {
"rampUpRules": []
},
"autoHealEnabled": false,
"vnetRouteAllEnabled": false,
"vnetPrivatePortsCount": 0,
"cors": {
"supportCredentials": false
},
"localMySqlEnabled": false,
"managedServiceIdentityId": 484,
"ipSecurityRestrictions": [
{
"ipAddress": "Any",
"action": "Allow",
"priority": 2147483647,
"name": "Allow all",
"description": "Allow all access"
}
],
"scmIpSecurityRestrictions": [
{
"ipAddress": "Any",
"action": "Allow",
"priority": 2147483647,
"name": "Allow all",
"description": "Allow all access"
}
],
"scmIpSecurityRestrictionsUseMain": false,
"http20Enabled": true,
"minTlsVersion": "1.2",
"scmMinTlsVersion": "1.2",
"ftpsState": "FtpsOnly",
"preWarmedInstanceCount": 0,
"elasticWebAppScaleLimit": 0,
"healthCheckPath": "/health",
"functionsRuntimeScaleMonitoringEnabled": false,
"minimumElasticInstanceCount": 0,
"azureStorageAccounts": {
"shady": {
"type": "AzureBlob",
"accountName": "piketest",
"shareName": "pike",
"mountPath": "/mount/shady"
}
}
}
},
{
"type": "Microsoft.Web/sites/hostNameBindings",
"apiVersion": "2022-09-01",
"name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]",
"location": "UK South",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]"
],
"properties": {
"siteName": "pike",
"hostNameType": "Verified"
}
}
]
}
Loading

0 comments on commit 2e66ec6

Please sign in to comment.