Skip to content

Commit cfbec87

Browse files
silverhacksilverhack
committed
update checks for Azure Compute and Database
1 parent 22d469e commit cfbec87

51 files changed

Lines changed: 6248 additions & 6 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎rules/findings/azure/appservices/azure-app-authentication-disabled.json‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
{
2+
"args": [],
3+
"provider": "Azure",
4+
"serviceType": "App Service",
5+
"serviceName": "Hosted Services",
6+
"displayName": "Ensure authentication is set to 'Enabled' for _ARG_0_",
7+
"description": "App Service authentication can prevent anonymous HTTP requests from reaching an app, or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a login page. To handle the login process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.",
8+
"rationale": "By enabling authentication, every incoming HTTP request passes through it before being handled by the application code. It also handles authentication of users with the specified provider (Entra ID, Facebook, Google, Microsoft Account, and Twitter), validation, storage and refreshing of tokens, managing the authenticated sessions, and injecting identity information into request headers.",
9+
"impact": "This is only required for apps that require authentication. Enabling it on a site like a marketing or support website will prevent unauthenticated access, which would be undesirable.<br/><br/>Adding an authentication requirement will increase costs and require additional security components to facilitate the authentication.",
10+
"remediation": {
11+
"text": "
12+
#### Remediate from Azure Portal
13+
1. Go to App Services.
14+
2. Click the name of an app.
15+
3. Under Settings, click Authentication.
16+
4. If an identity provider is not configured:
17+
1. Click Add identity provider.
18+
2. Provide appropriate configuration for an identity provider and click Add.
19+
5. If App Service authentication is set to Disabled:
20+
1. Click Enable authentication.
21+
6. Repeat steps 1-5 for each app requiring remediation.
22+
",
23+
"code": {
24+
"powerShell": null,
25+
"iac": null,
26+
"terraform": null,
27+
"other": null
28+
}
29+
},
30+
"recommendation": null,
31+
"references": [
32+
"https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization",
33+
"https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#website-contributor",
34+
"https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-privileged-access#pa-3-manage-lifecycle-of-identities-and-entitlements",
35+
"https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy"
36+
],
37+
"compliance": [
38+
{
39+
"name": "CIS Microsoft Azure Foundations",
40+
"version": "2.0.0",
41+
"reference": "2.1.12",
42+
"profile": [
43+
"Level 2"
44+
]
45+
}
46+
],
47+
"level": "low",
48+
"tags": [],
49+
"rule": {
50+
"path": "az_app_services",
51+
"subPath": null,
52+
"selectCondition": [
53+
{
54+
"filter": [
55+
{
56+
"include": "_ARG_1_"
57+
}
58+
]
59+
}
60+
],
61+
"query": [
62+
{
63+
"filter": [
64+
{
65+
"conditions": [
66+
[
67+
"eq",
68+
"authSettingsV2"
69+
],
70+
[
71+
"authSettingsV2.properties.platform.enabled",
72+
"eq",
73+
"False"
74+
]
75+
],
76+
"operator":"or"
77+
}
78+
]
79+
},
80+
{
81+
"connectOperator":"and",
82+
"filter": [
83+
{
84+
"conditions": [
85+
[
86+
"eq",
87+
"authSettings"
88+
],
89+
[
90+
"authSettings.properties.enabled",
91+
"eq",
92+
"False"
93+
]
94+
],
95+
"operator":"or"
96+
}
97+
]
98+
}
99+
],
100+
"shouldExist": null,
101+
"returnObject": null,
102+
"removeIfNotExists": null
103+
},
104+
"output": {
105+
"html": {
106+
"data": {
107+
"properties": {
108+
"name": "Name",
109+
"location": "location",
110+
"resourceGroupName": "Resource Group Name",
111+
"authSettings":"Auth Settings",
112+
"authSettingsV2":"Auth Settings V2"
113+
},
114+
"expandObject": null
115+
},
116+
"table": "default",
117+
"decorate": [],
118+
"emphasis": [],
119+
"actions": {
120+
"objectData": {
121+
"properties": [
122+
"name",
123+
"location",
124+
"resourceGroupName",
125+
"authSettings",
126+
"authSettingsV2"
127+
],
128+
"expandObject": null,
129+
"limit": null
130+
},
131+
"showGoToButton": "True",
132+
"showModalButton": "True",
133+
"directLink": null
134+
}
135+
},
136+
"text": {
137+
"data": {
138+
"properties": {
139+
"name": "Name",
140+
"location": "location",
141+
"resourceGroupName": "Resource Group Name",
142+
"authSettings":"Auth Settings",
143+
"authSettingsV2":"Auth Settings V2"
144+
},
145+
"expandObject": null
146+
},
147+
"status": {
148+
"keyName": ["name"],
149+
"message": "Ensure 'App Service authentication' is set to 'Enabled' for {name}",
150+
"defaultMessage": "Ensure authentication is set to 'Enabled' for _ARG_0_"
151+
},
152+
"properties": {
153+
"resourceName": "name",
154+
"resourceId": "id",
155+
"resourceType": "type"
156+
},
157+
"onlyStatus": false
158+
}
159+
},
160+
"idSuffix": "azure_app_service_authentication_disabled__ARG_2_",
161+
"notes": [],
162+
"categories": [],
163+
"immutable_properties": [
164+
"name",
165+
"id"
166+
],
167+
"id": "azure_app_service__ARG_3_"
168+
}

‎rules/findings/azure/appservices/azure-app-service-all-traffic-not-routed-through-vnet.json‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{
2+
"args": [],
3+
"provider": "Azure",
4+
"serviceType": "_ARG_0_",
5+
"serviceName": "Hosted Services",
6+
"displayName": "Ensure all traffic is routed through the virtual network",
7+
"description": "Enable vnetRouteAllEnabled to ensure all outbound traffic is routed through the integrated virtual network.<br/><br/>This recommendation should be applied after integrating an App Service app with a virtual network.",
8+
"rationale": "Routing all outbound traffic through the virtual network enhances security.",
9+
"impact": "Additional configuration may be required to ensure that traffic is routed properly.",
10+
"remediation": {
11+
"text": "
12+
#### Remediate from Azure Portal
13+
1. Go to App Services.
14+
2. Click the name of an app.
15+
3. Under Settings, click Networking.
16+
4. Under Outbound traffic configuration, next to Virtual network integration, click the virtual network and subnet name.
17+
5. Under Application routing, check the box next to Outbound internet traffic.
18+
6. Click Apply.
19+
7. Repeat steps 1-6 for each app requiring remediation.
20+
",
21+
"code": {
22+
"powerShell": null,
23+
"iac": null,
24+
"terraform": null,
25+
"other": null
26+
}
27+
},
28+
"recommendation": null,
29+
"references": [
30+
"https://learn.microsoft.com/en-us/azure/app-service/configure-vnet-integration-routing#configure-application-routing",
31+
"https://learn.microsoft.com/en-us/cli/azure/webapp",
32+
"https://learn.microsoft.com/en-us/cli/azure/resource"
33+
],
34+
"compliance": [
35+
{
36+
"name": "_ARG_1_",
37+
"version": "_ARG_2_",
38+
"reference": "_ARG_3_",
39+
"profile": [
40+
"Level 1"
41+
]
42+
}
43+
],
44+
"level": "medium",
45+
"tags": [],
46+
"rule": {
47+
"path": "az_app_services",
48+
"subPath": null,
49+
"selectCondition": {},
50+
"query": [
51+
{
52+
"filter": [
53+
{
54+
"conditions": [
55+
[
56+
"properties.vnetRouteAllEnabled",
57+
"ne",
58+
"True"
59+
]
60+
]
61+
}
62+
]
63+
},
64+
{
65+
"connectOperator": "and",
66+
"filter": [
67+
{
68+
"include": "_ARG_4_"
69+
}
70+
]
71+
}
72+
],
73+
"shouldExist": null,
74+
"returnObject": null,
75+
"removeIfNotExists": null
76+
},
77+
"output": {
78+
"html": {
79+
"data": {
80+
"properties": {
81+
"name": "Name",
82+
"location": "location",
83+
"resourceGroupName": "Resource Group Name",
84+
"properties.vnetRouteAllEnabled":"Route all traffic"
85+
},
86+
"expandObject": null
87+
},
88+
"table": "default",
89+
"decorate": [],
90+
"emphasis": [],
91+
"actions": {
92+
"objectData": {
93+
"properties": [
94+
"name",
95+
"location",
96+
"resourceGroupName",
97+
"properties.vnetRouteAllEnabled"
98+
],
99+
"expandObject": null,
100+
"limit": null
101+
},
102+
"showGoToButton": "True",
103+
"showModalButton": "True",
104+
"directLink": null
105+
}
106+
},
107+
"text": {
108+
"data": {
109+
"properties": {
110+
"name": "Name",
111+
"location": "location",
112+
"resourceGroupName": "Resource Group Name",
113+
"properties.vnetRouteAllEnabled":"Route all traffic"
114+
},
115+
"expandObject": null
116+
},
117+
"status": {
118+
"keyName": ["name"],
119+
"message": "Ensure all traffic is routed through the virtual network for {name}",
120+
"defaultMessage": null
121+
},
122+
"properties": {
123+
"resourceName": "name",
124+
"resourceId": "id",
125+
"resourceType": "type"
126+
},
127+
"onlyStatus": false
128+
}
129+
},
130+
"idSuffix": "azure__ARG_0__routing_all_traffic_not_enabled",
131+
"notes": [],
132+
"categories": [],
133+
"immutable_properties": [
134+
"name",
135+
"id"
136+
],
137+
"id": "azure_app_service__ARG_5_"
138+
}

0 commit comments

Comments
 (0)