-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #184 from prancer-io/azure-iac-new-rego3
Azure iac new rego files (sql_servers, Redis, keyvaultkeys)
- Loading branch information
Showing
5 changed files
with
393 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| package rule | ||
|
|
||
| # https://docs.microsoft.com/en-us/azure/templates/Microsoft.Cache/redis | ||
|
|
||
| # PR-AZR-0131-ARM | ||
|
|
||
| default enableSslPort = null | ||
|
|
||
| azure_attribute_absence ["enableSslPort"] { | ||
| resource := input.resources[_] | ||
| lower(resource.type) == "microsoft.cache/redis" | ||
| not resource.properties.enableNonSslPort | ||
| } | ||
|
|
||
| azure_issue ["enableSslPort"] { | ||
| resource := input.resources[_] | ||
| lower(resource.type) == "microsoft.cache/redis" | ||
| resource.properties.enableNonSslPort != false | ||
| } | ||
|
|
||
| enableSslPort { | ||
| azure_attribute_absence["enableSslPort"] | ||
| } | ||
|
|
||
|
|
||
| enableSslPort { | ||
| lower(input.resources[_].type) == "microsoft.cache/redis" | ||
| not azure_issue["servenableSslPorterRole"] | ||
| } | ||
|
|
||
|
|
||
| enableSslPort = false { | ||
| azure_issue["enableSslPort"] | ||
| } | ||
|
|
||
| enableSslPort_err = "Redis cache is currently allowing unsecure connection via a non ssl port opened" { | ||
| azure_issue["enableSslPort"] | ||
| } | ||
|
|
||
|
|
||
| enableSslPort_metadata := { | ||
| "Policy Code": "PR-AZR-0131-ARM", | ||
| "Type": "IaC", | ||
| "Product": "AZR", | ||
| "Language": "ARM template", | ||
| "Policy Title": "Ensure that the Redis Cache accepts only SSL connections", | ||
| "Policy Description": "It is recommended that Redis Cache should allow only SSL connections. Note: some Redis tools (like redis-cli) do not support SSL. When using such tools plain connection ports should be enabled.", | ||
| "Resource Type": "Microsoft.Cache/redis", | ||
| "Policy Help URL": "", | ||
| "Resource Help URL": "https://docs.microsoft.com/en-us/azure/templates/Microsoft.Cache/redis" | ||
| } | ||
|
|
||
|
|
||
|
|
||
|
|
||
| # https://docs.microsoft.com/en-us/azure/templates/microsoft.cache/redis/linkedservers | ||
|
|
||
| # PR-AZR-0132-ARM | ||
|
|
||
| default serverRole = null | ||
|
|
||
|
|
||
| azure_attribute_absence ["serverRole"] { | ||
| resource := input.resources[_] | ||
| lower(resource.type) == "microsoft.cache/redis/linkedservers" | ||
| not resource.properties.serverRole | ||
| } | ||
|
|
||
| azure_issue ["serverRole"] { | ||
| resource := input.resources[_] | ||
| lower(resource.type) == "microsoft.cache/redis/linkedservers" | ||
| lower(resource.properties.serverRole) != "secondary" | ||
| } | ||
|
|
||
|
|
||
| serverRole { | ||
| lower(input.resources[_].type) == "microsoft.cache/redis/linkedservers" | ||
| not azure_attribute_absence["serverRole"] | ||
| not azure_issue["serverRole"] | ||
| } | ||
|
|
||
|
|
||
| serverRole = false { | ||
| azure_attribute_absence["serverRole"] | ||
| } | ||
|
|
||
|
|
||
| serverRole = false { | ||
| azure_issue["serverRole"] | ||
| } | ||
|
|
||
|
|
||
| serverRole_miss_err = "Azure Redis Cache linked server property 'serverRole' is missing from the resource" { | ||
| azure_attribute_absence["serverRole"] | ||
| } | ||
|
|
||
|
|
||
| serverRole_err = "Azure Redis Cache linked backup server currently does not have secondary role." { | ||
| azure_issue["serverRole"] | ||
| } | ||
|
|
||
|
|
||
| serverRole_metadata := { | ||
| "Policy Code": "PR-AZR-0132-ARM", | ||
| "Type": "IaC", | ||
| "Product": "AZR", | ||
| "Language": "ARM template", | ||
| "Policy Title": "Redis cache should have a backup", | ||
| "Policy Description": "Replicate Redis Cache server data to another Redis Cache server using geo replication. This feature is only available for Premium tier Redis Cache. From performance point of view, Microsoft recommends that both Redis Caches (Primary and the linked secondary) reside in the same region.", | ||
| "Resource Type": "Microsoft.Cache/redis/linkedservers", | ||
| "Policy Help URL": "", | ||
| "Resource Help URL": "https://docs.microsoft.com/en-us/azure/templates/microsoft.cache/redis/linkedservers" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package rule | ||
|
|
||
| # https://docs.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults/keys | ||
|
|
||
| # | ||
| # PR-AZR-0130-ARM | ||
| # | ||
|
|
||
| default kv_keys_expire = null | ||
|
|
||
| azure_attribute_absence["kv_keys_expire"] { | ||
| resource := input.resources[_] | ||
| lower(resource.type) == "microsoft.keyvault/vaults/keys" | ||
| resource.properties.attributes.enabled != false | ||
| not resource.properties.attributes.exp | ||
| not resource.properties.rotationPolicy.attributes.expiryTime | ||
| } | ||
|
|
||
| azure_issue["kv_keys_expire"] { | ||
| resource := input.resources[_] | ||
| resource.properties.attributes.enabled != false | ||
| to_number(resource.properties.attributes.exp) < 0 | ||
| count(resource.properties.rotationPolicy.attributes.expiryTime) == 0 | ||
| } | ||
|
|
||
| kv_keys_expire { | ||
| lower(input.resources[_].type) == "microsoft.keyvault/vaults/keys" | ||
| not azure_attribute_absence["kv_keys_expire"] | ||
| not azure_issue["kv_keys_expire"] | ||
| } | ||
|
|
||
|
|
||
| kv_keys_expire = false { | ||
| azure_attribute_absence["kv_keys_expire"] | ||
| } | ||
|
|
||
| kv_keys_expire = false { | ||
| azure_issue["kv_keys_expire"] | ||
| } | ||
|
|
||
|
|
||
| kv_keys_expire_miss_err = "Azure Key Vault attribute 'exp' or 'expiryTime' is missing from the resource" { | ||
| azure_attribute_absence["kv_keys_expire"] | ||
| } | ||
|
|
||
| kv_keys_expire_err = "Azure Key Vault keys currently dont have any expiration date" { | ||
| azure_issue["kv_keys_expire"] | ||
| } | ||
|
|
||
|
|
||
| kv_keys_expire_metadata := { | ||
| "Policy Code": "PR-AZR-0130-ARM", | ||
| "Type": "IaC", | ||
| "Product": "AZR", | ||
| "Language": "ARM template", | ||
| "Policy Title": "Azure Key Vault keys should have an expiration date", | ||
| "Policy Description": "This policy identifies Azure Key Vault keys that do not have an expiration date. As a best practice, set an expiration date for each secret and rotate the secret regularly.", | ||
| "Resource Type": "microsoft.keyvault/vaults/keys", | ||
| "Policy Help URL": "", | ||
| "Resource Help URL": "https://docs.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults/keys" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.