Skip to content

Commit 3803175

Browse files
cx-ricardo-jesuscx-ricardo-jesus
authored
Merge branch 'master' into AST-127003
2 parents 06e21a8 + 1c3915c commit 3803175

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+785
-994
lines changed

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/query.rego‎

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,65 @@ import data.generic.common as common_lib
55

66
CxPolicy[result] {
77
types := ["auditingSettings", "Microsoft.Sql/servers/databases/auditingSettings", "Microsoft.Sql/servers/auditingSettings"]
8-
dbTypes := ["Microsoft.Sql/servers/databases", "databases", "Microsoft.Sql/servers"]
9-
8+
dbTypes := ["databases", "Microsoft.Sql/servers/databases", "Microsoft.Sql/servers"]
109
doc := input.document[i]
1110
[path, value] = walk(doc)
12-
1311
value.type == dbTypes[_]
14-
childrenArr := arm_lib.get_children(doc, value, path)
12+
13+
# Case of database resource with auditingsettings as "child"
14+
childrenArr_full := get_children(doc, value, path)
15+
childrenArr := [x | x := childrenArr_full[ch_index]
16+
childrenArr_full[ch_index].type == types[_]]
1517

1618
count([x |
17-
child := childrenArr[_].value
18-
child.type == types[_]
19+
child := childrenArr[_]
1920
[val, _] := arm_lib.getDefaultValueFromParametersIfPresent(doc, child.properties.state)
2021
lower(val) == "enabled"
2122
x := child
2223
]) == 0
2324

25+
# Case of "child" database resource with auditingsettings as "brother" resource
26+
depth_path := array.slice(path, 0, count(path)-1)
27+
brothersArr_full := object.get(doc, depth_path, [])
28+
brothersArr := [x | x := brothersArr_full[ch_index]
29+
brothersArr_full[ch_index].type == types[_]
30+
count(split(brothersArr_full[ch_index].name, "/")) < count(split(value.name, "/")) + 2] # Prevents /servers from capturing ../databases/auditingSettings
31+
32+
count([x |
33+
brother := brothersArr[_]
34+
[val, _] := arm_lib.getDefaultValueFromParametersIfPresent(doc, brother.properties.state)
35+
lower(val) == "enabled"
36+
x := brother
37+
]) == 0
38+
2439
result := {
2540
"documentId": input.document[i].id,
2641
"resourceType": value.type,
2742
"resourceName": value.name,
2843
"searchKey": sprintf("%s.name=%s", [common_lib.concat_path(path), value.name]),
29-
"issueType": "MissingAttribute",
44+
"issueType": get_issue_type(childrenArr, brothersArr),
3045
"keyExpectedValue": sprintf("resource '%s' should have an enabled 'auditingsettings' resource", [value.name]),
3146
"keyActualValue": sprintf("resource '%s' is missing an enabled 'auditingsettings' resource", [value.name]),
3247
"searchLine": common_lib.build_search_line(path, ["name"]),
3348
}
3449
}
50+
51+
get_children(doc, parent, path) = childArr {
52+
resourceArr := [x | x := parent.resources[_]]
53+
outerArr := get_outer_children(doc, parent.name)
54+
childArr := array.concat(resourceArr, outerArr)
55+
}
56+
57+
get_outer_children(doc, nameParent) = outerArr {
58+
outerArr := [x |
59+
[path, value] := walk(doc)
60+
startswith(value.name, nameParent)
61+
count(split(value.name, "/")) == count(split(nameParent, "/")) + 1 # Prevents /servers from capturing ../databases/auditingSettings
62+
x := value
63+
]
64+
}
65+
66+
get_issue_type(childrenArr,brothersArr) = "MissingAttribute"{
67+
childrenArr == []
68+
brothersArr == []
69+
} else = "IncorrectValue" # When associated with an auditing resource with "state" != enabled

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative1.bicep‎

Lines changed: 6 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,13 @@
1-
resource sqlServer1 'Microsoft.Sql/servers@2021-02-01-preview' = {
2-
name: 'sqlServer1'
1+
resource sql_server 'Microsoft.Sql/servers@2021-02-01-preview' = {
2+
name: 'sql_server'
33
location: resourceGroup().location
4-
tags: {
5-
displayName: 'sqlServer1'
6-
}
7-
properties: {
8-
administratorLogin: 'adminUsername'
9-
administratorLoginPassword: 'adminPassword'
10-
}
11-
}
12-
13-
resource sqlServer1_default 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = {
14-
parent: sqlServer1
15-
name: 'default'
16-
properties: {
17-
auditActionsAndGroups: ['DATABASE_LOGOUT_GROUP']
18-
isAzureMonitorTargetEnabled: true
19-
isStorageSecondaryKeyInUse: true
20-
queueDelayMs: 1000
21-
retentionDays: 100
22-
state: 'Enabled'
23-
}
4+
properties: {}
245
}
256

26-
resource sqlServer1_ssqlDatabase1 'Microsoft.Sql/servers/databases@2021-02-01-preview' = {
27-
parent: sqlServer1
28-
name: 'ssqlDatabase1'
29-
location: resourceGroup().location
30-
tags: {
31-
displayName: 'sqlDatabase1'
32-
}
33-
properties: {
34-
collation: 'SQL_Latin1_General_CP1_CI_AS'
35-
edition: 'Basic'
36-
maxSizeBytes: 107374182
37-
requestedServiceObjectiveName: 'Basic'
38-
}
39-
}
40-
41-
resource sqlServer1_ssqlDatabase1_default 'Microsoft.Sql/servers/databases/auditingSettings@2021-02-01-preview' = {
42-
parent: sqlServer1_ssqlDatabase1
43-
name: 'default'
7+
resource sql_server_auditing_settings 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = {
8+
parent: sql_server
9+
name: 'default_1'
4410
properties: {
45-
auditActionsAndGroups: ['DATABASE_LOGOUT_GROUP']
46-
isAzureMonitorTargetEnabled: true
47-
isStorageSecondaryKeyInUse: true
48-
queueDelayMs: 1000
49-
retentionDays: 100
5011
state: 'Enabled'
5112
}
5213
}
53-
54-

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative1.json‎

Lines changed: 0 additions & 70 deletions
This file was deleted.

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative10.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"resources": [
5+
{
6+
"type": "Microsoft.Sql/servers",
7+
"apiVersion": "2023-02-01-preview",
8+
"name": "sql_server",
9+
"location": "[resourceGroup().location]",
10+
"properties": {}
11+
},
12+
{
13+
"type": "Microsoft.Sql/servers/databases",
14+
"apiVersion": "2024-11-01-preview",
15+
"name": "sql_server/sql_databases",
16+
"location": "[resourceGroup().location]",
17+
"dependsOn": [
18+
"[resourceId('Microsoft.Sql/servers', 'sql_server')]"
19+
],
20+
"properties": {}
21+
},
22+
{
23+
"type": "Microsoft.Sql/servers/auditingSettings",
24+
"apiVersion": "2024-11-01-preview",
25+
"name": "sql_server/default",
26+
"dependsOn": [
27+
"[resourceId('Microsoft.Sql/servers', 'sql_server')]"
28+
],
29+
"properties": {
30+
"state": "Enabled"
31+
}
32+
}
33+
]
34+
}

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative11.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"resources": [
5+
{
6+
"type": "Microsoft.Sql/servers",
7+
"apiVersion": "2023-02-01-preview",
8+
"name": "sql_server",
9+
"location": "[resourceGroup().location]",
10+
"properties": {},
11+
"resources": [
12+
{
13+
"type": "databases",
14+
"apiVersion": "2024-11-01-preview",
15+
"name": "sql_databases",
16+
"location": "[resourceGroup().location]",
17+
"properties": {}
18+
},
19+
{
20+
"type": "auditingSettings",
21+
"apiVersion": "2024-11-01-preview",
22+
"name": "default",
23+
"properties": {
24+
"state": "Enabled"
25+
}
26+
}
27+
]
28+
}
29+
]
30+
}

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative12.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"resources": [
5+
{
6+
"type": "Microsoft.Sql/servers",
7+
"apiVersion": "2021-02-01-preview",
8+
"name": "sqlServer1",
9+
"location": "[resourceGroup().location]",
10+
"properties": {}
11+
},
12+
{
13+
"type": "Microsoft.Sql/servers/auditingSettings",
14+
"apiVersion": "2021-02-01-preview",
15+
"name": "sqlServer1/default_1",
16+
"properties": {
17+
"state": "Enabled"
18+
}
19+
},
20+
{
21+
"type": "Microsoft.Sql/servers/databases",
22+
"apiVersion": "2021-02-01-preview",
23+
"name": "sqlServer1/sqlDatabase1",
24+
"location": "[resourceGroup().location]",
25+
"properties": {}
26+
},
27+
{
28+
"type": "Microsoft.Sql/servers/databases/auditingSettings",
29+
"apiVersion": "2021-02-01-preview",
30+
"name": "sqlServer1/sqlDatabase1/default_2",
31+
"properties": {
32+
"state": "Disabled"
33+
}
34+
}
35+
]
36+
}

‎assets/queries/azureResourceManager/sql_server_database_without_auditing/test/negative13.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"resources": [
5+
{
6+
"type": "Microsoft.Sql/servers",
7+
"apiVersion": "2021-02-01-preview",
8+
"name": "sqlServer1",
9+
"location": "[resourceGroup().location]",
10+
"properties": {},
11+
"resources": [
12+
{
13+
"type": "auditingSettings",
14+
"apiVersion": "2021-02-01-preview",
15+
"name": "default_1",
16+
"properties": {
17+
"state": "Enabled"
18+
}
19+
},
20+
{
21+
"type": "databases",
22+
"apiVersion": "2021-02-01-preview",
23+
"name": "sqlDatabase1",
24+
"location": "[resourceGroup().location]",
25+
"properties": {},
26+
"resources": [
27+
{
28+
"type": "auditingSettings",
29+
"apiVersion": "2021-02-01-preview",
30+
"name": "default_2",
31+
"properties": {
32+
"state": "Disabled"
33+
}
34+
}
35+
]
36+
}
37+
]
38+
}
39+
]
40+
}

0 commit comments

Comments
 (0)