fix(query): add supports for Microsoft.Web/sites/config on Web App Not Using TLS Last Version for AzureResourceManager

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/query.rego

@@ -3,12 +3,16 @@ package Cx
 import data.generic.common as common_lib
 import data.generic.azureresourcemanager as arm_lib
 
-CxPolicy[result] {
+CxPolicy[result] { # resource of type Microsoft.Web/sites without child resources of type Microsoft.Web/sites/config
 	doc := input.document[i]
 
 	[path, value] = walk(doc)
 
 	value.type == "Microsoft.Web/sites"
+
+	children_array := arm_lib.get_children(doc, value, path)
+
+	count(children_array) == 0
 	not is_last_tls(doc, value)
 
 	issue := prepare_issue(value)
@@ -25,6 +29,89 @@ CxPolicy[result] {
 	}
 }
 
+CxPolicy[result] {
+	doc := input.document[i]
+
+	[path, value] = walk(doc)
+
+	value.type == "Microsoft.Web/sites"
+
+	children_array := arm_lib.get_children(doc, value, path)
+	not count(children_array) == 0
+	child_resource := children_array[_]
+	is_sites_config(child_resource.value.type)
+	child_resource_status := get_child_resource_info(doc, child_resource.value)
+
+	res := check_tls_version(doc, value, path, child_resource, child_resource_status)
+
+	result := {
+		"documentId": input.document[i].id,
+		"resourceType": res["rt"],
+		"resourceName": res["rn"],
+		"searchKey": res["sk"],
+		"issueType": res["it"],
+		"keyExpectedValue": res["kev"],
+		"keyActualValue": res["kav"],
+		"searchLine": res["sl"],
+	}
+}
+
+check_tls_version(doc, value, path, child_resource, child_resource_status) = res {
+	# child resource without minTlsVersion defined but parent resource with the field incorrectly defined 
+	child_resource_status == "not defined"
+	not is_last_tls(doc, value)
+
+	issue := prepare_issue(value)
+	issue.issueType == "IncorrectValue"
+	res := {
+		"rt": value.type,
+		"rn": value.name,
+		"sk": sprintf("%s.name=%s%s", [common_lib.concat_path(path), value.name, issue.sk]),
+		"it": issue.issueType,
+		"kev": issue.keyExpectedValue,
+		"kav": issue.keyActualValue,
+		"sl": common_lib.build_search_line(path, issue.sl),
+	}
+} else = res {
+	# both child and parent resources with minTlsVersion field not defined
+	child_resource_status == "not defined"
+	not is_last_tls(doc, value)
+
+	issue := prepare_issue(value)
+	issue.issueType == "MissingAttribute"
+	res := {
+		"rt": child_resource.value.type,
+		"rn": child_resource.value.name,
+		"sk": sprintf("%s.name=%s.properties", [common_lib.concat_path(child_resource.path), child_resource.value.name]),
+		"it": "MissingAttribute",
+		"kev": "'minTlsVersion' should be defined with the version '1.2' or higher",
+		"kav": "'minTlsVersion' is not defined",
+		"sl": common_lib.build_search_line(child_resource.path, ["properties"]),
+	}
+} else = res {
+	# child resource with minTlsVersion incorrectly defined
+	child_resource_status == "not correctly defined"
+	res := {
+		"rt": child_resource.value.type,
+		"rn": child_resource.value.name,
+		"sk": sprintf("%s.name=%s.properties.minTlsVersion", [common_lib.concat_path(child_resource.path), child_resource.value.name]),
+		"it": "IncorrectValue",
+		"kev": "'minTlsVersion' should be defined with the version '1.2' or higher",
+		"kav": sprintf("'minTlsVersion' is defined to '%s'", [child_resource.value.properties.minTlsVersion]),
+		"sl": common_lib.build_search_line(child_resource.path, ["properties", "minTlsVersion"])
+	}
+}
+
+get_child_resource_info(doc, child_resource) = info {
+	not common_lib.valid_key(child_resource.properties, "minTlsVersion")
+	info := "not defined"
+} else = info {
+	[val, _] := arm_lib.getDefaultValueFromParametersIfPresent(doc, child_resource.properties.minTlsVersion)
+	val != "1.3"
+	val != "1.2"
+	info := "not correctly defined"
+}
+
 is_last_tls(doc, resource) {
 	[val, _] :=  arm_lib.getDefaultValueFromParametersIfPresent(doc, resource.properties.siteConfig.minTlsVersion)
 	val == "1.3"
@@ -73,3 +160,9 @@ prepare_issue(resource) = issue {
 		"sl": ["properties"],
 	}
 }
+
+is_sites_config(resource_type) {
+	resource_type == "Microsoft.Web/sites/config"
+} else {
+	resource_type == "config"
+} else = false

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/negative3.bicep

@@ -0,0 +1,13 @@
+resource meuAppService 'Microsoft.Web/sites@2022-09-01' = {
+  name: 'meuAppService'
+  location: 'West Europe'
+  properties: {}
+}
+
+resource meuAppService_web 'Microsoft.Web/sites/config@2022-09-01' = {
+  parent: meuAppService
+  name: 'web'
+  properties: {
+    minTlsVersion: '1.2'
+  }
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/negative3.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-09-01",
+      "name": "meuAppService",
+      "location": "West Europe",
+      "properties": {}
+    },
+    {
+      "type": "Microsoft.Web/sites/config",
+      "apiVersion": "2022-09-01",
+      "name": "meuAppService/web",
+      "dependsOn": [
+        "Microsoft.Web/sites/meuAppService"
+      ],
+      "properties": {
+        "minTlsVersion": "1.2"
+      }
+    }
+  ]
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/positive5.bicep

@@ -0,0 +1,13 @@
+resource meuAppService 'Microsoft.Web/sites@2022-09-01' = {
+  name: 'meuAppService'
+  location: 'West Europe'
+  properties: {}
+}
+
+resource meuAppService_web 'Microsoft.Web/sites/config@2022-09-01' = {
+  parent: meuAppService
+  name: 'web'
+  properties: {
+    minTlsVersion: '1.1'
+  }
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/positive5.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.39.26.7824",
+      "templateHash": "11739403591702951112"
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-09-01",
+      "name": "meuAppService",
+      "location": "West Europe",
+      "properties": {}
+    },
+    {
+      "type": "Microsoft.Web/sites/config",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}/{1}', 'meuAppService', 'web')]",
+      "properties": {
+        "minTlsVersion": "1.1"
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Web/sites', 'meuAppService')]"
+      ]
+    }
+  ]
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/positive6.bicep

@@ -0,0 +1,11 @@
+resource meuAppService 'Microsoft.Web/sites@2022-09-01' = {
+  name: 'meuAppService'
+  location: 'West Europe'
+  properties: {}
+}
+
+resource meuAppService_web 'Microsoft.Web/sites/config@2022-09-01' = {
+  parent: meuAppService
+  name: 'web'
+  properties: {}
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/positive6.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.39.26.7824",
+      "templateHash": "750350632139492718"
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Web/sites",
+      "apiVersion": "2022-09-01",
+      "name": "meuAppService",
+      "location": "West Europe",
+      "properties": {}
+    },
+    {
+      "type": "Microsoft.Web/sites/config",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}/{1}', 'meuAppService', 'web')]",
+      "properties": {},
+      "dependsOn": [
+        "[resourceId('Microsoft.Web/sites', 'meuAppService')]"
+      ]
+    }
+  ]
+}

assets/queries/azureResourceManager/web_app_not_using_tls_last_version/test/positive_expected_result.json

@@ -23,6 +23,18 @@
     "line": 13,
     "filename": "positive4.json"
   },
+  {
+    "queryName": "Web App Not Using TLS Last Version",
+    "severity": "MEDIUM",
+    "line": 17,
+    "filename": "positive5.json"
+  },
+  {
+    "queryName": "Web App Not Using TLS Last Version",
+    "severity": "MEDIUM",
+    "line": 17,
+    "filename": "positive6.json"
+  },
   {
     "queryName": "Web App Not Using TLS Last Version",
     "severity": "MEDIUM",
@@ -46,5 +58,17 @@
     "severity": "MEDIUM",
     "line": 5,
     "filename": "positive4.bicep"
+  },
+  {
+    "queryName": "Web App Not Using TLS Last Version",
+    "severity": "MEDIUM",
+    "line": 11,
+    "filename": "positive5.bicep"
+  },
+  {
+    "queryName": "Web App Not Using TLS Last Version",
+    "severity": "MEDIUM",
+    "line": 10,
+    "filename": "positive6.bicep"
   }
 ]