feat: Add security queries for AKS configurations and tests

GeekMasher · GeekMasher · commit b3fbec2c007a · 2025-06-12T12:59:42.000+01:00
diff --git a/ql/lib/codeql/bicep/frameworks/Microsoft/AKS.qll b/ql/lib/codeql/bicep/frameworks/Microsoft/AKS.qll
@@ -295,6 +295,10 @@ module AKS {
        */
       Boolean getEnabled() { result = this.getProperty("enabled") }
 
+      boolean enabled() {
+        result = this.getEnabled().getBool()
+      }
+
       string toString() { result = "AddonKubeDashboard" }
     }
 
diff --git a/ql/src/security/AKS/AKSKubeDashboardEnabled.ql b/ql/src/security/AKS/AKSKubeDashboardEnabled.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AKS cluster with kubeDashboard enabled
+ * @description Detects Azure Kubernetes Service (AKS) clusters where the kubeDashboard addon is enabled (insecure configuration).
+ * @kind problem
+ * @problem.severity warning
+ * @id bicep/aks-kubedashboard-enabled
+ * @tags security, kubernetes, azure, aks
+ */
+import codeql.bicep.frameworks.Microsoft.AKS
+
+from AKS::ManagedContainerResource r, 
+     AKS::ManagedContainerProperties::AddonProfiles addons, 
+     AKS::ManagedContainerProperties::AddonKubeDashboard dashboard
+where
+  addons = r.getProperties().getAddonProfiles() and
+  dashboard = addons.getKubeDashboard() and
+  dashboard.enabled() = true
+select r, "AKS cluster has kubeDashboard addon enabled (insecure configuration)."
diff --git a/ql/src/security/AKS/AKSPrivateApiEnabled.ql b/ql/src/security/AKS/AKSPrivateApiEnabled.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AKS cluster with private API server enabled
+ * @description Detects Azure Kubernetes Service (AKS) clusters where the API server is private (private cluster enabled).
+ * @kind problem
+ * @problem.severity recommendation
+ * @id bicep/aks-private-api-server-enabled
+ * @tags security
+ *       kubernetes
+ *       azure
+ */
+import codeql.bicep.frameworks.Microsoft.AKS
+
+from AKS::ManagedContainerResource r, 
+     AKS::ManagedContainerProperties::ApiServerAccessProfile api
+where
+  api = r.getProperties().getApiServerAccessProfile() and
+  api.enablePrivateCluster() = true
+select r, "AKS cluster API server is private (private cluster enabled)."
diff --git a/ql/src/security/AKS/AKSPublicApi.ql b/ql/src/security/AKS/AKSPublicApi.ql
@@ -0,0 +1,22 @@
+/**
+ * @name AKS cluster with public API server
+ * @description Detects Azure Kubernetes Service (AKS) clusters where the API server is publicly accessible (private cluster not enabled).
+ * @kind problem
+ * @problem.severity warning
+ * @id bicep/aks-public-api-server
+ * @tags security
+ *       azure
+ *       kubernetes
+ */
+import bicep
+
+from AKS::ManagedContainerResource r, 
+     AKS::ManagedContainerProperties::ApiServerAccessProfile api
+where
+  api = r.getProperties().getApiServerAccessProfile() and
+  (
+    // enablePrivateCluster is missing or set to false
+    not exists(api.getEnablePrivateCluster()) or
+    api.enablePrivateCluster() = false
+  )
+select r, "AKS cluster API server is publicly accessible (private cluster not enabled)."
diff --git a/ql/test/queries-tests/security/AKS/AKSKubeDashboardEnabled.expected b/ql/test/queries-tests/security/AKS/AKSKubeDashboardEnabled.expected
@@ -0,0 +1 @@
+| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster has kubeDashboard addon enabled (insecure configuration). |
diff --git a/ql/test/queries-tests/security/AKS/AKSKubeDashboardEnabled.qlref b/ql/test/queries-tests/security/AKS/AKSKubeDashboardEnabled.qlref
@@ -0,0 +1 @@
+security/AKS/AKSKubeDashboardEnabled.ql
diff --git a/ql/test/queries-tests/security/AKS/AKSPrivateApiEnabled.expected b/ql/test/queries-tests/security/AKS/AKSPrivateApiEnabled.expected
@@ -0,0 +1 @@
+| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster API server is private (private cluster enabled). |
diff --git a/ql/test/queries-tests/security/AKS/AKSPrivateApiEnabled.qlref b/ql/test/queries-tests/security/AKS/AKSPrivateApiEnabled.qlref
@@ -0,0 +1 @@
+security/AKS/AKSPrivateApiEnabled.ql
diff --git a/ql/test/queries-tests/security/AKS/AKSPublicApi.expected b/ql/test/queries-tests/security/AKS/AKSPublicApi.expected
@@ -0,0 +1,2 @@
+| aks-security-examples.bicep:2:1:30:1 | ManagedContainerResource | AKS cluster API server is publicly accessible (private cluster not enabled). |
+| aks-security-examples.bicep:32:1:62:1 | ManagedContainerResource | AKS cluster API server is publicly accessible (private cluster not enabled). |
diff --git a/ql/test/queries-tests/security/AKS/AKSPublicApi.qlref b/ql/test/queries-tests/security/AKS/AKSPublicApi.qlref
@@ -0,0 +1 @@
+security/AKS/AKSPublicApi.ql
diff --git a/ql/test/queries-tests/security/AKS/aks-security-examples.bicep b/ql/test/queries-tests/security/AKS/aks-security-examples.bicep
@@ -0,0 +1,62 @@
+// Example Bicep file with AKS security issues for CodeQL testing
+resource insecureAks 'Microsoft.ContainerService/managedClusters@2023-01-01' = {
+  name: 'aks-insecure-public'
+  location: 'eastus'
+  properties: {
+    kubernetesVersion: '1.25.6' // Outdated version
+    dnsPrefix: 'aks-public'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 1
+        vmSize: 'Standard_DS2_v2'
+        osType: 'Linux'
+        mode: 'System'
+        enableAutoScaling: false // No autoscaling
+      }
+    ]
+    networkProfile: {
+      networkPlugin: 'azure'
+    }
+    apiServerAccessProfile: {
+      enablePrivateCluster: false // Public API server
+    }
+    addonProfiles: {
+      kubeDashboard: {
+        enabled: true // Insecure: dashboard enabled
+      }
+    }
+  }
+}
+
+resource secureAks 'Microsoft.ContainerService/managedClusters@2023-01-01' = {
+  name: 'aks-secure-private'
+  location: 'eastus'
+  properties: {
+    kubernetesVersion: '1.28.3' // Supported version
+    dnsPrefix: 'aks-private'
+    agentPoolProfiles: [
+      {
+        name: 'agentpool'
+        count: 3
+        vmSize: 'Standard_DS2_v2'
+        osType: 'Linux'
+        mode: 'System'
+        enableAutoScaling: true
+        minCount: 1
+        maxCount: 5
+      }
+    ]
+    networkProfile: {
+      networkPlugin: 'azure'
+    }
+    apiServerAccessProfile: {
+      enablePrivateCluster: true // Private API server
+    }
+    addonProfiles: {
+      kubeDashboard: {
+        enabled: false // Secure: dashboard disabled
+      }
+    }
+  }
+}

Original file line number	Diff line number	Diff line change
`@@ -295,6 +295,10 @@ module AKS {`
`295`	`295`	`*/`
`296`	`296`	`Boolean getEnabled() { result = this.getProperty("enabled") }`
`297`	`297`
	`298`	`+ boolean enabled() {`
	`299`	`+ result = this.getEnabled().getBool()`
	`300`	`+ }`
	`301`	`+`
`298`	`302`	`string toString() { result = "AddonKubeDashboard" }`
`299`	`303`	`}`
`300`	`304`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+\| aks-security-examples.bicep:2:1:30:1 \| ManagedContainerResource \| AKS cluster has kubeDashboard addon enabled (insecure configuration). \|`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+security/AKS/AKSKubeDashboardEnabled.ql`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+\| aks-security-examples.bicep:32:1:62:1 \| ManagedContainerResource \| AKS cluster API server is private (private cluster enabled). \|`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+\| aks-security-examples.bicep:2:1:30:1 \| ManagedContainerResource \| AKS cluster API server is publicly accessible (private cluster not enabled). \|`
	`2`	`+\| aks-security-examples.bicep:32:1:62:1 \| ManagedContainerResource \| AKS cluster API server is publicly accessible (private cluster not enabled). \|`