From d12c77dc27febe644bb73c618d4cdebf54d31af8 Mon Sep 17 00:00:00 2001 From: fatima99s Date: Tue, 23 Jan 2024 16:19:33 +0500 Subject: [PATCH 1/3] appService/VnetIntegrated --- exports.js | 1 + plugins/azure/appservice/vnetIntegrated.js | 50 +++++++++++ .../azure/appservice/vnetIntegrated.spec.js | 85 +++++++++++++++++++ 3 files changed, 136 insertions(+) create mode 100644 plugins/azure/appservice/vnetIntegrated.js create mode 100644 plugins/azure/appservice/vnetIntegrated.spec.js diff --git a/exports.js b/exports.js index 8bbe47f69a..eee291b3df 100644 --- a/exports.js +++ b/exports.js @@ -915,6 +915,7 @@ module.exports = { 'tlsVersionCheck' : require(__dirname + '/plugins/azure/appservice/tlsVersionCheck.js'), 'remoteDebuggingDisabled' : require(__dirname + '/plugins/azure/appservice/remoteDebuggingDisabled.js'), 'alwaysOnEnabled' : require(__dirname + '/plugins/azure/appservice/alwaysOnEnabled.js'), + 'vnetIntegrated' : require(__dirname + '/plugins/azure/appservice/vnetIntegrated.js'), 'certificateExpiry' : require(__dirname + '/plugins/azure/appservice/certificateExpiry.js'), 'scmSiteAccessRestriction' : require(__dirname + '/plugins/azure/appservice/scmSiteAccessRestriction.js'), 'appServiceAccessRestriction' : require(__dirname + '/plugins/azure/appservice/appServiceAccessRestriction.js'), diff --git a/plugins/azure/appservice/vnetIntegrated.js b/plugins/azure/appservice/vnetIntegrated.js new file mode 100644 index 0000000000..675d9c82ba --- /dev/null +++ b/plugins/azure/appservice/vnetIntegrated.js @@ -0,0 +1,50 @@ +var async = require('async'); +var helpers = require('../../../helpers/azure'); + +module.exports = { + title: 'Web Apps VNet Integrated', + category: 'App Service', + domain: 'Application Integration', + description: 'Ensures that Azure Web Apps have VNet integrated.', + more_info: 'Enabling virtual network integration for Apps allows outbound access to resources within the virtual network, ensuring enhanced security and operational control. This feature is crucial for proactively safeguarding your server against potential security threats and unauthorized access.', + recommended_action: 'Enable VNet Integration for Azure Web Apps', + link: 'https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration', + apis: ['webApps:list'], + + run: function(cache, settings, callback) { + var results = []; + var source = {}; + var locations = helpers.locations(settings.govcloud); + + async.each(locations.webApps, function(location, rcb) { + const webApps = helpers.addSource(cache, source, + ['webApps', 'list', location]); + + if (!webApps) return rcb(); + + if (webApps.err || !webApps.data) { + helpers.addResult(results, 3, 'Unable to query for Web Apps: ' + helpers.addError(webApps), location); + return rcb(); + } + + if (!webApps.data.length) { + helpers.addResult(results, 0, 'No existing Web Apps found', location); + return rcb(); + } + + webApps.data.forEach(function(webApp) { + if (webApp && webApp.kind && webApp.kind === 'functionapp') { + helpers.addResult(results, 0, 'VNet integration can not be configured for the function App', location, webApp.id); + } else if (webApp && webApp.virtualNetworkSubnetId) { + helpers.addResult(results, 0, 'Web App has VNet integrated', location, webApp.id); + } else { + helpers.addResult(results, 2, 'Web App does not have VNet integrated', location, webApp.id); + } + }); + rcb(); + }, function() { + // Global checking goes here + callback(null, results, source); + }); + } +}; diff --git a/plugins/azure/appservice/vnetIntegrated.spec.js b/plugins/azure/appservice/vnetIntegrated.spec.js new file mode 100644 index 0000000000..49228fbdc4 --- /dev/null +++ b/plugins/azure/appservice/vnetIntegrated.spec.js @@ -0,0 +1,85 @@ +var expect = require('chai').expect; +var vnetIntegrated = require('./vnetIntegrated'); + +const webApps = [ + { + 'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Web/sites/app1', + 'name': 'app1', + 'virtualNetworkSubnetId': '/subscriptions/12345/resourceGroups/cloudsploit-dev/providers/Microsoft.Network/virtualNetworks/test/subnets/default' + }, + { + 'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Web/sites/app1', + 'name': 'app1', + 'virtualNetworkSubnetId': null + } +]; + +const createCache = (webApps) => { + return { + webApps: { + list: { + 'eastus':{ + data: webApps + } + } + } + }; +}; + +const createErrorCache = () => { + return { + webApps: { + list: { + 'eastus': {} + } + } + }; +}; + +describe('vnetIntegrated', function() { + describe('run', function() { + it('should give passing result if no web apps', function(done) { + const cache = createCache([]); + vnetIntegrated.run(cache, {}, (err, results) => { + expect(results.length).to.equal(1); + expect(results[0].status).to.equal(0); + expect(results[0].message).to.include('No existing Web Apps found'); + expect(results[0].region).to.equal('eastus'); + done(); + }); + }); + + it('should give unknown result if unable to query web app ', function(done) { + const cache = createErrorCache(); + vnetIntegrated.run(cache, {}, (err, results) => { + expect(results.length).to.equal(1); + expect(results[0].status).to.equal(3); + expect(results[0].message).to.include('Unable to query for Web Apps: '); + expect(results[0].region).to.equal('eastus'); + done(); + }); + }); + + it('should give passing result if app service has Vnet Integrated', function(done) { + const cache = createCache([webApps[0]]); + vnetIntegrated.run(cache, {}, (err, results) => { + expect(results.length).to.equal(1); + expect(results[0].status).to.equal(0); + expect(results[0].message).to.include('Web App has VNet integrated'); + expect(results[0].region).to.equal('eastus'); + done(); + }); + }); + + it('should give failing result if app service app service does not have Vnet Integrated', function(done) { + const cache = createCache([webApps[1]]); + vnetIntegrated.run(cache, {}, (err, results) => { + expect(results.length).to.equal(1); + expect(results[0].status).to.equal(2); + expect(results[0].message).to.include('Web App does not have VNet integrated'); + expect(results[0].region).to.equal('eastus'); + done(); + }); + }); + }); +}); \ No newline at end of file From d267a4da9d6cffcacc7578a706d05f87a1c45b34 Mon Sep 17 00:00:00 2001 From: fatima99s Date: Tue, 23 Jan 2024 17:31:00 +0500 Subject: [PATCH 2/3] added triggers --- plugins/azure/appservice/vnetIntegrated.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/azure/appservice/vnetIntegrated.js b/plugins/azure/appservice/vnetIntegrated.js index 675d9c82ba..2987bd2475 100644 --- a/plugins/azure/appservice/vnetIntegrated.js +++ b/plugins/azure/appservice/vnetIntegrated.js @@ -10,6 +10,8 @@ module.exports = { recommended_action: 'Enable VNet Integration for Azure Web Apps', link: 'https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration', apis: ['webApps:list'], + realtime_triggers: ['microsoftweb:sites:write', 'microsoftweb:sites:networkconfig:delete', 'microsoftweb:sites:delete'], + run: function(cache, settings, callback) { var results = []; From 4d9c382f0ceae7ff17e4d34c0387978038cdc6ab Mon Sep 17 00:00:00 2001 From: mehakseedat63 <87388442+mehakseedat63@users.noreply.github.com> Date: Thu, 25 Jan 2024 14:45:29 +0500 Subject: [PATCH 3/3] Apply suggestions from code review --- plugins/azure/appservice/vnetIntegrated.js | 12 ++++++------ plugins/azure/appservice/vnetIntegrated.spec.js | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/plugins/azure/appservice/vnetIntegrated.js b/plugins/azure/appservice/vnetIntegrated.js index 2987bd2475..c44261347a 100644 --- a/plugins/azure/appservice/vnetIntegrated.js +++ b/plugins/azure/appservice/vnetIntegrated.js @@ -5,9 +5,9 @@ module.exports = { title: 'Web Apps VNet Integrated', category: 'App Service', domain: 'Application Integration', - description: 'Ensures that Azure Web Apps have VNet integrated.', - more_info: 'Enabling virtual network integration for Apps allows outbound access to resources within the virtual network, ensuring enhanced security and operational control. This feature is crucial for proactively safeguarding your server against potential security threats and unauthorized access.', - recommended_action: 'Enable VNet Integration for Azure Web Apps', + description: 'Ensures that Azure Web Apps have virtual network integrated.', + more_info: 'Enabling virtual network integration for apps allows outbound access to resources within the virtual network, ensuring enhanced security and operational control. This feature is crucial for proactively safeguarding your server against potential security threats and unauthorized access.', + recommended_action: 'Ensure virtual network is integrated for all web apps.', link: 'https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration', apis: ['webApps:list'], realtime_triggers: ['microsoftweb:sites:write', 'microsoftweb:sites:networkconfig:delete', 'microsoftweb:sites:delete'], @@ -36,11 +36,11 @@ module.exports = { webApps.data.forEach(function(webApp) { if (webApp && webApp.kind && webApp.kind === 'functionapp') { - helpers.addResult(results, 0, 'VNet integration can not be configured for the function App', location, webApp.id); + helpers.addResult(results, 0, 'Virtual Networks cannot be integrated with function apps', location, webApp.id); } else if (webApp && webApp.virtualNetworkSubnetId) { - helpers.addResult(results, 0, 'Web App has VNet integrated', location, webApp.id); + helpers.addResult(results, 0, 'App Service is integrated with a virtual network', location, webApp.id); } else { - helpers.addResult(results, 2, 'Web App does not have VNet integrated', location, webApp.id); + helpers.addResult(results, 2, 'App Service is not integrated with a virtual network', location, webApp.id); } }); rcb(); diff --git a/plugins/azure/appservice/vnetIntegrated.spec.js b/plugins/azure/appservice/vnetIntegrated.spec.js index 49228fbdc4..9fc59a8311 100644 --- a/plugins/azure/appservice/vnetIntegrated.spec.js +++ b/plugins/azure/appservice/vnetIntegrated.spec.js @@ -65,7 +65,7 @@ describe('vnetIntegrated', function() { vnetIntegrated.run(cache, {}, (err, results) => { expect(results.length).to.equal(1); expect(results[0].status).to.equal(0); - expect(results[0].message).to.include('Web App has VNet integrated'); + expect(results[0].message).to.include('App Service is integrated with a virtual network'); expect(results[0].region).to.equal('eastus'); done(); }); @@ -76,7 +76,7 @@ describe('vnetIntegrated', function() { vnetIntegrated.run(cache, {}, (err, results) => { expect(results.length).to.equal(1); expect(results[0].status).to.equal(2); - expect(results[0].message).to.include('Web App does not have VNet integrated'); + expect(results[0].message).to.include('App Service is not integrated with a virtual network'); expect(results[0].region).to.equal('eastus'); done(); });