appService/VnetIntegrated

exports.js

@@ -915,6 +915,7 @@ module.exports = {
         'tlsVersionCheck'               : require(__dirname + '/plugins/azure/appservice/tlsVersionCheck.js'),
         'remoteDebuggingDisabled'       : require(__dirname + '/plugins/azure/appservice/remoteDebuggingDisabled.js'),
         'alwaysOnEnabled'               : require(__dirname + '/plugins/azure/appservice/alwaysOnEnabled.js'),
+        'vnetIntegrated'                : require(__dirname + '/plugins/azure/appservice/vnetIntegrated.js'),
         'certificateExpiry'             : require(__dirname + '/plugins/azure/appservice/certificateExpiry.js'),
         'scmSiteAccessRestriction'      : require(__dirname + '/plugins/azure/appservice/scmSiteAccessRestriction.js'),
         'appServiceAccessRestriction'   : require(__dirname + '/plugins/azure/appservice/appServiceAccessRestriction.js'),

plugins/azure/appservice/vnetIntegrated.js

@@ -0,0 +1,52 @@
+var async = require('async');
+var helpers = require('../../../helpers/azure');
+
+module.exports = {
+    title: 'Web Apps VNet Integrated',
+    category: 'App Service',
+    domain: 'Application Integration',
+    description: 'Ensures that Azure Web Apps have virtual network integrated.',
+    more_info: 'Enabling virtual network integration for apps allows outbound access to resources within the virtual network, ensuring enhanced security and operational control. This feature is crucial for proactively safeguarding your server against potential security threats and unauthorized access.',
+    recommended_action: 'Ensure virtual network is integrated for all web apps.',
+    link: 'https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration',
+    apis: ['webApps:list'],
+    realtime_triggers: ['microsoftweb:sites:write', 'microsoftweb:sites:networkconfig:delete', 'microsoftweb:sites:delete'],
+
+
+    run: function(cache, settings, callback) {
+        var results = [];
+        var source = {};
+        var locations = helpers.locations(settings.govcloud);
+
+        async.each(locations.webApps, function(location, rcb) {
+            const webApps = helpers.addSource(cache, source,
+                ['webApps', 'list', location]);
+
+            if (!webApps) return rcb();
+
+            if (webApps.err || !webApps.data) {
+                helpers.addResult(results, 3, 'Unable to query for Web Apps: ' + helpers.addError(webApps), location);
+                return rcb();
+            }
+
+            if (!webApps.data.length) {
+                helpers.addResult(results, 0, 'No existing Web Apps found', location);
+                return rcb();
+            }
+
+            webApps.data.forEach(function(webApp) {
+                if (webApp && webApp.kind && webApp.kind === 'functionapp') {
+                    helpers.addResult(results, 0, 'Virtual Networks cannot be integrated with function apps', location, webApp.id);
+                } else if (webApp && webApp.virtualNetworkSubnetId) {
+                    helpers.addResult(results, 0, 'App Service is integrated with a virtual network', location, webApp.id);
+                } else {
+                    helpers.addResult(results, 2, 'App Service is not integrated with a virtual network', location, webApp.id);
+                }
+            });
+            rcb();
+        }, function() {
+            // Global checking goes here
+            callback(null, results, source);
+        });
+    }
+};

plugins/azure/appservice/vnetIntegrated.spec.js

@@ -0,0 +1,85 @@
+var expect = require('chai').expect;
+var vnetIntegrated = require('./vnetIntegrated');
+
+const webApps = [
+    {
+        'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Web/sites/app1',
+        'name': 'app1',
+        'virtualNetworkSubnetId': '/subscriptions/12345/resourceGroups/cloudsploit-dev/providers/Microsoft.Network/virtualNetworks/test/subnets/default'
+    },
+    {
+        'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Web/sites/app1',
+        'name': 'app1',
+        'virtualNetworkSubnetId': null
+    }
+];
+
+const createCache = (webApps) => {
+    return {
+        webApps: {
+            list: {
+                'eastus':{
+                    data: webApps
+                }
+            }
+        }
+    };
+};
+
+const createErrorCache = () => {
+    return {
+        webApps: {
+            list: {
+                'eastus': {}
+            }
+        }
+    };
+};
+
+describe('vnetIntegrated', function() {
+    describe('run', function() {
+        it('should give passing result if no web apps', function(done) {
+            const cache = createCache([]);
+            vnetIntegrated.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('No existing Web Apps found');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give unknown result if unable to query web app ', function(done) {
+            const cache = createErrorCache();
+            vnetIntegrated.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query for Web Apps: ');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give passing result if app service has Vnet Integrated', function(done) {
+            const cache = createCache([webApps[0]]);
+            vnetIntegrated.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('App Service is integrated with a virtual network');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give failing result if app service app service does not have Vnet Integrated', function(done) {
+            const cache = createCache([webApps[1]]);
+            vnetIntegrated.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].message).to.include('App Service is not integrated with a virtual network');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+    });
+});