Skip to content

Commit

Permalink
feat(arm): implement CKV_AZURE_149 for ARM (#5496)
Browse files Browse the repository at this point in the history 
* feat(arm): implement CKV_AZURE_149 for ARM

* fix dog food

* fix dog food

* adjust logic

---------

Co-authored-by: gruebel <[email protected]>
  • Loading branch information
@JamesWoolfenden @gruebel
JamesWoolfenden and gruebel authored Sep 27, 2023
1 parent 7805b28 commit c64513e
Show file tree
Hide file tree
Showing 6 changed files with 984 additions and 0 deletions.
51 changes: 51 additions & 0 deletions checkov/arm/checks/resource/VMDisablePasswordAuthentication.py
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
from __future__ import annotations

from typing import Any

from checkov.common.models.enums import CheckCategories, CheckResult
from checkov.arm.base_resource_check import BaseResourceCheck


class VMDisablePasswordAuthentication(BaseResourceCheck):
def __init__(self) -> None:
name = "Ensure that Virtual machine does not enable password authentication"
id = "CKV_AZURE_149"
supported_resources = (
"Microsoft.Compute/virtualMachineScaleSets",
"Microsoft.Compute/virtualMachines",
)
categories = (CheckCategories.ENCRYPTION,)
super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)

def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult:
os_profile = None

properties = conf.get("properties")
if properties and isinstance(properties, dict):
if self.entity_type == "Microsoft.Compute/virtualMachines":
tmp_os_profile = properties.get("osProfile")
if tmp_os_profile and isinstance(tmp_os_profile, dict):
os_profile = tmp_os_profile
elif self.entity_type == "Microsoft.Compute/virtualMachineScaleSets":
vm_profile = properties.get("virtualMachineProfile")
if vm_profile and isinstance(vm_profile, dict):
tmp_os_profile = vm_profile.get("osProfile")
if tmp_os_profile and isinstance(tmp_os_profile, dict):
os_profile = tmp_os_profile

if os_profile is None:
return CheckResult.UNKNOWN

linux_config = os_profile.get("linuxConfiguration")
if linux_config and isinstance(linux_config, dict):
pass_auth = linux_config.get("disablePasswordAuthentication")
if pass_auth and isinstance(pass_auth, bool):
return CheckResult.PASSED if pass_auth and isinstance(pass_auth, bool) else CheckResult.FAILED
return CheckResult.FAILED

return CheckResult.UNKNOWN

return CheckResult.FAILED


check = VMDisablePasswordAuthentication()
235 changes: 235 additions & 0 deletions tests/arm/checks/resource/example_VMDisablePasswordAuthentication/failed-vm.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,235 @@
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"location": {
"type": "string"
},
"networkInterfaceName1": {
"type": "string"
},
"enableAcceleratedNetworking": {
"type": "bool"
},
"networkSecurityGroupName": {
"type": "string"
},
"networkSecurityGroupRules": {
"type": "array"
},
"subnetName": {
"type": "string"
},
"virtualNetworkName": {
"type": "string"
},
"addressPrefixes": {
"type": "array"
},
"subnets": {
"type": "array"
},
"publicIpAddressName1": {
"type": "string"
},
"publicIpAddressType": {
"type": "string"
},
"publicIpAddressSku": {
"type": "string"
},
"pipDeleteOption": {
"type": "string"
},
"virtualMachineName": {
"type": "string"
},
"virtualMachineName1": {
"type": "string"
},
"virtualMachineComputerName1": {
"type": "string"
},
"virtualMachineRG": {
"type": "string"
},
"osDiskType": {
"type": "string"
},
"osDiskDeleteOption": {
"type": "string"
},
"virtualMachineSize": {
"type": "string"
},
"nicDeleteOption": {
"type": "string"
},
"adminUsername": {
"type": "string"
},
"adminPassword": {
"type": "secureString"
},
"securityType": {
"type": "string"
},
"secureBoot": {
"type": "bool"
},
"vTPM": {
"type": "bool"
},
"virtualMachine1Zone": {
"type": "string"
}
},
"variables": {
"nsgId": "[resourceId(resourceGroup().name, 'Microsoft.Network/networkSecurityGroups', parameters('networkSecurityGroupName'))]",
"vnetName": "[parameters('virtualNetworkName')]",
"vnetId": "[resourceId(resourceGroup().name,'Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]",
"subnetRef": "[concat(variables('vnetId'), '/subnets/', parameters('subnetName'))]"
},
"resources": [
{
"name": "[parameters('networkInterfaceName1')]",
"type": "Microsoft.Network/networkInterfaces",
"apiVersion": "2022-11-01",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/networkSecurityGroups/', parameters('networkSecurityGroupName'))]",
"[concat('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]",
"[concat('Microsoft.Network/publicIpAddresses/', parameters('publicIpAddressName1'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"subnet": {
"id": "[variables('subnetRef')]"
},
"privateIPAllocationMethod": "Dynamic",
"publicIpAddress": {
"id": "[resourceId(resourceGroup().name, 'Microsoft.Network/publicIpAddresses', parameters('publicIpAddressName1'))]",
"properties": {
"deleteOption": "[parameters('pipDeleteOption')]"
}
}
}
}
],
"enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
"networkSecurityGroup": {
"id": "[variables('nsgId')]"
}
}
},
{
"name": "[parameters('networkSecurityGroupName')]",
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2019-02-01",
"location": "[parameters('location')]",
"properties": {
"securityRules": "[parameters('networkSecurityGroupRules')]"
}
},
{
"name": "[parameters('virtualNetworkName')]",
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2021-05-01",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": "[parameters('addressPrefixes')]"
},
"subnets": "[parameters('subnets')]"
}
},
{
"name": "[parameters('publicIpAddressName1')]",
"type": "Microsoft.Network/publicIpAddresses",
"apiVersion": "2020-08-01",
"location": "[parameters('location')]",
"properties": {
"publicIpAllocationMethod": "[parameters('publicIpAddressType')]"
},
"sku": {
"name": "[parameters('publicIpAddressSku')]"
},
"zones": [
"[parameters('virtualMachine1Zone')]"
]
},
{
"name": "failed",
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2022-03-01",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/networkInterfaces/', parameters('networkInterfaceName1'))]"
],
"properties": {
"hardwareProfile": {
"vmSize": "[parameters('virtualMachineSize')]"
},
"storageProfile": {
"osDisk": {
"createOption": "fromImage",
"managedDisk": {
"storageAccountType": "[parameters('osDiskType')]"
},
"deleteOption": "[parameters('osDiskDeleteOption')]"
},
"imageReference": {
"publisher": "canonical",
"offer": "0001-com-ubuntu-server-focal",
"sku": "20_04-lts-gen2",
"version": "latest"
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('networkInterfaceName1'))]",
"properties": {
"deleteOption": "[parameters('nicDeleteOption')]"
}
}
]
},
"osProfile": {
"computerName": "[parameters('virtualMachineComputerName1')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]",
"linuxConfiguration": {
"patchSettings": {
"patchMode": "ImageDefault"
}
}
},
"securityProfile": {
"securityType": "[parameters('securityType')]",
"uefiSettings": {
"secureBootEnabled": "[parameters('secureBoot')]",
"vTpmEnabled": "[parameters('vTPM')]"
}
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true
}
}
},
"zones": [
"[parameters('virtualMachine1Zone')]"
]
}
],
"outputs": {
"adminUsername": {
"type": "string",
"value": "[parameters('adminUsername')]"
}
}
}
Loading

0 comments on commit c64513e

Please sign in to comment.