feat(arm): implement CKV_AZURE_97 for ARM

[JamesWoolfenden]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Fixes # (issue)

New/Edited policies (Delete if not relevant)

Description

Include a description of what makes it a violation and any relevant external links.

Fix

How does someone fix the issue in code and/or in runtime?

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[gruebel]

🍺

[mmassey1993]

Hi,

This merge has now broken my checkov for the things you have tried to resolve. I am now getting errors of CKV_AZURE_97 on my tests asking for encryptionAtHost property to be set to true on my Bicep virtual machine modules, which it already is.

Please can you review the code. Looks like it tries to find the "virtualMachineProfile" property, something which doesnt exist in Bicep. There is a securityProfile property though.

Many thanks

Michael

[gruebel]

hey @mmassey1993 thanks for reaching out.

I checked the code and also the Bicep docs. If you define a Microsoft.Compute/virtualMachineScaleSets resource, then securityProfile is found under virtualMachineProfile. If it is a Microsoft.Compute/virtualMachines resource, then is just securityProfile. Without an example of the resource, which is failing for you I can't say why is failing.

[mmassey1993]

Yeah i have that. This is one of the modules that fails now for me on the check:
resource VM 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: virtualMachineName
location: location
tags: tags
properties: {
networkProfile: {
networkInterfaces: [
{
id: networkInterface.id
}
]
}
osProfile: {
computerName: virtualMachineName
adminUsername: username
adminPassword: password
}
licenseType: 'Windows_Server'
hardwareProfile: {
vmSize: 'Standard_D2s_v5'
}
securityProfile: {
encryptionAtHost: true
}
storageProfile: {
osDisk: {
createOption: 'FromImage'
managedDisk: {
storageAccountType: 'StandardSSD_LRS'
}
}
dataDisks: [
{
diskSizeGB: 1023
lun: 0
createOption: 'Empty'
}
]
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: '2022-datacenter-azure-edition'
version: 'latest'
}
}
}
}

[gruebel]

thanks, found the issue. We check against a string not a boolean. I will prepare a fix for it 🙂

[mmassey1993]

Awesome thank you. Please let me know when resolved :)