azure-security.yml

apiVersion: kopexa.io/v1alpha1
kind: Policy
metadata:
  name: kopexa-azure-security
  title: Kopexa Microsoft Azure Security
  version: 2.0.3
  tags:
    kopexa.com/category: security
    kopexa.com/platform: azure,cloud

require:
  - provider: azure

authors:
  - name: Kopexa GmbH
    email: security@kopexa.com

groups:
  - title: Azure Storage
    checks:
      - uid: kopexa-azure-security-public-access-level-private-blob-containers
      - uid: kopexa-azure-security-trusted-microsoft-services-enabled-for-storage-account-access
      - uid: kopexa-azure-security-secure-transfer-required-enabled
      - uid: kopexa-azure-security-default-network-access-rule-storage-accounts-deny

  - title: Azure SQL
    checks:
      - uid: kopexa-azure-security-sql-server-audit-on
      - uid: kopexa-azure-security-sql-server-tde-on
      - uid: kopexa-azure-security-ensure-that-ssl-enabled-latest-version-mysql
      - uid: kopexa-azure-security-ensure-that-ssl-enabled-postgresql
      - uid: kopexa-azure-security-no-sql-databases-allow-ingress-0-0-0-0-0
      - uid: kopexa-azure-security-ensure-disabled-public-access-sql

  - title: Azure Key Vault
    checks:
      - uid: kopexa-azure-security-ensure-the-kv-is-recoverable
      - uid: kopexa-azure-security-keyvault-public-access-disabled

  - title: Azure Compute
    checks:
      - uid: kopexa-azure-security-ensure-os-disk-are-encrypted
      - uid: kopexa-azure-security-nsg-no-unrestricted-ssh
      - uid: kopexa-azure-security-nsg-no-unrestricted-rdp

  - title: Azure Core
    filter: asset.type == "azure-subscription"
    checks:
      - uid: kopexa-azure-security-diagnostic-settings-exist
      - uid: kopexa-azure-security-ensure-register-with-ad-is-enabled-on-app-service
      - uid: kopexa-azure-security-ensure-web-app-is-using-the-latest-tls

scoring_system: highest_impact

queries:
  # Storage Security Checks
  - uid: kopexa-azure-security-public-access-level-private-blob-containers
    title: Ensure that anonymous access to blob containers and public access on storage accounts are disabled
    resource: azure_storage_account
    severity: critical
    query: |
      has(resource.properties) &&
      has(resource.properties.allowBlobPublicAccess) &&
      resource.properties.allowBlobPublicAccess == false
    docs: |
      Anonymous access to blob containers can lead to unauthorized data exposure. This check ensures that public blob access is disabled on storage accounts.
    audit: |
      **Azure Portal:**
      1. Go to Storage Accounts
      2. For each storage account, check Networking settings
      3. Verify 'Public Network Access' is set to 'Disabled'
      4. Under Configuration, verify 'Allow Blob Anonymous Access' is 'Disabled'
    remediation: |
      Disable public blob access in storage account configuration settings.

  - uid: kopexa-azure-security-trusted-microsoft-services-enabled-for-storage-account-access
    title: Ensure "Trusted Microsoft Services" have access to azure storage accounts
    resource: azure_storage_account
    severity: high
    query: |
      has(resource.properties) &&
      has(resource.properties.networkAcls) &&
      has(resource.properties.networkAcls.bypass) &&
      resource.properties.networkAcls.bypass == "AzureServices" &&
      resource.properties.networkAcls.defaultAction == "Deny"
    docs: |
      Allowing trusted Microsoft services ensures operational functionality while maintaining security.
    remediation: |
      Enable 'Allow trusted Microsoft services' in storage account networking settings.

  - uid: kopexa-azure-security-secure-transfer-required-enabled
    title: Mandate HTTPS for Secure Data Transfer to azure storage accounts
    resource: azure_storage_account
    severity: critical
    query: |
      has(resource.properties) &&
      has(resource.properties.supportsHttpsTrafficOnly) &&
      resource.properties.supportsHttpsTrafficOnly == true
    docs: |
      Enforces HTTPS for all data operations to prevent data interception.
    remediation: |
      Enable 'Secure transfer required' in storage account configuration.

  - uid: kopexa-azure-security-default-network-access-rule-storage-accounts-deny
    title: Enforce Deny as Default Network Access for Azure Storage Accounts
    resource: azure_storage_account
    severity: critical
    query: |
      has(resource.properties) &&
      has(resource.properties.networkAcls) &&
      resource.properties.networkAcls.defaultAction == "Deny"
    docs: |
      Setting default network access to "Deny" ensures only explicitly allowed networks can access storage.
    remediation: |
      Set default network access rule to 'Deny' in storage account networking settings.

  # SQL Security Checks
  - uid: kopexa-azure-security-sql-server-audit-on
    title: Ensure that all activities on SQL server are audited
    resource: azure_sql_server
    severity: high
    query: |
      has(resource.auditingPolicy) &&
      resource.auditingPolicy.state == "Enabled"
    docs: |
      Auditing SQL server activities helps detect unauthorized access and suspicious behavior.
    remediation: |
      Enable auditing for the SQL server in Azure portal or via Azure CLI.

  - uid: kopexa-azure-security-sql-server-tde-on
    title: Ensure that transparent data encryption is enabled for SQL Server databases
    resource: azure_sql_database
    severity: high
    query: |
      resource.name == "master" ||
      (has(resource.transparentDataEncryption) &&
       resource.transparentDataEncryption.state == "Enabled")
    docs: |
      TDE encrypts data at rest, protecting sensitive information from unauthorized access.
    remediation: |
      Enable Transparent Data Encryption for each SQL database.

  - uid: kopexa-azure-security-ensure-that-ssl-enabled-latest-version-mysql
    title: Ensure SSL connection enabled for MySQL Database Server with the latest version
    resource: azure_mysql_server
    severity: critical
    query: |
      has(resource.properties) &&
      resource.properties.sslEnforcement == "Enabled" &&
      resource.properties.minimalTlsVersion == "TLS1_2"
    docs: |
      Enforces SSL/TLS connections and ensures the latest TLS version is used for MySQL servers.
    remediation: |
      Enable SSL enforcement and set minimum TLS version to 1.2 for MySQL server.

  - uid: kopexa-azure-security-ensure-that-ssl-enabled-postgresql
    title: Ensure SSL connection enabled for PostgreSQL database servers
    resource: azure_postgresql_server
    severity: critical
    query: |
      has(resource.properties) &&
      resource.properties.sslEnforcement == "Enabled"
    docs: |
      Enforces SSL/TLS for all PostgreSQL connections to protect data in transit.
    remediation: |
      Enable SSL enforcement for the PostgreSQL server.

  - uid: kopexa-azure-security-no-sql-databases-allow-ingress-0-0-0-0-0
    title: Ensure no SQL Databases allow ingress 0.0.0.0/0 (ANY IP)
    resource: azure_sql_server
    severity: critical
    query: |
      !has(resource.firewallRules) ||
      size(resource.firewallRules) == 0 ||
      resource.firewallRules.all(rule, rule.startIpAddress != "0.0.0.0" || rule.endIpAddress != "255.255.255.255")
    docs: |
      Prevents unrestricted network access to SQL databases from any IP address.
    remediation: |
      Remove firewall rules that allow access from 0.0.0.0 to 255.255.255.255.

  - uid: kopexa-azure-security-ensure-disabled-public-access-sql
    title: Ensure public network access for SQL server is blocked or Limited to Use Selected Networks
    resource: azure_sql_server
    severity: critical
    query: |
      has(resource.properties) &&
      (resource.properties.publicNetworkAccess == "Disabled" ||
       (has(resource.virtualNetworkRules) && size(resource.virtualNetworkRules) > 0) ||
       (has(resource.firewallRules) && size(resource.firewallRules) > 0))
    docs: |
      Limits public network access to SQL servers to reduce exposure to attacks.
    remediation: |
      Disable public network access or configure virtual network rules for the SQL server.

  # Key Vault Security Checks
  - uid: kopexa-azure-security-ensure-the-kv-is-recoverable
    title: Ensure Key Vaults are configured with Recovery features
    resource: azure_keyvault_vault
    severity: critical
    query: |
      has(resource.properties) &&
      has(resource.properties.enablePurgeProtection) &&
      resource.properties.enablePurgeProtection == true
    docs: |
      Purge protection prevents accidental or malicious permanent deletion of key vaults.
    remediation: |
      Enable purge protection for the Key Vault.

  - uid: kopexa-azure-security-keyvault-public-access-disabled
    title: Ensure default public network access for Azure Key Vault is disabled
    resource: azure_keyvault_vault
    severity: critical
    query: |
      has(resource.properties) &&
      (resource.properties.publicNetworkAccess == "Disabled" ||
       (has(resource.properties.networkAcls) &&
        ((has(resource.properties.networkAcls.ipRules) && size(resource.properties.networkAcls.ipRules) > 0) ||
         (has(resource.properties.networkAcls.virtualNetworkRules) && size(resource.properties.networkAcls.virtualNetworkRules) > 0))))
    docs: |
      Restricting public network access to Key Vault minimizes exposure to potential attacks.
    remediation: |
      Disable public network access or configure IP/virtual network rules for the Key Vault.

  # Compute Security Checks
  - uid: kopexa-azure-security-ensure-os-disk-are-encrypted
    title: Ensure OS Disks in azure virtual machines are encrypted with Customer Managed Keys
    resource: azure_virtual_machine
    severity: critical
    query: |
      has(resource.osDisk) &&
      has(resource.osDisk.properties) &&
      has(resource.osDisk.properties.encryption) &&
      resource.osDisk.properties.encryption.type == "EncryptionAtRestWithCustomerKey"
    docs: |
      Encrypting OS disks with CMK provides enhanced control over encryption and decryption processes.
    remediation: |
      Enable disk encryption with Customer Managed Keys for the virtual machine.

  - uid: kopexa-azure-security-nsg-no-unrestricted-ssh
    title: Ensure that SSH access is restricted from the internet
    resource: azure_network_security_group
    severity: critical
    query: |
      !has(resource.securityRules) ||
      size(resource.securityRules) == 0 ||
      !resource.securityRules.exists(rule,
        has(rule.properties) &&
        rule.properties.access == "Allow" &&
        rule.properties.direction == "Inbound" &&
        (rule.properties.protocol == "TCP" || rule.properties.protocol == "*") &&
        (rule.properties.sourceAddressPrefix == "*" ||
         rule.properties.sourceAddressPrefix == "0.0.0.0/0" ||
         rule.properties.sourceAddressPrefix == "Internet" ||
         rule.properties.sourceAddressPrefix == "Any") &&
        (rule.properties.destinationPortRange == "22" ||
         rule.properties.destinationPortRange == "*")
      )
    docs: |
      Restricting SSH access from the internet prevents unauthorized remote access attempts.
    remediation: |
      Remove or restrict NSG rules that allow SSH (port 22) from any internet source.

  - uid: kopexa-azure-security-nsg-no-unrestricted-rdp
    title: Ensure that RDP access is restricted from the internet
    resource: azure_network_security_group
    severity: critical
    query: |
      !has(resource.securityRules) ||
      size(resource.securityRules) == 0 ||
      !resource.securityRules.exists(rule,
        has(rule.properties) &&
        rule.properties.access == "Allow" &&
        rule.properties.direction == "Inbound" &&
        (rule.properties.protocol == "TCP" || rule.properties.protocol == "*") &&
        (rule.properties.sourceAddressPrefix == "*" ||
         rule.properties.sourceAddressPrefix == "0.0.0.0/0" ||
         rule.properties.sourceAddressPrefix == "Internet" ||
         rule.properties.sourceAddressPrefix == "Any") &&
        (rule.properties.destinationPortRange == "3389" ||
         rule.properties.destinationPortRange == "*")
      )
    docs: |
      Restricting RDP access from the internet prevents brute force and unauthorized access attempts.
    remediation: |
      Remove or restrict NSG rules that allow RDP (port 3389) from any internet source.

  # Core Security Checks
  - uid: kopexa-azure-security-diagnostic-settings-exist
    title: Ensure that diagnostic settings exist for the subscription
    resource: azure_subscription
    severity: high
    query: |
      has(resource.monitor) &&
      has(resource.monitor.diagnosticSettings) &&
      size(resource.monitor.diagnosticSettings) > 0
    docs: |
      Diagnostic settings enable effective monitoring and security analysis of Azure resources.
    remediation: |
      Create diagnostic settings for the Azure subscription to enable logging.

  - uid: kopexa-azure-security-ensure-register-with-ad-is-enabled-on-app-service
    title: Enable Managed Identities for App services to Authenticate via Microsoft Entra ID
    resource: azure_app_service
    severity: high
    query: |
      has(resource.identity) &&
      has(resource.identity.type) &&
      resource.identity.type == "SystemAssigned" &&
      has(resource.identity.principalId) &&
      resource.identity.principalId != ""
    docs: |
      Managed Identities eliminate the need to store credentials and enhance security.
    remediation: |
      Enable System Assigned Managed Identity for the App Service.

  - uid: kopexa-azure-security-ensure-web-app-is-using-the-latest-tls
    title: Ensure that Web Apps use the latest available version of TLS encryption
    resource: azure_app_service
    severity: high
    query: |
      has(resource.configuration) &&
      has(resource.configuration.properties) &&
      resource.configuration.properties.minTlsVersion == "1.2"
    docs: |
      Using the latest TLS version ensures strong encryption and mitigates known vulnerabilities.
    remediation: |
      Set minimum TLS version to 1.2 for the App Service.