feat(arm): add CKV_AZURE_76 to ensure that Azure Batch account uses key vault to encrypt data

checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py

@@ -0,0 +1,22 @@
+from checkov.common.models.consts import ANY_VALUE
+from typing import Any
+from checkov.common.models.enums import CheckCategories
+from checkov.arm.base_resource_value_check import BaseResourceValueCheck
+
+
+class AzureBatchAccountUsesKeyVaultEncryption(BaseResourceValueCheck):
+ def __init__(self) -> None:
+ name = "Ensure that Azure Batch account uses key vault to encrypt data"
+ id = "CKV_AZURE_76"
+ supported_resources = ("Microsoft.Batch/batchAccounts",)
+ categories = [CheckCategories.ENCRYPTION]
+ super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,)
+
+ def get_inspected_key(self) -> str:
+ return "properties/keyVaultReference"
+
+ def get_expected_value(self) -> Any:
+ return ANY_VALUE
+
+
+check = AzureBatchAccountUsesKeyVaultEncryption()

tests/arm/checks/resource/example_AzureBatchAccountUsesKeyVaultEncryption/fail.json

@@ -0,0 +1,106 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "_generator": {
+ "name": "bicep",
+ "version": "0.26.54.24096",
+ "templateHash": "5620168434409602803"
+ }
+ },
+ "parameters": {
+ "batchAccountName": {
+ "type": "string",
+ "defaultValue": "[format('{0}batch', toLower(uniqueString(resourceGroup().id)))]",
+ "metadata": {
+ "description": "Batch Account Name"
+ }
+ },
+ "storageAccountsku": {
+ "type": "string",
+ "defaultValue": "Standard_LRS",
+ "allowedValues": [
+ "Standard_LRS",
+ "Standard_GRS",
+ "Standard_ZRS",
+ "Premium_LRS"
+ ],
+ "metadata": {
+ "description": "Storage Account type"
+ }
+ },
+ "location": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Location for all resources."
+ }
+ }
+ },
+ "variables": {
+ "storageAccountName": "[format('{0}storage', uniqueString(resourceGroup().id))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.Storage/storageAccounts",
+ "apiVersion": "2023-01-01",
+ "name": "[variables('storageAccountName')]",
+ "location": "[parameters('location')]",
+ "sku": {
+ "name": "[parameters('storageAccountsku')]"
+ },
+ "kind": "StorageV2",
+ "tags": {
+ "ObjectName": "[variables('storageAccountName')]"
+ },
+ "properties": {
+ "minimumTlsVersion": "TLS1_2",
+ "allowBlobPublicAccess": false,
+ "networkAcls": {
+ "defaultAction": "Deny"
+ },
+ "supportsHttpsTrafficOnly": true
+ }
+ },
+ {
+ "type": "Microsoft.Batch/batchAccounts",
+ "apiVersion": "2024-02-01",
+ "name": "fail",
+ "location": "[parameters('location')]",
+ "tags": {
+ "ObjectName": "[parameters('batchAccountName')]"
+ },
+ "properties": {
+ "autoStorage": {
+ "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
+ }
+
+ },
+ "dependsOn": [
+ "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
+ ]
+ }
+ ],
+ "outputs": {
+ "storageAccountName": {
+ "type": "string",
+ "value": "[variables('storageAccountName')]"
+ },
+ "batchAccountName": {
+ "type": "string",
+ "value": "[parameters('batchAccountName')]"
+ },
+ "location": {
+ "type": "string",
+ "value": "[parameters('location')]"
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "value": "[resourceGroup().name]"
+ },
+ "resourceId": {
+ "type": "string",
+ "value": "[resourceId('Microsoft.Batch/batchAccounts', parameters('batchAccountName'))]"
+ }
+ }
+}

tests/arm/checks/resource/example_AzureBatchAccountUsesKeyVaultEncryption/pass.json

@@ -0,0 +1,109 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "_generator": {
+ "name": "bicep",
+ "version": "0.26.54.24096",
+ "templateHash": "5620168434409602803"
+ }
+ },
+ "parameters": {
+ "batchAccountName": {
+ "type": "string",
+ "defaultValue": "[format('{0}batch', toLower(uniqueString(resourceGroup().id)))]",
+ "metadata": {
+ "description": "Batch Account Name"
+ }
+ },
+ "storageAccountsku": {
+ "type": "string",
+ "defaultValue": "Standard_LRS",
+ "allowedValues": [
+ "Standard_LRS",
+ "Standard_GRS",
+ "Standard_ZRS",
+ "Premium_LRS"
+ ],
+ "metadata": {
+ "description": "Storage Account type"
+ }
+ },
+ "location": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Location for all resources."
+ }
+ }
+ },
+ "variables": {
+ "storageAccountName": "[format('{0}storage', uniqueString(resourceGroup().id))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.Storage/storageAccounts",
+ "apiVersion": "2023-01-01",
+ "name": "[variables('storageAccountName')]",
+ "location": "[parameters('location')]",
+ "sku": {
+ "name": "[parameters('storageAccountsku')]"
+ },
+ "kind": "StorageV2",
+ "tags": {
+ "ObjectName": "[variables('storageAccountName')]"
+ },
+ "properties": {
+ "minimumTlsVersion": "TLS1_2",
+ "allowBlobPublicAccess": false,
+ "networkAcls": {
+ "defaultAction": "Deny"
+ },
+ "supportsHttpsTrafficOnly": true
+ }
+ },
+ {
+ "type": "Microsoft.Batch/batchAccounts",
+ "apiVersion": "2024-02-01",
+ "name": "pass",
+ "location": "[parameters('location')]",
+ "tags": {
+ "ObjectName": "[parameters('batchAccountName')]"
+ },
+ "properties": {
+ "autoStorage": {
+ "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
+ },
+ "keyVaultReference": {
+ "id": "test",
+ "url": "https://test.com"
+ }
+ },
+ "dependsOn": [
+ "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
+ ]
+ }
+ ],
+ "outputs": {
+ "storageAccountName": {
+ "type": "string",
+ "value": "[variables('storageAccountName')]"
+ },
+ "batchAccountName": {
+ "type": "string",
+ "value": "[parameters('batchAccountName')]"
+ },
+ "location": {
+ "type": "string",
+ "value": "[parameters('location')]"
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "value": "[resourceGroup().name]"
+ },
+ "resourceId": {
+ "type": "string",
+ "value": "[resourceId('Microsoft.Batch/batchAccounts', parameters('batchAccountName'))]"
+ }
+ }
+}

tests/arm/checks/resource/test_AzureBatchAccountUsesKeyVaultEncryption.py

@@ -0,0 +1,39 @@
+import unittest
+from pathlib import Path
+from checkov.arm.checks.resource.AzureBatchAccountUsesKeyVaultEncryption import check
+from checkov.arm.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestAzureBatchAccountUsesKeyVaultEncryption(unittest.TestCase):
+ def test_summary(self):
+ # given
+ test_files_dir = Path(__file__).parent / "example_AzureBatchAccountUsesKeyVaultEncryption"
+
+ # when
+ report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
+
+ # then
+ summary = report.get_summary()
+
+ passing_resources = {
+ "Microsoft.Batch/batchAccounts.pass",
+ }
+ failing_resources = {
+ "Microsoft.Batch/batchAccounts.fail",
+ }
+
+ passed_check_resources = {c.resource for c in report.passed_checks}
+ failed_check_resources = {c.resource for c in report.failed_checks}
+
+ self.assertEqual(summary["passed"], len(passing_resources))
+ self.assertEqual(summary["failed"], len(failing_resources))
+ self.assertEqual(summary["skipped"], 0)
+ self.assertEqual(summary["parsing_errors"], 0)
+
+ self.assertEqual(passing_resources, passed_check_resources)
+ self.assertEqual(failing_resources, failed_check_resources)
+
+
+if __name__ == "__main__":
+ unittest.main()