From 0d5d42320bfd7b9e877480f7639911937ff90afc Mon Sep 17 00:00:00 2001 From: Venu Date: Mon, 23 Dec 2024 14:59:10 +0530 Subject: [PATCH 1/4] Add policy pack - Azure VNets have flow log enabled. Closes #893 --- .../README.md | 79 +++++++++++++++++++ .../main.tf | 5 ++ .../policies.tf | 77 ++++++++++++++++++ .../providers.tf | 11 +++ 4 files changed, 172 insertions(+) create mode 100644 policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md create mode 100644 policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf create mode 100644 policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf create mode 100644 policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md new file mode 100644 index 00000000..5f8b61dd --- /dev/null +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md @@ -0,0 +1,79 @@ +--- +categories: ["logging", "networking"] +primary_category: "networking" +type: "featured" +--- + +# Check Azure Virtual Networks Have Flow Logs Enabled + +Ensure that Azure Virtual Networks have flow logs configured and enabled to monitor and analyze network traffic. Flow logs capture information about IP traffic flowing in and out of network interfaces in the virtual network. This helps detect anomalies, troubleshoot issues, and maintain compliance with security best practices and regulatory requirements. + +This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for network security groups: + +- Check if flow logs are configured for Azure Virtual Networks +- Validate that flow logging status is enabled + +**[Review policy settings →](https://hub.guardrails.turbot.com/policy-packs/azure_network_check_virtual_networks_have_flowlog_enabled/settings)** + +## Getting Started + +### Requirements + +- [Terraform](https://developer.hashicorp.com/terraform/install) +- Guardrails mods: + - [@turbot/azure-network](https://hub.guardrails.turbot.com/mods/azure/mods/azure-network) + - [@turbot/azure-networkwatcher](https://hub.guardrails.turbot.com/mods/azure/mods/azure-networkwatcher) + +### Credentials + +To create a policy pack through Terraform: + +- Ensure you have `Turbot/Admin` permissions (or higher) in Guardrails +- [Create access keys](https://turbot.com/guardrails/docs/guides/iam/access-keys#generate-a-new-guardrails-api-access-key) in Guardrails + +And then set your credentials: + +```sh +export TURBOT_WORKSPACE=myworkspace.acme.com +export TURBOT_ACCESS_KEY=acce6ac5-access-key-here +export TURBOT_SECRET_KEY=a8af61ec-secret-key-here +``` + +Please see [Turbot Guardrails Provider authentication](https://registry.terraform.io/providers/turbot/turbot/latest/docs#authentication) for additional authentication methods. + +## Usage + +### Install Policy Pack + +> [!NOTE] +> By default, installed policy packs are not attached to any resources. +> +> Policy packs must be attached to resources in order for their policy settings to take effect. + +Clone: + +```sh +git clone https://github.com/turbot/guardrails-samples.git +cd guardrails-samples/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled +``` + +Run the Terraform to create the policy pack in your workspace: + +```sh +terraform init +terraform plan +``` + +Then apply the changes: + +```sh +terraform apply +``` + +### Apply Policy Pack + +Log into your Guardrails workspace and [attach the policy pack to a resource](https://turbot.com/guardrails/docs/guides/policy-packs#attach-a-policy-pack-to-a-resource). + +If this policy pack is attached to a Guardrails folder, its policies will be applied to all accounts and resources in that folder. The policy pack can also be attached to multiple resources. + +For more information, please see [Policy Packs](https://turbot.com/guardrails/docs/concepts/policy-packs). diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf new file mode 100644 index 00000000..3504d3cf --- /dev/null +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf @@ -0,0 +1,5 @@ +resource "turbot_policy_pack" "main" { + title = "Check Flow Log Is Enabled for Azure Virtual Networks" + description = "Ensure that logging is enabled for Azure Virtual Networks to monitor traffic and maintain security compliance." + akas = ["azure_network_check_virtual_networks_have_flowlog_enabled"] +} diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf new file mode 100644 index 00000000..4b52d75c --- /dev/null +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf @@ -0,0 +1,77 @@ +# Azure > Network > Virtual Network > Approved +resource "turbot_policy_setting" "azure_network_virtual_network_approved" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-network#/policy/types/virtualNetworkApproved" + value = "Check: Approved" +} + +# Azure > Network > Virtual Network > Approved > Usage +resource "turbot_policy_setting" "azure_network_virtual_network_approved_usage" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-network#/policy/types/virtualNetworkApprovedUsage" + value = "Approved" +} + +# Azure > Network > Virtual Network > Approved > Custom +resource "turbot_policy_setting" "azure_network_virtual_network_approved_custom" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-network#/policy/types/virtualNetworkApprovedCustom" + template_input = <<-EOT + - | + { + resource { + name:get(path:"name") + flowLogs:get(path:"flowLogs") + } + } + - | + { + resource { + name:get(path:"name") + flowLogs:get(path:"flowLogs") + } + resources(filter:"resourceTypeId:tmod:@turbot/azure-networkwatcher#/resource/types/flowLog $.id:'{{ $.resource.flowLogs[0].id }}'"){ + items { + enabled:get(path:"enabled") + id:get(path:"id") + name:get(path:"name") + } + } + } + EOT + template = <<-EOT + {%- set virtualNetworkFlowLogs = $.resource.flowLogs %} + {%- set subscriptionFlowLogs = $.resources.items %} + + {%- if virtualNetworkFlowLogs and virtualNetworkFlowLogs | length > 0 %} + {%- for vnetFlowLog in virtualNetworkFlowLogs %} + {%- set matchedFlowLog = null %} + {%- for subscriptionFlowLog in subscriptionFlowLogs %} + {%- if subscriptionFlowLog.id == vnetFlowLog.id %} + {%- set matchedFlowLog = subscriptionFlowLog %} + {%- endif %} + {%- endfor %} + + {%- if matchedFlowLog %} + {%- if matchedFlowLog.enabled %} + - title: Flow Log + result: Approved + message: "Flow log '{{ matchedFlowLog.name }}' is configured" + {%- else %} + - title: Flow Log + result: Not approved + message: "Flow log '{{ matchedFlowLog.name }}' is configured but currently disabled" + {%- endif %} + {%- else %} + - title: Flow Log + result: Not approved + message: "Flow log is configured, but the resource '{{ vnetFlowLog.id.split('/').pop() }}' is not in CMDB. Please run the Flow Log Discovery controls within the Subscription" + {%- endif %} + {%- endfor %} + {%- else %} + - title: Flow Log + result: Not approved + message: "Flow log is not configured" + {%- endif %} + EOT +} diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf new file mode 100644 index 00000000..3ede1821 --- /dev/null +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf @@ -0,0 +1,11 @@ +terraform { + required_providers { + turbot = { + source = "turbot/turbot" + version = ">= 1.11.0" + } + } +} + +provider "turbot" { +} From 2a9fb3d9a24895e0f6eea808b446c3eee330a279 Mon Sep 17 00:00:00 2001 From: Venu Date: Mon, 23 Dec 2024 15:13:34 +0530 Subject: [PATCH 2/4] Update messages and title --- .../check_virtual_networks_have_flowlog_enabled/main.tf | 2 +- .../check_virtual_networks_have_flowlog_enabled/policies.tf | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf index 3504d3cf..423b252d 100644 --- a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf @@ -1,5 +1,5 @@ resource "turbot_policy_pack" "main" { - title = "Check Flow Log Is Enabled for Azure Virtual Networks" + title = "Check Azure Virtual Networks Have Flow Log Enabled" description = "Ensure that logging is enabled for Azure Virtual Networks to monitor traffic and maintain security compliance." akas = ["azure_network_check_virtual_networks_have_flowlog_enabled"] } diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf index 4b52d75c..2b64f69f 100644 --- a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf @@ -56,15 +56,15 @@ resource "turbot_policy_setting" "azure_network_virtual_network_approved_custom" {%- if matchedFlowLog.enabled %} - title: Flow Log result: Approved - message: "Flow log '{{ matchedFlowLog.name }}' is configured" + message: "Flow log '{{ matchedFlowLog.name }}' is enabled" {%- else %} - title: Flow Log result: Not approved - message: "Flow log '{{ matchedFlowLog.name }}' is configured but currently disabled" + message: "Flow log '{{ matchedFlowLog.name }}' is configured but not enabled" {%- endif %} {%- else %} - title: Flow Log - result: Not approved + result: Skip message: "Flow log is configured, but the resource '{{ vnetFlowLog.id.split('/').pop() }}' is not in CMDB. Please run the Flow Log Discovery controls within the Subscription" {%- endif %} {%- endfor %} From d804a57b2c3cc049485d38d5d59d65e68d6b6034 Mon Sep 17 00:00:00 2001 From: Venu Date: Mon, 23 Dec 2024 15:23:38 +0530 Subject: [PATCH 3/4] update title --- .../network/check_virtual_networks_have_flowlog_enabled/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf index 423b252d..00d75c6d 100644 --- a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf +++ b/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf @@ -1,5 +1,5 @@ resource "turbot_policy_pack" "main" { - title = "Check Azure Virtual Networks Have Flow Log Enabled" + title = "Check Azure Virtual Networks Have Flow Logs Enabled" description = "Ensure that logging is enabled for Azure Virtual Networks to monitor traffic and maintain security compliance." akas = ["azure_network_check_virtual_networks_have_flowlog_enabled"] } From 26d79214b2cd147677a75a4bd440399eacb1734a Mon Sep 17 00:00:00 2001 From: Venu Date: Mon, 23 Dec 2024 15:27:31 +0530 Subject: [PATCH 4/4] update file name --- .../README.md | 0 .../main.tf | 0 .../policies.tf | 0 .../providers.tf | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename policy_packs/azure/network/{check_virtual_networks_have_flowlog_enabled => check_virtual_networks_have_flowlogs_enabled}/README.md (100%) rename policy_packs/azure/network/{check_virtual_networks_have_flowlog_enabled => check_virtual_networks_have_flowlogs_enabled}/main.tf (100%) rename policy_packs/azure/network/{check_virtual_networks_have_flowlog_enabled => check_virtual_networks_have_flowlogs_enabled}/policies.tf (100%) rename policy_packs/azure/network/{check_virtual_networks_have_flowlog_enabled => check_virtual_networks_have_flowlogs_enabled}/providers.tf (100%) diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md b/policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/README.md similarity index 100% rename from policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/README.md rename to policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/README.md diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/main.tf similarity index 100% rename from policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/main.tf rename to policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/main.tf diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/policies.tf similarity index 100% rename from policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/policies.tf rename to policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/policies.tf diff --git a/policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf b/policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/providers.tf similarity index 100% rename from policy_packs/azure/network/check_virtual_networks_have_flowlog_enabled/providers.tf rename to policy_packs/azure/network/check_virtual_networks_have_flowlogs_enabled/providers.tf