AzSDKPreview

2.0.5

Framework/Abstracts/SVTBase.ps1

Set-StrictMode -Version Latest 
class SVTBase: AzSdkRoot
{
    hidden [string] $ResourceId = ""
    [ResourceContext] $ResourceContext
    hidden [SVTConfig] $SVTConfig
    hidden [PSObject] $ControlSettings
    hidden [PSObject] $ControlStateIndexer = @()
    hidden [ControlState[]] $ControlStates =@()
    hidden [ControlItem] $CurrentControlItem;

    hidden [ControlItem[]] $ApplicableControls = $null;

    [string[]] $FilterTags = @();
    [string[]] $ExcludeTags = @();
    [string[]] $ControlIds = @();

    SVTBase([string] $subscriptionId, [SVTResource] $svtResource): 
        Base($subscriptionId)
    {
        $this.CreateInstance($svtResource);
    }

    SVTBase([string] $subscriptionId): 
        Base($subscriptionId)
    {
        $this.CreateInstance();
    }

    SVTBase([string] $subscriptionId, [string] $resourceGroupName, [string] $resourceName): 
        Base($subscriptionId)
    {
        $this.CreateInstance([SVTResource]@{
            ResourceGroupName = $resourceGroupName;
            ResourceName = $resourceName;
        });
    }
    hidden [void] CreateInstance()
    {
        [Helpers]::AbstractClass($this, [SVTBase]);
        
        $this.LoadSvtConfig([SVTMapping]::SubscriptionMapping.JsonFileName);

        $this.ResourceContext = [ResourceContext]@{
            FeatureName = ($this.SVTConfig.FeatureName);
            Reference = ($this.SVTConfig.Reference);
            SubscriptionId = ($this.Context.SubscriptionId);
            SubscriptionName = ($this.Context.SubscriptionName);
        }
        $this.ControlStateIndexer = [ControlStateManager]::GetControlStateIndexer();
        $this.ControlStates = $this.GetControlStates();        
    }
    hidden [void] CreateInstance([SVTResource] $svtResource)
    {
        [Helpers]::AbstractClass($this, [SVTBase]); 

        if(-not $svtResource)
        {
            throw [System.ArgumentException] ("The argument 'svtResource' is null");
        }

        if([string]::IsNullOrEmpty($svtResource.ResourceGroupName))
        {
            throw [System.ArgumentException] ("The argument 'ResourceGroupName' is null or empty");
        }

        if([string]::IsNullOrEmpty($svtResource.ResourceName))
        {
            throw [System.ArgumentException] ("The argument 'ResourceName' is null or empty");
        }

        if(-not $svtResource.ResourceTypeMapping)
        {
            $svtResource.ResourceTypeMapping = [SVTMapping]::Mapping | 
                                        Where-Object { $_.ClassName -eq $this.GetType().Name } | 
                                        Select-Object -First 1
        }

        if (-not $svtResource.ResourceTypeMapping) 
        {
            throw [System.ArgumentException] ("No ResourceTypeMapping found");    
        }

        if ([string]::IsNullOrEmpty($svtResource.ResourceTypeMapping.JsonFileName))
        {
            throw [System.ArgumentException] ("Json file name is null or empty");    
        }
        
        $this.ResourceId = $svtResource.ResourceId;

        $this.LoadSvtConfig($svtResource.ResourceTypeMapping.JsonFileName);


        $this.ResourceContext = [ResourceContext]@{
            ResourceGroupName = $svtResource.ResourceGroupName;
            ResourceName = $svtResource.ResourceName;
            ResourceType = $svtResource.ResourceTypeMapping.ResourceType;
            FeatureName = ($this.SVTConfig.FeatureName);
            Reference = ($this.SVTConfig.Reference);
            SubscriptionId = ($this.Context.SubscriptionId);
            SubscriptionName = ($this.Context.SubscriptionName);
        }; 
        $this.ResourceContext.ResourceId = $this.GetResourceId();

    }

    hidden [void] LoadSvtConfig([string] $controlsJsonFileName)
    {
        $this.ControlSettings = $this.LoadJsonFile("ControlSettings.json");

        if (-not $this.SVTConfig) {
            $this.SVTConfig =  [ConfigurationManager]::GetSVTConfig($controlsJsonFileName); 
                        
            #Evaluate all code block in Description and Recommendation texts.
            #Can use '$this.ControlSettings.xyz' in text to fill dynamic settings.
            $this.SVTConfig.Controls | Foreach-Object {
                $_.Description = $global:ExecutionContext.InvokeCommand.ExpandString($_.Description)
                $_.Recommendation = $global:ExecutionContext.InvokeCommand.ExpandString($_.Recommendation)
                if(-not [string]::IsNullOrEmpty($_.MethodName))
                {
                    $_.MethodName = $_.MethodName.Trim();
                }
            }
        }
    }

    hidden [string] GetResourceId()
    {
        if ([string]::IsNullOrEmpty($this.ResourceId)) 
        {
               $resource = Get-AzureRmResource -ResourceName $this.ResourceContext.ResourceName -ResourceGroupName $this.ResourceContext.ResourceGroupName 

            if($resource)
            {
                $this.ResourceId = $resource.ResourceId;
            }
            else
            {
                throw "Unable to find the Azure resource - [ResourceType: $($this.ResourceContext.ResourceType)] [ResourceGroupName: $($this.ResourceContext.ResourceGroupName)] [ResourceName: $($this.ResourceContext.ResourceName)]" 
            }
        }

        return $this.ResourceId;
    }

    [bool] ValidateMaintenanceState()
    {  
        if ($this.SVTConfig.IsManintenanceMode) {
            $this.PublishCustomMessage(($this.RootConfig.MaintenanceMessage -f $this.ResourceContext.FeatureName), [MessageType]::Warning);
        }
        return $this.SVTConfig.IsManintenanceMode;
    }  

    [ControlResult] CreateControlResult([string] $childResourceName, [VerificationResult] $verificationResult)
    {
        [ControlResult] $control = [ControlResult]@{
            VerificationResult = $verificationResult;
        };

        if(-not [string]::IsNullOrEmpty($childResourceName))
        {
            $control.ChildResourceName = $childResourceName;
        }
        else 
        {
            $control.ChildResourceName = $this.ResourceContext.ResourceName;            
        }
        return $control;
    }

    [ControlResult] CreateControlResult()
    {
        return $this.CreateControlResult("", [VerificationResult]::Manual);
    }

    [ControlResult] CreateControlResult([string] $childResourceName)
    {
        return $this.CreateControlResult($childResourceName, [VerificationResult]::Manual);
    }
  
    hidden [SVTEventContext] CreateErrorEventContext([System.Management.Automation.ErrorRecord] $exception)
    {
        [SVTEventContext] $arg = [SVTEventContext]@{
            ResourceContext = $this.ResourceContext;
            ExceptionMessage = $exception;
        };

        return $arg;
    }

    hidden [void] ControlStarted([SVTEventContext] $arg) 
    {
        $this.PublishEvent([SVTEvent]::ControlStarted, $arg);
    }    

    hidden [void] ControlDisabled([SVTEventContext] $arg) 
    {
        $this.PublishEvent([SVTEvent]::ControlDisabled, $arg);
    }

    hidden [void] ControlCompleted([SVTEventContext] $arg) 
    {
        $this.PublishEvent([SVTEvent]::ControlCompleted, $arg);
    }

    hidden [void] ControlError([ControlItem] $controlItem, [System.Management.Automation.ErrorRecord] $exception) 
    {
        $arg = $this.CreateErrorEventContext($exception);
        $arg.ControlItem = $controlItem;
        $this.PublishEvent([SVTEvent]::ControlError, $arg);
    }
    
    hidden [void] EvaluationCompleted([SVTEventContext[]] $arguments) 
    {
        $this.PublishEvent([SVTEvent]::EvaluationCompleted, $arguments);
    }

    hidden [void] EvaluationStarted()
    {
        [SVTEventContext] $arg = [SVTEventContext]@{
            ResourceContext = $this.ResourceContext;           
        };
        $this.PublishEvent([SVTEvent]::EvaluationStarted, $arg);    
    }

    hidden [void] EvaluationError([System.Management.Automation.ErrorRecord] $exception) 
    {
        $this.PublishEvent([SVTEvent]::EvaluationError, $this.CreateErrorEventContext($exception));    
    }

    [SVTEventContext[]] EvaluateAllControls()
    {
        [SVTEventContext[]] $resourceSecurityResult = @();        
        if (-not $this.ValidateMaintenanceState()) {
            if($this.GetApplicableControls().Count -eq 0)
            {
                $this.PublishCustomMessage("No controls have been found to evaluate for Resource [$($this.ResourceContext.ResourceName)]", [MessageType]::Warning);
            }
            else
            {
                $this.EvaluationStarted();
                $resourceSecurityResult += $this.GetAutomatedSecurityStatus();
                $resourceSecurityResult += $this.GetManualSecurityStatus();
                $this.EvaluationCompleted($resourceSecurityResult);           
            }
        }
        return $resourceSecurityResult;         
    }

    hidden [ControlItem[]] GetApplicableControls()
    {
        #Lazy load the list of the applicable controls
        if(-not $this.ApplicableControls)
        {
            $this.ApplicableControls = @();
            $filterControlsById = @();
            if($this.ControlIds.Count -ne 0)
            {
                $filterControlsById += $this.SVTConfig.Controls | Where-Object { $this.ControlIds.Contains($_.ControlId) };
            }
            else
            {
                $filterControlsById += $this.SVTConfig.Controls
            }

            if(($this.FilterTags | Measure-Object).Count -ne 0 -or ($this.ExcludeTags | Measure-Object).Count -ne 0)
            {
                $filterControlsById | ForEach-Object {
                    Set-Variable -Name control -Value $_ -Scope Local
                    Set-Variable -Name filterMatch -Value $false -Scope Local
                    Set-Variable -Name excludeMatch -Value $false -Scope Local
                    $control.Tags | ForEach-Object {
                        Set-Variable -Name cTag -Value $_ -Scope Local
                        
                        if(($this.FilterTags | Measure-Object).Count -ne 0 `
                            -and ($this.FilterTags | Where-Object { $_ -like $cTag} | Measure-Object).Count -ne 0)
                        {
                            $filterMatch = $true
                        }
                        elseif(($this.FilterTags | Measure-Object).Count -eq 0)
                        {
                            $filterMatch = $true
                        }
                        if(($this.ExcludeTags | Measure-Object).Count -ne 0 `
                            -and ($this.ExcludeTags | Where-Object { $_ -like $cTag} | Measure-Object).Count -ne 0)
                        {
                            $excludeMatch = $true
                        }                                            
                    }

                    if(($filterMatch  -and $excludeMatch -le 0) `
                            -or ($filterMatch -lt 0 -and $excludeMatch -le 0))                            
                    {
                        $this.ApplicableControls += $control            
                    }
                }
            }
            else
            {
                $this.ApplicableControls += $filterControlsById;
            }
        }
        return $this.ApplicableControls;
    }

    hidden [SVTEventContext[]] GetManualSecurityStatus()
    {
        [SVTEventContext[]] $manualControlsResult = @();
        try 
        {
            $this.GetApplicableControls() | Where-Object { $_.Automated -eq "No" } | 
            ForEach-Object {
                $controlItem = $_;
                [SVTEventContext] $arg = [SVTEventContext]@{
                    ResourceContext = $this.ResourceContext;
                    ControlItem = $controlItem;
                    ControlResults = [ControlResult]@{
                        ChildResourceName = $this.ResourceContext.ResourceName;
                        VerificationResult = [VerificationResult]::Manual;
                    };
                };
                $manualControlsResult += $arg;
            } 
        }
        catch 
        {
            $this.EvaluationError($_);
        }   

        return $manualControlsResult;
    }

    hidden [SVTEventContext[]] GetAutomatedSecurityStatus()
    {
        [SVTEventContext[]] $automatedControlsResult = @();
        try 
        {
            $this.GetApplicableControls() | Where-Object { -not [string]::IsNullOrEmpty($_.MethodName) } |
            ForEach-Object {
                $eventContext = $this.RunControl($_);
                if($eventContext)
                {
                    $automatedControlsResult += $eventContext;
                }
            };
        }
        catch 
        {
            $this.EvaluationError($_);
        }        

        return $automatedControlsResult;
    }

    hidden [SVTEventContext] RunControl([ControlItem] $controlItem)
    {
        [SVTEventContext] $singleControlResult = [SVTEventContext]@{
            ResourceContext = $this.ResourceContext;
            ControlItem = $controlItem;
        };
               
        $this.ControlStarted($singleControlResult);
        if($controlItem.Enabled -eq $false)
        {
            $this.ControlDisabled($singleControlResult);             
        }
        else 
        {
            $controlResult = $this.CreateControlResult();
            try 
            {
                $methodName = $controlItem.MethodName;
                $this.CurrentControlItem = $controlItem;
                $singleControlResult.ControlResults += $this.$methodName($controlResult);          
            }
            catch 
            {
                $controlResult.VerificationResult = [VerificationResult]::Error              
                $controlResult.AddError($_);
                $singleControlResult.ControlResults += $controlResult;
                $this.ControlError($controlItem, $_);                
            }           
            
        }
    
        $this.ControlCompleted($singleControlResult);

        return $singleControlResult;
    }
    
    hidden [ControlState[]] GetControlStates()
    {
        [ControlState[]] $tempControlStates = @()
        $tempId = $this.ResourceContext.SubscriptionId
        if(-not [string]::IsNullOrWhiteSpace($this.ResourceContext.ResourceId))
        {
            $tempId = $this.ResourceContext.ResourceId
        }
        $controls = [ControlStateManager]::GetControlState($tempId);

        if($null -eq $controls)
        {
            return $tempControlStates;
        }
        $tempControlStates += $controls        
        return $tempControlStates;
    }

    hidden [MessageData] GetControlState([string] $DataObjectType, [string] $ControlId)
    {
        $tempMessageObject = $null
        if(($this.ControlStates | Measure-Object).Count -gt 0)
        {
            $this.ControlStates | Where-Object { $_.controlId -eq $ControlId} | ForEach-Object{
                Set-Variable -Name ControlState -Value $_ -Scope Local
                if(($ControlState | Get-Member State) -ne $null)
                {
                    $ControlState.State | ForEach-Object{
                        [MessageData] $MessageObject = $_
                        if($MessageObject.DataObjectType -eq $DataObjectType)
                        {
                            $tempMessageObject = $MessageObject;
                        }
                    }
                }
            }
        }
        return $tempMessageObject;
    }
    hidden [ControlResult] CheckDiagnosticsSettings([ControlResult] $controlResult)
    {
        $diagnostics = Get-AzureRmDiagnosticSetting -ResourceId $this.GetResourceId()
        if($diagnostics -and ($diagnostics.Logs | Measure-Object).Count -ne 0)
        {
            $nonCompliantLogs = $diagnostics.Logs | 
                                Where-Object { -not ($_.Enabled -and                                              
                                            ($_.RetentionPolicy.Days -eq $this.ControlSettings.Diagnostics_RetentionPeriod_Forever -or 
                                            $_.RetentionPolicy.Days -eq $this.ControlSettings.Diagnostics_RetentionPeriod_Min))};

            $selectedDiagnosticsProps = $diagnostics | Select-Object -Property Logs, Metrics, StorageAccountId, ServiceBusRuleId, Name;

            if(($nonCompliantLogs | Measure-Object).Count -eq 0)
            {
                $controlResult.AddMessage([VerificationResult]::Passed, 
                    "Diagnostics settings are correctly configured for resource - [$($this.ResourceContext.ResourceName)]",
                    $selectedDiagnosticsProps);
            }
            else
            {
                $controlResult.AddMessage([VerificationResult]::Failed, 
                    "Diagnostics settings are either disabled OR not retaining logs for atleast $($this.ControlSettings.Diagnostics_RetentionPeriod_Min) days for resource - [$($this.ResourceContext.ResourceName)]",
                    $selectedDiagnosticsProps);
            }
        }
        else
        {
            $controlResult.AddMessage("Not able to fetch diagnostics settings. Please validate diagnostics settings manually for resource - [$($this.ResourceContext.ResourceName)].");
        }

        return $controlResult;
    }

    hidden [ControlResult] CheckRBACAccess([ControlResult] $controlResult)
    {
        $accessList = [RoleAssignmentHelper]::GetAzSDKRoleAssignmentByScope($this.GetResourceId(), $false, $true);   
        
        $resourceAccessList = $accessList | Where-Object { $_.Scope -eq $this.GetResourceId() };   

        $controlResult.VerificationResult = [VerificationResult]::Verify; 
        
        if(($resourceAccessList | Measure-Object).Count -ne 0)
        {
            $controlResult.AddMessage("Validate that the following identities have explicitly provided with RBAC access to resource - [$($this.ResourceContext.ResourceName)]");
            $controlResult.AddMessage([MessageData]::new($this.CreateRBACCountMessage($resourceAccessList), $resourceAccessList));
        }
        else
        {   
            $controlResult.AddMessage("No identities have been explicitly provided with RBAC access to resource - [$($this.ResourceContext.ResourceName)]");
        }  
            
        $inheritedAccessList = $accessList | Where-Object { $_.Scope -ne $this.GetResourceId() };
    
        if(($inheritedAccessList | Measure-Object).Count -ne 0)
        {
            $controlResult.AddMessage("Note: " + $this.CreateRBACCountMessage($inheritedAccessList) + " have inherited RBAC access to resource. It's good practice to keep the RBAC access to minimum.");
        }
        else
        {
            $controlResult.AddMessage("No identities have inherited RBAC access to resource");         
        }
      
        return $controlResult;
    }

    hidden [string] CreateRBACCountMessage([array] $resourceAccessList)
    {
        $nonNullObjectTypes = $resourceAccessList | Where-Object { -not [string]::IsNullOrEmpty($_.ObjectType) };
        if(($nonNullObjectTypes | Measure-Object).Count -eq 0)
        {
            return "$($resourceAccessList.Count) identities";
        }
        else
        {
            $countBreakupString = [string]::Join(", ", 
                                    ($nonNullObjectTypes | 
                                        Group-Object -Property ObjectType -NoElement | 
                                        ForEach-Object { "$($_.Name): $($_.Count)" }
                                    ));
            return "$($resourceAccessList.Count) identities ($countBreakupString)";
        }
    }

    hidden [bool] CheckMetricAlertConfiguration([PSObject[]] $metricSettings, [ControlResult] $controlResult, [string] $extendedResourceName)
    {
        $result = $false;
        if($metricSettings -and $metricSettings.Count -ne 0)
        {
            $resId = $this.GetResourceId() + $extendedResourceName;
            $resourceAlerts = (Get-AzureRmAlertRule -ResourceGroup $this.ResourceContext.ResourceGroupName -DetailedOutput) | 
                                Where-Object { $_.Properties -and $_.Properties.Condition -and $_.Properties.Condition.DataSource } |
                                Where-Object { $_.Properties.Condition.DataSource.ResourceUri -eq $resId }; 
                     
            $nonConfiguredMetrices = @();
            $misConfiguredMetrices = @();

            $metricSettings    | 
            ForEach-Object {
                $currentMetric = $_;
                $matchedMetrices = @();
                $matchedMetrices += $resourceAlerts | 
                                    Where-Object { $_.Properties.Condition.DataSource.MetricName -eq $currentMetric.Condition.DataSource.MetricName }

                if($matchedMetrices.Count -eq 0)
                {
                    $nonConfiguredMetrices += $currentMetric;
                }
                else
                {
                    $misConfigured = @();
                    $misConfigured += $matchedMetrices | Where-Object { -not [Helpers]::CompareObject($currentMetric, $_.Properties) };

                    if($misConfigured.Count -eq $matchedMetrices.Count)
                    {
                        $misConfiguredMetrices += $misConfigured;
                    }
                }
            }

            $controlResult.AddMessage("Following metric alerts must be configured with settings mentioned below:"); 
            $controlResult.AddMessage(($metricSettings | ConvertTo-Json -Depth 10)); 
            $controlResult.VerificationResult = [VerificationResult]::Failed;

            if($nonConfiguredMetrices.Count -ne 0)
            {
                $controlResult.AddMessage("Following metric alerts are not configured:"); 
                $controlResult.AddMessage(($nonConfiguredMetrices | ConvertTo-Json -Depth 10)); 
            }

            if($misConfiguredMetrices.Count -ne 0)
            {
                $controlResult.AddMessage("Following metric alerts are not correctly configured. Please update the metric settings in order to comply.", $misConfiguredMetrices); 
            }

            if($nonConfiguredMetrices.Count -eq 0 -and $misConfiguredMetrices.Count -eq 0)
            {
                $result = $true;
                $controlResult.AddMessage([VerificationResult]::Passed , "All mandatory metric alerts are correctly configured."); 
            }
        }
        else
        {
            throw [System.ArgumentException] ("The argument 'metricSettings' is null or empty");
        }

        return $result;
    }
}