output/20260723_080510/govviz/repo/pwsh/dev/functions/processStorageAccountAnalysis.ps1
|
function processStorageAccountAnalysis { $start = Get-Date Write-Host 'Processing Storage Account Analysis' $storageAccountsCount = $storageAccounts.count if ($storageAccountsCount -gt 0) { Write-Host " Executing Storage Account Analysis for $storageAccountsCount Storage Accounts" createBearerToken -AzAPICallConfiguration $azapicallconf -targetEndPoint 'Storage' $htSACost = @{} if ($DoAzureConsumption -eq $true) { $saConsumptionByResourceId = $allConsumptionData.where({ $_.resourceType -eq 'microsoft.storage/storageaccounts' }) | Group-Object -Property resourceid foreach ($sa in $saConsumptionByResourceId) { $htSACost.($sa.Name) = @{ meterCategoryAll = ($sa.Group.MeterCategory | Sort-Object) -join ', ' costAll = ($sa.Group.PreTaxCost | Measure-Object -Sum).Sum #[decimal]($sa.Group.PreTaxCost | Measure-Object -Sum).Sum currencyAll = ($sa.Group.Currency | Sort-Object -Unique) -join ', ' } foreach ($costentry in $sa.Group) { $htSACost.($sa.Name)."cost_$($costentry.MeterCategory)" = $costentry.PreTaxCost $htSACost.($sa.Name)."currency_$($costentry.MeterCategory)" = $costentry.Currency } } } $batchSize = [math]::ceiling($storageAccounts.Count / $ThrottleLimit) Write-Host "Optimal batch size: $($batchSize)" $counterBatch = [PSCustomObject] @{ Value = 0 } $storageAccountsBatch = ($storageAccounts) | Group-Object -Property { [math]::Floor($counterBatch.Value++ / $batchSize) } Write-Host "Processing data in $($storageAccountsBatch.Count) batches" $storageAccountsBatch | ForEach-Object -Parallel { $azAPICallConf = $using:azAPICallConf $arrayStorageAccountAnalysisResults = $using:arrayStorageAccountAnalysisResults $htAllSubscriptionsFromAPI = $using:htAllSubscriptionsFromAPI $htSubscriptionsMgPath = $using:htSubscriptionsMgPath $htSubscriptionTags = $using:htSubscriptionTags $CSVDelimiterOpposite = $using:CSVDelimiterOpposite $htSACost = $using:htSACost $StorageAccountAccessAnalysisSubscriptionTags = $using:StorageAccountAccessAnalysisSubscriptionTags $StorageAccountAccessAnalysisStorageAccountTags = $using:StorageAccountAccessAnalysisStorageAccountTags foreach ($storageAccount in $_.Group) { $listContainersSuccess = 'n/a' $containersCount = 'n/a' $arrayContainers = [System.Collections.ArrayList]@() $arrayContainersAnonymousContainer = [System.Collections.ArrayList]@() $arrayContainersAnonymousBlob = [System.Collections.ArrayList]@() $staticWebsitesState = 'n/a' $webSiteResponds = 'n/a' $subscriptionId = ($storageAccount.SA.id -split '/')[2] $resourceGroupName = ($storageAccount.SA.id -split '/')[4] $subDetails = $htAllSubscriptionsFromAPI.($subscriptionId).subDetails Write-Host "Processing Storage Account '$($storageAccount.SA.name)' - Subscription: '$($subDetails.displayName)' ($subscriptionId) [$($subDetails.subscriptionPolicies.quotaId)]" if ($storageAccount.SA.Properties.primaryEndpoints.blob) { $urlServiceProps = "$($storageAccount.SA.Properties.primaryEndpoints.blob)?restype=service&comp=properties" $saProperties = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $urlServiceProps -method 'GET' -listenOn 'Content' -currentTask "$($storageAccount.SA.name) get restype=service&comp=properties" -saResourceGroupName $resourceGroupName -unhandledErrorAction Continue if ($saProperties) { if ($saProperties -eq 'AuthorizationFailure' -or $saProperties -eq 'AuthorizationPermissionDenied' -or $saProperties -eq 'ResourceUnavailable' -or $saProperties -eq 'AuthorizationPermissionMismatch' ) { if ($saProperties -eq 'ResourceUnavailable') { $staticWebsitesState = $saProperties } } else { try { # ? https://github.com/Azure/Azure-Governance-Visualizer/issues/218#issuecomment-1854516882 if ($saProperties.gettype().Name -eq 'Byte[]') { $byteArray = [byte[]]$saProperties $saProperties = [System.Text.Encoding]::UTF8.GetString($byteArray) } # $xmlSaProperties = [xml]([string]$saProperties -replace $saProperties.Substring(0, 3)) # Leading character:  (PS version <= 7.3.9) # $xmlSaProperties = [xml]([string]$saProperties -replace $saProperties.Substring(0, 1)) # Leading character: or U+feff (PS version >= 7.4.0) $xmlSaProperties = [xml]($saProperties -replace '^.*?<', '<') # Universal fix for all PS versions if ($xmlSaProperties.StorageServiceProperties.StaticWebsite) { if ($xmlSaProperties.StorageServiceProperties.StaticWebsite.Enabled -eq $true) { $staticWebsitesState = $true } else { $staticWebsitesState = $false } } } catch { Write-Host "XMLSAPropertiesFailed: Subscription: $($subDetails.displayName) ($subscriptionId) - Storage Account: $($storageAccount.SA.name)" Write-Host $($saProperties.ForEach({ [char]$_ }) -join '') -ForegroundColor Cyan } } } $urlCompList = "$($storageAccount.SA.Properties.primaryEndpoints.blob)?comp=list" $listContainers = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $urlCompList -method 'GET' -listenOn 'Content' -currentTask "$($storageAccount.SA.name) get comp=list" -unhandledErrorAction Continue if ($listContainers) { if ($listContainers -eq 'AuthorizationFailure' -or $listContainers -eq 'AuthorizationPermissionDenied' -or $listContainers -eq 'ResourceUnavailable' -or $listContainers -eq 'AuthorizationPermissionMismatch') { if ($listContainers -eq 'ResourceUnavailable') { $listContainersSuccess = $listContainers } else { $listContainersSuccess = $false } } else { $listContainersSuccess = $true } if ($listContainersSuccess -eq $true) { # ? https://github.com/Azure/Azure-Governance-Visualizer/issues/218#issuecomment-1854516882 if ($listContainers.gettype().Name -eq 'Byte[]') { $byteArray = [byte[]]$listContainers $listContainers = [System.Text.Encoding]::UTF8.GetString($byteArray) } # $xmlListContainers = [xml]([string]$listContainers -replace $listContainers.Substring(0, 3)) # Leading character:  (PS version <= 7.3.9) # $xmlListContainers = [xml]([string]$listContainers -replace $listContainers.Substring(0, 1)) # Leading character: or U+feff (PS version >= 7.4.0) $xmlListContainers = [xml]($listContainers -replace '^.*?<', '<') # Universal fix for all PS versions $containersCount = $xmlListContainers.EnumerationResults.Containers.Container.Count foreach ($container in $xmlListContainers.EnumerationResults.Containers.Container) { $null = $arrayContainers.Add($container.Name) if ($container.Name -eq '$web' -and $staticWebsitesState) { if ($storageAccount.SA.properties.primaryEndpoints.web) { try { $testStaticWebsiteResponse = Invoke-WebRequest -Uri $storageAccount.SA.properties.primaryEndpoints.web -Method 'HEAD' $webSiteResponds = $true } catch { $webSiteResponds = $false } } } if ($container.Properties.PublicAccess) { if ($container.Properties.PublicAccess -eq 'blob') { $null = $arrayContainersAnonymousBlob.Add($container.Name) } if ($container.Properties.PublicAccess -eq 'container') { $null = $arrayContainersAnonymousContainer.Add($container.Name) } } } } } } $allowSharedKeyAccess = $storageAccount.SA.properties.allowSharedKeyAccess if ([string]::IsNullOrWhiteSpace($storageAccount.SA.properties.allowSharedKeyAccess)) { $allowSharedKeyAccess = 'likely True' } $requireInfrastructureEncryption = $storageAccount.SA.properties.encryption.requireInfrastructureEncryption if ([string]::IsNullOrWhiteSpace($storageAccount.SA.properties.encryption.requireInfrastructureEncryption)) { $requireInfrastructureEncryption = 'likely False' } $arrayResourceAccessRules = [System.Collections.ArrayList]@() if ($storageAccount.SA.properties.networkAcls.resourceAccessRules) { if ($storageAccount.SA.properties.networkAcls.resourceAccessRules.count -gt 0) { foreach ($resourceAccessRule in $storageAccount.SA.properties.networkAcls.resourceAccessRules) { $resourceAccessRuleResourceIdSplitted = $resourceAccessRule.resourceId -split '/' $resourceType = "$($resourceAccessRuleResourceIdSplitted[6])/$($resourceAccessRuleResourceIdSplitted[7])" [regex]$regex = '\*+' #$resourceAccessRule.resourceId switch ($regex.matches($resourceAccessRule.resourceId).count) { { $_ -eq 1 } { $null = $arrayResourceAccessRules.Add([PSCustomObject]@{ resourcetype = $resourceType range = 'resourceGroup' sort = 3 }) } { $_ -eq 2 } { $null = $arrayResourceAccessRules.Add([PSCustomObject]@{ resourcetype = $resourceType range = 'subscription' sort = 2 }) } { $_ -eq 3 } { $null = $arrayResourceAccessRules.Add([PSCustomObject]@{ resourcetype = $resourceType range = 'tenant' sort = 1 }) } default { $null = $arrayResourceAccessRules.Add([PSCustomObject]@{ resourcetype = $resourceType range = 'resource' resource = $resourceAccessRule.resourceId sort = 0 }) } } } } } $resourceAccessRulesCount = $arrayResourceAccessRules.count if ($resourceAccessRulesCount -eq 0) { $resourceAccessRules = '' } else { $ht = @{} foreach ($accessRulePerRange in $arrayResourceAccessRules | Group-Object -Property range | Sort-Object -Property Name -Descending) { if ($accessRulePerRange.Name -eq 'resource') { $arrayResources = [System.Collections.ArrayList]@() foreach ($resource in $accessRulePerRange.Group.resource | Sort-Object) { $null = $arrayResources.Add($resource) } $ht.($accessRulePerRange.Name) = ($arrayResources) } else { $arrayResourceTypes = [System.Collections.ArrayList]@() foreach ($resourceType in $accessRulePerRange.Group.resourceType | Sort-Object) { $null = $arrayResourceTypes.Add($resourceType) } $ht.($accessRulePerRange.Name) = ($arrayResourceTypes) } } $resourceAccessRules = $ht | ConvertTo-Json } if ([string]::IsNullOrWhiteSpace($storageAccount.SA.properties.publicNetworkAccess)) { $publicNetworkAccess = 'likely Enabled' } else { $publicNetworkAccess = $storageAccount.SA.properties.publicNetworkAccess } if ([string]::IsNullOrWhiteSpace($storageAccount.SA.properties.allowedCopyScope)) { $allowedCopyScope = 'From any Storage Account' } else { $allowedCopyScope = $storageAccount.SA.properties.allowedCopyScope } if ([string]::IsNullOrWhiteSpace($storageAccount.SA.properties.allowCrossTenantReplication)) { if ($allowedCopyScope -ne 'From any Storage Account') { $allowCrossTenantReplication = "likely False (allowedCopyScope=$allowedCopyScope)" } else { $allowCrossTenantReplication = 'likely True' } } else { $allowCrossTenantReplication = $storageAccount.SA.properties.allowCrossTenantReplication } if ($storageAccount.SA.properties.dnsEndpointType) { $dnsEndpointType = $storageAccount.SA.properties.dnsEndpointType } else { $dnsEndpointType = 'standard' } if ($azAPICallConf['htParameters'].DoAzureConsumption -eq $true) { if ($htSACost.($storageAccount.SA.id)) { $hlpCost = $htSACost.($storageAccount.SA.id) $saCost = $hlpCost.costAll $saCostCurrency = $hlpCost.currencyAll $saCostMeterCategories = $hlpCost.meterCategoryAll } else { $saCost = 'n/a' $saCostCurrency = 'n/a' $saCostMeterCategories = 'n/a' } } else { $saCost = '' $saCostCurrency = '' $saCostMeterCategories = '' } $temp = [System.Collections.ArrayList]@() $null = $temp.Add([PSCustomObject]@{ storageAccount = $storageAccount.SA.name kind = $storageAccount.SA.kind skuName = $storageAccount.SA.sku.name skuTier = $storageAccount.SA.sku.tier location = $storageAccount.SA.location creationTime = $storageAccount.SA.properties.creationTime allowBlobPublicAccess = $storageAccount.SA.properties.allowBlobPublicAccess publicNetworkAccess = $publicNetworkAccess SubscriptionId = $subscriptionId SubscriptionName = $subDetails.displayName subscriptionQuotaId = $subDetails.subscriptionPolicies.quotaId subscriptionMGPath = $htSubscriptionsMgPath.($subscriptionId).path -join '/' resourceGroup = $resourceGroupName networkAclsdefaultAction = $storageAccount.SA.properties.networkAcls.defaultAction staticWebsitesState = $staticWebsitesState staticWebsitesResponse = $webSiteResponds containersCanBeListed = $listContainersSuccess containersCount = $containersCount containers = $arrayContainers -join "$CSVDelimiterOpposite " containersAnonymousContainerCount = $arrayContainersAnonymousContainer.Count containersAnonymousContainer = $arrayContainersAnonymousContainer -join "$CSVDelimiterOpposite " containersAnonymousBlobCount = $arrayContainersAnonymousBlob.Count containersAnonymousBlob = $arrayContainersAnonymousBlob -join "$CSVDelimiterOpposite " ipRulesCount = $storageAccount.SA.properties.networkAcls.ipRules.Count ipRulesIPAddressList = ($storageAccount.SA.properties.networkAcls.ipRules.value | Sort-Object) -join "$CSVDelimiterOpposite " virtualNetworkRulesCount = $storageAccount.SA.properties.networkAcls.virtualNetworkRules.Count virtualNetworkRulesList = ($storageAccount.SA.properties.networkAcls.virtualNetworkRules.Id | Sort-Object) -join "$CSVDelimiterOpposite " resourceAccessRulesCount = $resourceAccessRulesCount resourceAccessRules = $resourceAccessRules bypass = ($storageAccount.SA.properties.networkAcls.bypass | Sort-Object) -join "$CSVDelimiterOpposite " supportsHttpsTrafficOnly = $storageAccount.SA.properties.supportsHttpsTrafficOnly minimumTlsVersion = $storageAccount.SA.properties.minimumTlsVersion allowSharedKeyAccess = $allowSharedKeyAccess requireInfrastructureEncryption = $requireInfrastructureEncryption allowedCopyScope = $allowedCopyScope allowCrossTenantReplication = $allowCrossTenantReplication dnsEndpointType = $dnsEndpointType usedCapacity = $storageAccount.SAUsedCapacity cost = $saCost metercategory = $saCostMeterCategories curreny = $saCostCurrency }) if ($StorageAccountAccessAnalysisSubscriptionTags[0] -ne 'undefined' -and $StorageAccountAccessAnalysisSubscriptionTags.Count -gt 0) { foreach ($subTag4StorageAccountAccessAnalysis in $StorageAccountAccessAnalysisSubscriptionTags) { if ($htSubscriptionTags.($subscriptionId).$subTag4StorageAccountAccessAnalysis) { $temp | Add-Member -NotePropertyName "SubTag_$subTag4StorageAccountAccessAnalysis" -NotePropertyValue $($htSubscriptionTags.($subscriptionId).$subTag4StorageAccountAccessAnalysis) } else { $temp | Add-Member -NotePropertyName "SubTag_$subTag4StorageAccountAccessAnalysis" -NotePropertyValue 'n/a' } } } if ($StorageAccountAccessAnalysisStorageAccountTags[0] -ne 'undefined' -and $StorageAccountAccessAnalysisStorageAccountTags.Count -gt 0) { if ($storageAccount.SA.tags) { $htAllSATags = @{} foreach ($saTagName in ($storageAccount.SA.tags | Get-Member).where({ $_.MemberType -eq 'NoteProperty' }).Name) { $htAllSATags.$saTagName = $storageAccount.SA.tags.$saTagName } } foreach ($saTag4StorageAccountAccessAnalysis in $StorageAccountAccessAnalysisStorageAccountTags) { if ($htAllSATags.$saTag4StorageAccountAccessAnalysis) { $temp | Add-Member -NotePropertyName "SATag_$saTag4StorageAccountAccessAnalysis" -NotePropertyValue $($htAllSATags.$saTag4StorageAccountAccessAnalysis) } else { $temp | Add-Member -NotePropertyName "SATag_$saTag4StorageAccountAccessAnalysis" -NotePropertyValue 'n/a' } } } $null = $script:arrayStorageAccountAnalysisResults.AddRange($temp) } } -ThrottleLimit $ThrottleLimit } else { Write-Host ' No Storage Accounts present' } $end = Get-Date Write-Host " Processing Storage Account Analysis duration: $((New-TimeSpan -Start $start -End $end).TotalMinutes) minutes ($((New-TimeSpan -Start $start -End $end).TotalSeconds) seconds)" } |