Checks/Network/Test-NatGateway.ps1
|
#Requires -Version 5.1 <# .SYNOPSIS DER.1 - Schadensbegrenzung: NAT Gateway fuer outbound Traffic. .DESCRIPTION Verifies NAT Gateway exists and is associated with App/DB subnets. #> function Test-NatGateway { [CmdletBinding()] param( [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$NatGatewayName, [string[]]$ExpectedSubnets = @('subnet-app', 'subnet-db'), [string]$SubscriptionId = '' ) $results = @() $response = Get-AzCliResponse -Arguments @("network", "nat", "gateway", "show", "-g", $ResourceGroup, "-n", $NatGatewayName) -SubscriptionId $SubscriptionId if ($response.ExitCode -ne 0) { $results += [ComplianceResult]::new( 'DER.1', "NAT Gateway $NatGatewayName exists", 'Network', [BsiCheckMode]::Remote, [BsiCheckStatus]::Error, [BsiSeverity]::Medium, "Could not retrieve NAT Gateway $NatGatewayName" ) $results[-1].CheckFunction = 'Test-NatGateway' return $results } $nat = $response.Output | ConvertFrom-Json $associatedSubnetIds = @($nat.subnets.id) $results += [ComplianceResult]::new( 'DER.1', "NAT Gateway $NatGatewayName exists", 'Network', [BsiCheckMode]::Remote, [BsiCheckStatus]::Pass, [BsiSeverity]::Medium, "NAT Gateway found with $($associatedSubnetIds.Count) subnet association(s)" ) $results[-1].CheckFunction = 'Test-NatGateway' foreach ($subnetName in $ExpectedSubnets) { $found = $associatedSubnetIds | Where-Object { $_ -match "/subnets/$([regex]::Escape($subnetName))$" } $pass = $null -ne $found $status = if ($pass) { [BsiCheckStatus]::Pass } else { [BsiCheckStatus]::Fail } $result = [ComplianceResult]::new( 'DER.1', "Subnet $subnetName uses NAT Gateway", 'Network', [BsiCheckMode]::Remote, $status, [BsiSeverity]::Medium, $(if ($pass) { "$subnetName is associated with NAT Gateway" } else { "$subnetName is not associated with NAT Gateway" }) ) $result.CheckFunction = 'Test-NatGateway' $result.Remediation = "Associate $subnetName with NAT Gateway for outbound connectivity" $results += $result } return $results } |