Skip to content

Commit a65ebc1

Browse files
mblaschkemblaschke
committed
refactoring audit enrichment
Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>
1 parent f45077b commit a65ebc1

File tree

2 files changed

+97
-96
lines changed

2 files changed

+97
-96
lines changed

‎auditor/auditor.enrich.go

Lines changed: 90 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -5,137 +5,131 @@ import (
55
"fmt"
66
"strings"
77

8-
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
98
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/subscriptions"
10-
"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2020-04-01-preview/authorization"
119
"github.com/Azure/go-autorest/autorest/to"
1210
azureCommon "github.com/webdevops/go-common/azure"
1311

1412
"github.com/webdevops/azure-auditor/auditor/validator"
1513
)
1614

1715
func (auditor *AzureAuditor) enrichAzureObjects(ctx context.Context, subscription *subscriptions.Subscription, list *[]*validator.AzureObject) {
18-
var (
19-
resourceGroupList map[string]resources.Group
20-
resourcesList map[string]resources.GenericResourceExpanded
21-
roleDefinitionList map[string]authorization.RoleDefinition
22-
)
23-
subscriptionList := auditor.getSubscriptionList(ctx)
2416
if subscription != nil {
25-
resourceGroupList = auditor.getResourceGroupList(ctx, subscription)
26-
resourcesList = auditor.getResourceList(ctx, subscription)
27-
roleDefinitionList = auditor.getRoleDefinitionList(ctx, subscription)
28-
}
17+
// fixed subscription
18+
auditor.enrichAzureObjectsWithSubscription(ctx, subscription, list)
19+
} else {
20+
// list all subscriptions
21+
subscriptionIdList := map[string]string{}
22+
for _, row := range *list {
23+
if subscriptionID, ok := (*row)["subscription.id"].(string); ok && subscriptionID != "" {
24+
subscriptionIdList[subscriptionID] = subscriptionID
25+
}
26+
}
2927

30-
inheritTag := map[string]string{}
31-
for _, tagName := range auditor.Opts.Azure.InheritTags {
32-
inheritTag[tagName] = ""
28+
subscriptionList := auditor.getSubscriptionList(ctx)
29+
for _, subscriptionId := range subscriptionIdList {
30+
if subscription, ok := subscriptionList[subscriptionId]; ok {
31+
auditor.enrichAzureObjectsWithSubscription(ctx, &subscription, list)
32+
}
33+
}
3334
}
3435

36+
// enrich with principal information
37+
auditor.enrichAzureObjectsWithMsGraphPrincipals(ctx, list)
38+
}
39+
40+
func (auditor *AzureAuditor) enrichAzureObjectsWithSubscription(ctx context.Context, subscription *subscriptions.Subscription, list *[]*validator.AzureObject) {
41+
resourceGroupList := auditor.getResourceGroupList(ctx, subscription)
42+
resourcesList := auditor.getResourceList(ctx, subscription)
43+
roleDefinitionList := auditor.getRoleDefinitionList(ctx, subscription)
44+
3545
for key, row := range *list {
3646
obj := (*(*list)[key])
3747

38-
// detect subscription info by row (if subscription is not specified before)
39-
if subscription == nil {
40-
resourceGroupList = map[string]resources.Group{}
41-
resourcesList = map[string]resources.GenericResourceExpanded{}
42-
roleDefinitionList = map[string]authorization.RoleDefinition{}
43-
44-
if subscriptionID, ok := (*row)["subscription.id"].(string); ok && subscriptionID != "" {
45-
if val, ok := subscriptionList[subscriptionID]; ok {
46-
resourceGroupList = auditor.getResourceGroupList(ctx, &val)
47-
resourcesList = auditor.getResourceList(ctx, &val)
48-
roleDefinitionList = auditor.getRoleDefinitionList(ctx, &val)
49-
}
48+
if subscriptionID, ok := obj["subscription.id"].(string); ok && subscriptionID != "" && subscriptionID == *subscription.SubscriptionID {
49+
// init inherit tags
50+
inheritTag := map[string]string{}
51+
for _, tagName := range auditor.Opts.Azure.InheritTags {
52+
inheritTag[tagName] = ""
5053
}
51-
}
5254

53-
// enrich with subscription information
54-
if subscriptionID, ok := (*row)["subscription.id"].(string); ok && subscriptionID != "" {
55-
if subscription, ok := subscriptionList[subscriptionID]; ok {
56-
obj["subscription.name"] = to.String(subscription.DisplayName)
57-
58-
for tagName, tagValue := range subscription.Tags {
59-
valKey := fmt.Sprintf("subscription.tag.%v", tagName)
60-
obj[valKey] = to.String(tagValue)
61-
}
55+
// enrich with subscription information
56+
obj["subscription.name"] = to.String(subscription.DisplayName)
57+
for tagName, tagValue := range subscription.Tags {
58+
valKey := fmt.Sprintf("subscription.tag.%v", tagName)
59+
obj[valKey] = to.String(tagValue)
6260
}
63-
}
6461

65-
// enrich with resourcegroup information
66-
if resourceGroupName, ok := (*row)["resourcegroup.name"].(string); ok && resourceGroupName != "" {
67-
resourceGroupName = strings.ToLower(resourceGroupName)
68-
if resourceGroup, ok := resourceGroupList[resourceGroupName]; ok {
69-
obj["resourcegroup.name"] = to.String(resourceGroup.Name)
70-
obj["resourcegroup.location"] = to.String(resourceGroup.Location)
71-
72-
for tagName, tagValue := range resourceGroup.Tags {
73-
valKey := fmt.Sprintf("resourcegroup.tag.%v", tagName)
74-
tagValueStr := to.String(tagValue)
75-
obj[valKey] = tagValueStr
76-
77-
// save tags for inheritance
78-
if _, ok := inheritTag[tagName]; ok {
79-
inheritTag[tagName] = tagValueStr
62+
// enrich with resourcegroup information
63+
if resourceGroupName, ok := (*row)["resourcegroup.name"].(string); ok && resourceGroupName != "" {
64+
resourceGroupName = strings.ToLower(resourceGroupName)
65+
if resourceGroup, ok := resourceGroupList[resourceGroupName]; ok {
66+
obj["resourcegroup.name"] = to.String(resourceGroup.Name)
67+
obj["resourcegroup.location"] = to.String(resourceGroup.Location)
68+
69+
for tagName, tagValue := range resourceGroup.Tags {
70+
valKey := fmt.Sprintf("resourcegroup.tag.%v", tagName)
71+
tagValueStr := to.String(tagValue)
72+
obj[valKey] = tagValueStr
73+
74+
// save tags for inheritance
75+
if _, ok := inheritTag[tagName]; ok {
76+
inheritTag[tagName] = tagValueStr
77+
}
8078
}
8179
}
8280
}
83-
}
8481

85-
// enrich with roledefinition information
86-
if val, ok := (*row)["roledefinition.id"].(string); ok && val != "" {
87-
if roleDefinition, ok := roleDefinitionList[val]; ok {
88-
obj["roledefinition.name"] = to.String(roleDefinition.RoleName)
89-
obj["roledefinition.type"] = to.String(roleDefinition.RoleType)
90-
obj["roledefinition.description"] = to.String(roleDefinition.Description)
82+
// enrich with roledefinition information
83+
if val, ok := (*row)["roledefinition.id"].(string); ok && val != "" {
84+
if roleDefinition, ok := roleDefinitionList[val]; ok {
85+
obj["roledefinition.name"] = to.String(roleDefinition.RoleName)
86+
obj["roledefinition.type"] = to.String(roleDefinition.RoleType)
87+
obj["roledefinition.description"] = to.String(roleDefinition.Description)
88+
}
9189
}
92-
}
9390

94-
// enrich with resource information (if resource is detected)
95-
resourceID := ""
96-
if val, ok := (*row)["roleassignment.scope"].(string); ok && val != "" {
97-
resourceID = val
98-
} else if val, ok := (*row)["resource.id"].(string); ok && val != "" {
99-
resourceID = val
100-
}
91+
// enrich with resource information (if resource is detected)
92+
resourceID := ""
93+
if val, ok := (*row)["roleassignment.scope"].(string); ok && val != "" {
94+
resourceID = val
95+
} else if val, ok := (*row)["resource.id"].(string); ok && val != "" {
96+
resourceID = val
97+
}
10198

102-
if resourceID != "" {
103-
if resourceInfo, err := azureCommon.ParseResourceId(resourceID); err == nil && resourceInfo.ResourceName != "" {
104-
resourceID := strings.ToLower(resourceInfo.ResourceId())
105-
obj["resource.name"] = resourceInfo.ResourceName
106-
obj["resource.type"] = resourceInfo.ResourceType
107-
108-
if resourceInfo.ResourceSubPath != "" {
109-
obj["resource.extension.path"] = resourceInfo.ResourceSubPath
110-
subPathInfo := strings.SplitN(strings.Trim(resourceInfo.ResourceSubPath, "/"), "/", 2)
111-
if len(subPathInfo) >= 2 {
112-
obj["resource.extension.type"] = subPathInfo[0]
113-
obj["resource.extension.name"] = subPathInfo[1]
99+
if resourceID != "" {
100+
if resourceInfo, err := azureCommon.ParseResourceId(resourceID); err == nil && resourceInfo.ResourceName != "" {
101+
resourceID := strings.ToLower(resourceInfo.ResourceId())
102+
obj["resource.name"] = resourceInfo.ResourceName
103+
obj["resource.type"] = resourceInfo.ResourceType
104+
105+
if resourceInfo.ResourceSubPath != "" {
106+
obj["resource.extension.path"] = resourceInfo.ResourceSubPath
107+
subPathInfo := strings.SplitN(strings.Trim(resourceInfo.ResourceSubPath, "/"), "/", 2)
108+
if len(subPathInfo) >= 2 {
109+
obj["resource.extension.type"] = subPathInfo[0]
110+
obj["resource.extension.name"] = subPathInfo[1]
111+
}
114112
}
115-
}
116113

117-
if resource, ok := resourcesList[resourceID]; ok {
118-
obj["resource.location"] = to.String(resource.Location)
114+
if resource, ok := resourcesList[resourceID]; ok {
115+
obj["resource.location"] = to.String(resource.Location)
119116

120-
// use tags from inhertiance for (as default)
121-
for tagName, tagValue := range inheritTag {
122-
valKey := fmt.Sprintf("resource.tag.%v", tagName)
123-
obj[valKey] = tagValue
124-
}
117+
// use tags from inhertiance for (as default)
118+
for tagName, tagValue := range inheritTag {
119+
valKey := fmt.Sprintf("resource.tag.%v", tagName)
120+
obj[valKey] = tagValue
121+
}
125122

126-
// resource tags (might overwrite inhertiance tags)
127-
for tagName, tagValue := range resource.Tags {
128-
valKey := fmt.Sprintf("resource.tag.%v", tagName)
129-
obj[valKey] = to.String(tagValue)
123+
// resource tags (might overwrite inhertiance tags)
124+
for tagName, tagValue := range resource.Tags {
125+
valKey := fmt.Sprintf("resource.tag.%v", tagName)
126+
obj[valKey] = to.String(tagValue)
127+
}
130128
}
131129
}
132130
}
133131
}
134-
135132
}
136-
137-
// enrich with principal information
138-
auditor.enrichAzureObjectsWithMsGraphPrincipals(ctx, list)
139133
}
140134

141135
func (auditor *AzureAuditor) enrichAzureObjectsWithMsGraphPrincipals(ctx context.Context, list *[]*validator.AzureObject) {

‎example.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@ resourceGraph:
1010
query: |-
1111
resources
1212
13+
enrich: true
14+
15+
mapping:
16+
subscriptionId: subscription.id
17+
resourceGroup: resourcegroup.name
18+
id: resource.id
19+
1320
rules: []
1421

1522
roleAssignments:

0 commit comments

Comments
 (0)