Skip to content

Commit f45077b

Browse files
mblaschkemblaschke
committed
improve roledefinition.id enrichment
Signed-off-by: Markus Blaschke <mblaschke82@gmail.com>
1 parent fc0794d commit f45077b

File tree

3 files changed

+52
-37
lines changed

3 files changed

+52
-37
lines changed

‎auditor/auditor.azure.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66

77
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
88
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/subscriptions"
9+
"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2020-04-01-preview/authorization"
910
"github.com/Azure/go-autorest/autorest/to"
1011
)
1112

@@ -122,3 +123,37 @@ func (auditor *AzureAuditor) getResourceList(ctx context.Context, subscription *
122123

123124
return
124125
}
126+
127+
func (auditor *AzureAuditor) getRoleDefinitionList(ctx context.Context, subscription *subscriptions.Subscription) (list map[string]authorization.RoleDefinition) {
128+
auditor.locks.resources.Lock()
129+
defer auditor.locks.resources.Unlock()
130+
131+
list = map[string]authorization.RoleDefinition{}
132+
133+
cacheKey := "roledefinitions:" + *subscription.SubscriptionID
134+
if val, ok := auditor.cache.Get(cacheKey); ok {
135+
// fetched from cache
136+
list = val.(map[string]authorization.RoleDefinition)
137+
return
138+
}
139+
140+
client := authorization.NewRoleDefinitionsClientWithBaseURI(auditor.azure.client.Environment.ResourceManagerEndpoint, *subscription.SubscriptionID)
141+
auditor.decorateAzureClient(&client.Client, auditor.azure.client.GetAuthorizer())
142+
143+
listResult, err := client.ListComplete(ctx, *subscription.ID, "")
144+
if err != nil {
145+
auditor.logger.Panic(err)
146+
}
147+
148+
for _, item := range *listResult.Response().Value {
149+
resourceID := strings.ToLower(to.String(item.ID))
150+
list[resourceID] = item
151+
}
152+
153+
auditor.logger.Infof("found %v Azure RoleDefinitions for Subscription %v (%v) (cache update)", len(list), to.String(subscription.DisplayName), to.String(subscription.SubscriptionID))
154+
155+
// save to cache
156+
_ = auditor.cache.Add(cacheKey, list, auditor.cacheExpiry)
157+
158+
return
159+
}

‎auditor/auditor.enrich.go

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77

88
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
99
"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/subscriptions"
10+
"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2020-04-01-preview/authorization"
1011
"github.com/Azure/go-autorest/autorest/to"
1112
azureCommon "github.com/webdevops/go-common/azure"
1213

@@ -15,13 +16,15 @@ import (
1516

1617
func (auditor *AzureAuditor) enrichAzureObjects(ctx context.Context, subscription *subscriptions.Subscription, list *[]*validator.AzureObject) {
1718
var (
18-
resourceGroupList map[string]resources.Group
19-
resourcesList map[string]resources.GenericResourceExpanded
19+
resourceGroupList map[string]resources.Group
20+
resourcesList map[string]resources.GenericResourceExpanded
21+
roleDefinitionList map[string]authorization.RoleDefinition
2022
)
2123
subscriptionList := auditor.getSubscriptionList(ctx)
2224
if subscription != nil {
2325
resourceGroupList = auditor.getResourceGroupList(ctx, subscription)
2426
resourcesList = auditor.getResourceList(ctx, subscription)
27+
roleDefinitionList = auditor.getRoleDefinitionList(ctx, subscription)
2528
}
2629

2730
inheritTag := map[string]string{}
@@ -36,11 +39,13 @@ func (auditor *AzureAuditor) enrichAzureObjects(ctx context.Context, subscriptio
3639
if subscription == nil {
3740
resourceGroupList = map[string]resources.Group{}
3841
resourcesList = map[string]resources.GenericResourceExpanded{}
42+
roleDefinitionList = map[string]authorization.RoleDefinition{}
3943

4044
if subscriptionID, ok := (*row)["subscription.id"].(string); ok && subscriptionID != "" {
4145
if val, ok := subscriptionList[subscriptionID]; ok {
4246
resourceGroupList = auditor.getResourceGroupList(ctx, &val)
4347
resourcesList = auditor.getResourceList(ctx, &val)
48+
roleDefinitionList = auditor.getRoleDefinitionList(ctx, &val)
4449
}
4550
}
4651
}
@@ -77,6 +82,15 @@ func (auditor *AzureAuditor) enrichAzureObjects(ctx context.Context, subscriptio
7782
}
7883
}
7984

85+
// enrich with roledefinition information
86+
if val, ok := (*row)["roledefinition.id"].(string); ok && val != "" {
87+
if roleDefinition, ok := roleDefinitionList[val]; ok {
88+
obj["roledefinition.name"] = to.String(roleDefinition.RoleName)
89+
obj["roledefinition.type"] = to.String(roleDefinition.RoleType)
90+
obj["roledefinition.description"] = to.String(roleDefinition.Description)
91+
}
92+
}
93+
8094
// enrich with resource information (if resource is detected)
8195
resourceID := ""
8296
if val, ok := (*row)["roleassignment.scope"].(string); ok && val != "" {

‎auditor/auditor.roleassignments.go

Lines changed: 1 addition & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@ func (auditor *AzureAuditor) auditRoleAssignments(ctx context.Context, logger *l
4040
func (auditor *AzureAuditor) fetchRoleAssignments(ctx context.Context, logger *log.Entry, subscription *subscriptions.Subscription) (list []*validator.AzureObject) {
4141
list = []*validator.AzureObject{}
4242

43-
roleDefinitionList := auditor.fetchRoleDefinitionList(ctx, logger, subscription)
44-
4543
client := authorization.NewRoleAssignmentsClientWithBaseURI(auditor.azure.client.Environment.ResourceManagerEndpoint, *subscription.SubscriptionID)
4644
auditor.decorateAzureClient(&client.Client, auditor.azure.client.GetAuthorizer())
4745

@@ -72,7 +70,7 @@ func (auditor *AzureAuditor) fetchRoleAssignments(ctx context.Context, logger *l
7270
obj := map[string]interface{}{
7371
"resource.id": stringPtrToStringLower(roleAssignment.ID),
7472
"subscription.id": to.String(subscription.SubscriptionID),
75-
"role.id": stringPtrToStringLower(roleAssignment.RoleDefinitionID),
73+
"roledefinition.id": stringPtrToStringLower(roleAssignment.RoleDefinitionID),
7674
"principal.objectid": stringPtrToStringLower(roleAssignment.PrincipalID),
7775
"resourcegroup.name": azureScope.ResourceGroup,
7876

@@ -84,12 +82,6 @@ func (auditor *AzureAuditor) fetchRoleAssignments(ctx context.Context, logger *l
8482
"roleassignment.age": time.Since(roleAssignment.CreatedOn.Time),
8583
}
8684

87-
if roleDefinition, exists := roleDefinitionList[stringPtrToStringLower(roleAssignment.RoleDefinitionID)]; exists {
88-
obj["role.name"] = stringPtrToStringLower(roleDefinition.RoleName)
89-
obj["role.type"] = stringPtrToStringLower(roleDefinition.RoleType)
90-
obj["role.description"] = stringPtrToStringLower(roleDefinition.Description)
91-
}
92-
9385
list = append(list, validator.NewAzureObject(obj))
9486

9587
if response.NextWithContext(ctx) != nil {
@@ -101,29 +93,3 @@ func (auditor *AzureAuditor) fetchRoleAssignments(ctx context.Context, logger *l
10193

10294
return
10395
}
104-
105-
func (auditor *AzureAuditor) fetchRoleDefinitionList(ctx context.Context, logger *log.Entry, subscription *subscriptions.Subscription) map[string]authorization.RoleDefinition {
106-
client := authorization.NewRoleDefinitionsClientWithBaseURI(auditor.azure.client.Environment.ResourceManagerEndpoint, *subscription.SubscriptionID)
107-
auditor.decorateAzureClient(&client.Client, auditor.azure.client.GetAuthorizer())
108-
109-
response, err := client.ListComplete(ctx, *subscription.ID, "")
110-
111-
if err != nil {
112-
logger.Panic(err)
113-
}
114-
115-
roleDefinitionList := map[string]authorization.RoleDefinition{}
116-
117-
for response.NotDone() {
118-
roleDefinition := response.Value()
119-
120-
roleDefinitionID := stringPtrToStringLower(roleDefinition.ID)
121-
roleDefinitionList[roleDefinitionID] = roleDefinition
122-
123-
if response.NextWithContext(ctx) != nil {
124-
break
125-
}
126-
}
127-
128-
return roleDefinitionList
129-
}

0 commit comments

Comments
 (0)