azure-postgres-allow-azure-services-disabled: Azure PostgreSQL Access From Azure Services Disabled

id: azure-postgres-allow-azure-services-disabled
info:
  name: Azure PostgreSQL Access From Azure Services Disabled
  author: princechaddha
  severity: high
  description: |
    Ensure that the access from Microsoft Azure cloud services to Azure Database for PostgreSQL servers is disabled in order to secure access to PostgreSQL databases by allowing access from trusted Virtual Networks (Vnets) only.
  impact: |
    Not restricting access to Azure Database for PostgreSQL servers from Azure services can expose sensitive database resources to potentially malicious traffic from within Azure, increasing the risk of breaches and data exposure.
  remediation: |
    Configure firewall rules to disable the "Allow access to Azure services" setting for Azure PostgreSQL Database servers to restrict access to trusted sources only.
  reference:
    - https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
  tags: cloud,devops,azure,microsoft,postgresql,azure-cloud-config

flow: |
  code(1);
  for (let ServerData of iterate(template.serverList)) {
    ServerData = JSON.parse(ServerData);
    set("name", ServerData.name);
    set("resourceGroup", ServerData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az postgres server list --output json --query '[*].{"name":name,"resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serverList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az postgres server firewall-rule list --server "$name" --resource-group "$resourceGroup" --query '[*].{"ruleName":name,"startIpAddress":startIpAddress,"endIpAddress":endIpAddress}'

    matchers:
      - type: word
        words:
          - '"ruleName": "AllowAllWindowsAzureIps"'
          - 'startIpAddress": "0.0.0.0"'
          - '"endIpAddress": "0.0.0.0"'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " allows access to Azure services"'
# digest: 4b0a00483046022100ebc86908f7f187db5ef901fa397b3c11463c42b009dc3948448a5b1b00a9a7ae022100bf65c7b41d1ca5f05644d08dba6932be098d4b425c98ea65f5f2d0f27db0a4da:922c64590222798bb761d5b6d8e72950