Merge pull request #88 from vanesasejdiu/azure-keyvault

Azure keyvault add check for soft delete retention days
aquasecurity · Jan 19, 2022 · 7273bad · 7273bad
2 parents b6eb390 + 046dab9
commit 7273bad
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 12 deletions.
diff --git a/provider/azure/keyvault/keyvault.go b/provider/azure/keyvault/keyvault.go
@@ -9,10 +9,11 @@ type KeyVault struct {
 }
 
 type Vault struct {
-	Secrets               []Secret
-	Keys                  []Key
-	EnablePurgeProtection types.BoolValue
-	NetworkACLs           NetworkACLs
+	Secrets                 []Secret
+	Keys                    []Key
+	EnablePurgeProtection   types.BoolValue
+	SoftDeleteRetentionDays types.IntValue
+	NetworkACLs             NetworkACLs
 }
 
 type NetworkACLs struct {

diff --git a/rules/azure/keyvault/no_purge.go b/rules/azure/keyvault/no_purge.go
@@ -22,13 +22,13 @@ Purge protection can only be enabled once soft-delete is enabled. It can be turn
 		Links: []string{
 			"https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection",
 		},
-		Terraform:   &rules.EngineMetadata{
-            GoodExamples:        terraformNoPurgeGoodExamples,
-            BadExamples:         terraformNoPurgeBadExamples,
-            Links:               terraformNoPurgeLinks,
-            RemediationMarkdown: terraformNoPurgeRemediationMarkdown,
-        },
-        Severity: severity.Medium,
+		Terraform: &rules.EngineMetadata{
+			GoodExamples:        terraformNoPurgeGoodExamples,
+			BadExamples:         terraformNoPurgeBadExamples,
+			Links:               terraformNoPurgeLinks,
+			RemediationMarkdown: terraformNoPurgeRemediationMarkdown,
+		},
+		Severity: severity.Medium,
 	},
 	func(s *state.State) (results rules.Results) {
 		for _, vault := range s.Azure.KeyVault.Vaults {
@@ -38,6 +38,12 @@ Purge protection can only be enabled once soft-delete is enabled. It can be turn
 					vault.EnablePurgeProtection,
 				)
 			}
+			if vault.EnablePurgeProtection.IsTrue() && (vault.SoftDeleteRetentionDays.LessThan(7) || vault.SoftDeleteRetentionDays.GreaterThan(90)) {
+				results.Add(
+					"Resource should have soft_delete_retention_days set between 7 and 90 days in order to enable purge protection.",
+					vault.EnablePurgeProtection, vault.SoftDeleteRetentionDays,
+				)
+			}
 		}
 		return
 	},

diff --git a/types/time_value.go b/types/time_value.go
@@ -47,7 +47,7 @@ func (b *timeValue) GetRawValue() interface{} {
 }
 
 func (b *timeValue) IsNever() bool {
-	return b.value == nil
+	return b.value.IsZero()
 }
 
 func (b *timeValue) LessThan(i time.Time) bool {