feat(azure): add new policies for Azure Synapse (terraform and arm)

checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml

@@ -0,0 +1,39 @@
+metadata: 
+  id: "CKV2_AZURE_54"
+  name: "Ensure log monitoring is enabled for Synapse SQL Pool"
+  category: "LOGGING"
+
+definition:
+  and:
+    - cond_type: connection
+      resource_types:
+        - Microsoft.Synapse/workspaces/sqlPools
+      connected_resource_types:
+        - Microsoft.Synapse/workspaces/sqlPools/auditingSettings
+      operator: exists
+    - cond_type: filter
+      attribute: resource_type
+      value:
+        - Microsoft.Synapse/workspaces/sqlPools
+      operator: within
+
+    - or:
+      - and:
+        - cond_type: attribute
+          resource_types:
+            - Microsoft.Synapse/workspaces/sqlPools/auditingSettings
+          attribute: state
+          operator: exists
+
+        - cond_type: attribute
+          resource_types:
+            - Microsoft.Synapse/workspaces/sqlPools/auditingSettings
+          attribute: state
+          operator: equals
+          value: Enabled
+
+      - cond_type: attribute
+        resource_types:
+          - Microsoft.Synapse/workspaces/sqlPools/auditingSettings
+        attribute: state
+        operator: not_exists

checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml

@@ -0,0 +1,24 @@
+metadata: 
+  id: "CKV2_AZURE_51"
+  name: "Ensure Synapse SQL Pool has a security alert policy"
+  category: "GENERAL_SECURITY"
+
+definition:
+  and:
+    - cond_type: connection
+      resource_types:
+        - Microsoft.Synapse/workspaces/sqlPools
+      connected_resource_types:
+        - Microsoft.Sql/servers/securityAlertPolicies
+      operator: exists
+    - cond_type: attribute
+      resource_types:
+        - Microsoft.Sql/servers/securityAlertPolicies
+      attribute: 'state'
+      operator: equals
+      value: 'Enabled'
+    - cond_type: filter
+      attribute: resource_type
+      value:
+        - Microsoft.Synapse/workspaces/sqlPools
+      operator: within

checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml

@@ -0,0 +1,30 @@
+metadata: 
+  id: "CKV2_AZURE_52"
+  name: "Ensure Synapse SQL Pool has vulnerability assessment attached"
+  category: "GENERAL_SECURITY"
+
+definition:
+  and:
+    - resource_types:
+        - Microsoft.Synapse/workspaces/sqlPools
+      connected_resource_types:
+        - Microsoft.Sql/servers/securityAlertPolicies
+      operator: exists
+      cond_type: connection
+    - resource_types:
+        - Microsoft.Sql/servers/securityAlertPolicies
+      connected_resource_types:
+        - Microsoft.Sql/servers/vulnerabilityAssessments
+      operator: exists
+      cond_type: connection
+    - cond_type: attribute
+      resource_types:
+        - Microsoft.Sql/servers/vulnerabilityAssessments
+      attribute: 'recurring_scans.*.enabled'
+      operator: equals
+      value: true
+    - cond_type: filter
+      attribute: resource_type
+      value:
+        - Microsoft.Sql/servers/securityAlertPolicies
+      operator: within

checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml

@@ -0,0 +1,24 @@
+metadata: 
+  id: "CKV2_AZURE_53"
+  name: "Ensure Azure Synapse Workspace has extended audit logs"
+  category: "LOGGING"
+
+definition:
+  and:
+    - cond_type: filter
+      attribute: resource_type
+      value:
+        - Microsoft.Synapse/workspaces
+      operator: within
+    - cond_type: connection
+      resource_types:
+        - Microsoft.Synapse/workspaces
+      connected_resource_types:
+        - Microsoft.Synapse/workspaces/extendedAuditingPolicies
+      operator: exists
+    - cond_type: attribute
+      resource_types:
+        - Microsoft.Synapse/workspaces/extendedAuditingPolicies
+      attribute: 'state'
+      operator: equals
+      value: 'Enabled'

tests/arm/graph_builder/checks/resources/SynapseLogMonitoringEnabledForSQLPool/expected.yaml

@@ -0,0 +1,6 @@
+pass:
+  - "Microsoft.Synapse/workspaces/sqlPools.pass"
+fail:
+  - "Microsoft.Synapse/workspaces/sqlPools.fail"
+evaluated_keys:
+  - 'properties/publicNetworkAccess'

tests/arm/graph_builder/checks/resources/SynapseLogMonitoringEnabledForSQLPool/fail.json

@@ -0,0 +1,80 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Synapse/workspaces/sqlPools",
+      "apiVersion": "2021-06-01",
+      "name": "fail",
+      "location": "[parameters('location')]",
+      "properties": {
+        "collation": "SQL_Latin1_General_CP1_CI_AS",
+        "maxSizeBytes": "2147483648",
+        "sku": {
+          "name": "DW100c",
+          "tier": "DataWarehouse"
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Synapse/workspaces/sqlPools/auditingSettings",
+      "apiVersion": "2021-06-01",
+      "name": "[concat(parameters('workspaceName'), '/', parameters('sqlPoolName'), '/default')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.Synapse/workspaces/sqlPools', parameters('workspaceName'), parameters('sqlPoolName'))]"
+      ],
+      "properties": {
+        "state": "Enabled",
+        "auditActionsAndGroups": [
+          "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
+          "FAILED_DATABASE_AUTHENTICATION_GROUP",
+          "BATCH_COMPLETED_GROUP"
+        ],
+        "isAzureMonitorTargetEnabled": false,
+        "retentionDays": 90,
+        "storageAccountSubscriptionId": "[parameters('storageAccountSubscriptionId')]",
+        "storageAccountResourceGroupName": "[parameters('storageAccountResourceGroupName')]",
+        "storageAccountName": "[parameters('storageAccountName')]",
+        "isStorageSecondaryKeyInUse": false
+      }
+    }
+  ],
+  "parameters": {
+    "workspaceName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Synapse workspace."
+      }
+    },
+    "sqlPoolName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the SQL pool."
+      }
+    },
+    "location": {
+      "type": "string",
+      "metadata": {
+        "description": "The location of the Synapse workspace."
+      }
+    },
+    "storageAccountSubscriptionId": {
+      "type": "string",
+      "metadata": {
+        "description": "The subscription ID of the storage account for auditing logs."
+      }
+    },
+    "storageAccountResourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group name of the storage account for auditing logs."
+      }
+    },
+    "storageAccountName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the storage account for auditing logs."
+      }
+    }
+  }
+}

tests/arm/graph_builder/checks/resources/SynapseLogMonitoringEnabledForSQLPool/pass.json

@@ -0,0 +1,80 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Synapse/workspaces/sqlPools",
+      "apiVersion": "2021-06-01",
+      "name": "pass",
+      "location": "[parameters('location')]",
+      "properties": {
+        "collation": "SQL_Latin1_General_CP1_CI_AS",
+        "maxSizeBytes": "2147483648",
+        "sku": {
+          "name": "DW100c",
+          "tier": "DataWarehouse"
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Synapse/workspaces/sqlPools/auditingSettings",
+      "apiVersion": "2021-06-01",
+      "name": "[concat(parameters('workspaceName'), '/', parameters('sqlPoolName'), '/default')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.Synapse/workspaces/sqlPools', parameters('workspaceName'), parameters('sqlPoolName'))]"
+      ],
+      "properties": {
+        "state": "Enabled",
+        "auditActionsAndGroups": [
+          "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
+          "FAILED_DATABASE_AUTHENTICATION_GROUP",
+          "BATCH_COMPLETED_GROUP"
+        ],
+        "isAzureMonitorTargetEnabled": true,
+        "retentionDays": 90,
+        "storageAccountSubscriptionId": "[parameters('storageAccountSubscriptionId')]",
+        "storageAccountResourceGroupName": "[parameters('storageAccountResourceGroupName')]",
+        "storageAccountName": "[parameters('storageAccountName')]",
+        "isStorageSecondaryKeyInUse": false
+      }
+    }
+  ],
+  "parameters": {
+    "workspaceName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the Synapse workspace."
+      }
+    },
+    "sqlPoolName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the SQL pool."
+      }
+    },
+    "location": {
+      "type": "string",
+      "metadata": {
+        "description": "The location of the Synapse workspace."
+      }
+    },
+    "storageAccountSubscriptionId": {
+      "type": "string",
+      "metadata": {
+        "description": "The subscription ID of the storage account for auditing logs."
+      }
+    },
+    "storageAccountResourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group name of the storage account for auditing logs."
+      }
+    },
+    "storageAccountName": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the storage account for auditing logs."
+      }
+    }
+  }
+}

tests/arm/graph_builder/checks/resources/SynapseSQLPoolHasSecurityAlertPolicy/expected.yaml

@@ -0,0 +1,7 @@
+pass:
+  - "Microsoft.Synapse/workspaces/sqlPools.pass"
+fail:
+  - "Microsoft.Synapse/workspaces/sqlPools.fail1"
+  - "Microsoft.Synapse/workspaces/sqlPools.fail2"
+evaluated_keys:
+  - 'properties/publicNetworkAccess'

tests/arm/graph_builder/checks/resources/SynapseSQLPoolHasSecurityAlertPolicy/fail1.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Synapse/workspaces/sqlPools",
+      "apiVersion": "2021-06-01",
+      "name": "fail1",
+      "location": "[parameters('location')]",
+      "properties": {
+        "sku": {
+          "name": "[parameters('skuName')]",
+          "tier": "[parameters('skuTier')]",
+          "capacity": "[parameters('skuCapacity')]"
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Sql/servers/securityAlertPolicies",
+      "apiVersion": "2021-11-01",
+      "name": "[concat(parameters('sqlServerName'), '/', 'Default')]",
+      "properties": {
+        "state": "Disabled",
+        "emailAccountAdmins": false,
+        "emailAddresses": [],
+        "disabledAlerts": [],
+        "retentionDays": 0
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Synapse/workspaces/sqlPools', parameters('workspaceName'), parameters('sqlPoolName'))]"
+      ]
+    }
+  ],
+  "parameters": {
+    "workspaceName": {
+      "type": "string"
+    },
+    "sqlPoolName": {
+      "type": "string"
+    },
+    "location": {
+      "type": "string"
+    },
+    "skuName": {
+      "type": "string"
+    },
+    "skuTier": {
+      "type": "string"
+    },
+    "skuCapacity": {
+      "type": "int"
+    },
+    "sqlServerName": {
+      "type": "string"
+    }
+  }
+}