preflight-engine 0.1.0__py3-none-any.whl

preflight/rules/azure.py

@@ -0,0 +1,309 @@
+"""Azure-specific rules"""
+
+from typing import Any
+
+from preflight.models import (
+    ActionType,
+    Finding,
+    ResourceChange,
+    RiskFactors,
+    Severity,
+)
+from preflight.rules.base import Rule, RuleContext
+from preflight.scoring import score_finding
+
+PUBLIC_SOURCES = {"*", "0.0.0.0/0", "::/0", "internet"}
+ADMIN_PORTS = {22, 3389}
+
+AZURE_DATABASE_TYPES = {
+    "azurerm_mssql_database",
+    "azurerm_mssql_server",
+    "azurerm_cosmosdb_account",
+    "azurerm_postgresql_flexible_server",
+    "azurerm_postgresql_server",
+    "azurerm_mysql_flexible_server",
+    "azurerm_mysql_server",
+    "azurerm_mariadb_server",
+    "azurerm_redis_cache",
+}
+
+
+def _port_spec_matches_admin(port_spec: Any) -> tuple[bool, str]:
+    if port_spec is None:
+        return False, ""
+    spec_str = str(port_spec).strip()
+    if spec_str == "*":
+        return True, "all ports (*)"
+    if "-" in spec_str:
+        parts = spec_str.split("-", 1)
+        try:
+            low, high = int(parts[0]), int(parts[1])
+            found: list[str] = []
+            if low <= 22 <= high:
+                found.append("SSH:22")
+            if low <= 3389 <= high:
+                found.append("RDP:3389")
+            if found:
+                return True, ", ".join(found)
+        except ValueError:
+            pass
+    else:
+        try:
+            val = int(spec_str)
+            if val == 22:
+                return True, "SSH:22"
+            if val == 3389:
+                return True, "RDP:3389"
+        except ValueError:
+            pass
+    return False, ""
+
+
+def _check_azure_nsg_rule(rule_data: dict[str, Any]) -> tuple[bool, str, list[str]]:
+    direction = str(rule_data.get("direction", "")).lower()
+    access = str(rule_data.get("access", "")).lower()
+    if direction != "inbound" or access != "allow":
+        return False, "", []
+
+    sources: list[str] = []
+    src = rule_data.get("source_address_prefix")
+    if src:
+        sources.append(str(src))
+    src_list = rule_data.get("source_address_prefixes")
+    if isinstance(src_list, list):
+        sources.extend(str(s) for s in src_list)
+
+    matched_sources = [s for s in sources if s.strip().lower() in PUBLIC_SOURCES]
+    if not matched_sources:
+        return False, "", []
+
+    ports: list[Any] = []
+    port = rule_data.get("destination_port_range")
+    if port is not None:
+        ports.append(port)
+    port_list = rule_data.get("destination_port_ranges")
+    if isinstance(port_list, list):
+        ports.extend(port_list)
+
+    for p in ports:
+        matches, desc = _port_spec_matches_admin(p)
+        if matches:
+            return True, desc, matched_sources
+
+    return False, "", []
+
+
+class AzureNsgPublicAdminIngressRule(Rule):
+    rule_id = "AZR-NET-001"
+    name = "Azure NSG Public Administrative Ingress"
+    description = "Detects NSG rules allowing Internet access to administrative ports (22, 3389) or wildcard ports."
+    default_severity = Severity.CRITICAL
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.action == ActionType.DELETE or not resource.after:
+            return []
+
+        findings: list[Finding] = []
+
+        if resource.type == "azurerm_network_security_rule":
+            matches, port_desc, sources = _check_azure_nsg_rule(resource.after)
+            if matches:
+                findings.append(self._build_finding(resource, context, port_desc, sources))
+
+        elif resource.type == "azurerm_network_security_group":
+            rules = resource.after.get("security_rule", [])
+            if isinstance(rules, list):
+                for rule in rules:
+                    if isinstance(rule, dict):
+                        matches, port_desc, sources = _check_azure_nsg_rule(rule)
+                        if matches:
+                            findings.append(
+                                self._build_finding(resource, context, port_desc, sources)
+                            )
+
+        return findings
+
+    def _build_finding(
+        self,
+        resource: ResourceChange,
+        context: RuleContext,
+        port_desc: str,
+        sources: list[str],
+    ) -> Finding:
+        base_factors = RiskFactors(
+            change_impact=3.5,
+            security_exposure=5.0,
+            reversibility=1.0,
+            uncertainty=0.5,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+        return Finding(
+            rule_id=self.rule_id,
+            rule_name=self.name,
+            severity=self.default_severity,
+            resource_address=resource.address,
+            resource_type=resource.type,
+            action=resource.action,
+            what_changed=f"NSG rule on '{resource.address}' allows inbound {port_desc} from public source ({', '.join(sources)}).",
+            why_it_matters="Exposing SSH or RDP to the public internet enables brute force credential attacks and automated compromise.",
+            remediation="Restrict NSG source prefixes to corporate VPNs, Azure Bastion, or private virtual network IP ranges.",
+            risk_factors=resolved_factors,
+            calculated_score=score,
+            details={"sources": sources, "ports": port_desc},
+        )
+
+
+class AzureStoragePublicAccessRule(Rule):
+    rule_id = "AZR-STG-001"
+    name = "Azure Storage Account Public Access"
+    description = (
+        "Detects storage accounts with public network access or nested blob public access enabled."
+    )
+    default_severity = Severity.HIGH
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.type != "azurerm_storage_account" or resource.action == ActionType.DELETE:
+            return []
+
+        after = resource.after or {}
+        reasons: list[str] = []
+
+        if after.get("allow_nested_items_to_be_public") is True:
+            reasons.append("allow_nested_items_to_be_public is enabled")
+        if after.get("allow_blob_public_access") is True:
+            reasons.append("allow_blob_public_access is enabled")
+
+        network_rules = after.get("network_rules")
+        if isinstance(network_rules, dict):
+            if str(network_rules.get("default_action", "")).lower() == "allow":
+                ip_rules = network_rules.get("ip_rules") or []
+                subnet_ids = network_rules.get("virtual_network_subnet_ids") or []
+                if not ip_rules and not subnet_ids:
+                    reasons.append(
+                        "network_rules default_action is Allow without network restrictions"
+                    )
+
+        if not reasons:
+            return []
+
+        base_factors = RiskFactors(
+            change_impact=3.5,
+            security_exposure=4.5,
+            reversibility=2.0,
+            uncertainty=0.5,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+
+        return [
+            Finding(
+                rule_id=self.rule_id,
+                rule_name=self.name,
+                severity=self.default_severity,
+                resource_address=resource.address,
+                resource_type=resource.type,
+                action=resource.action,
+                what_changed=f"Storage account '{resource.address}' enables public access: {'; '.join(reasons)}.",
+                why_it_matters="Public access on storage accounts risks accidental data leaks and sensitive blob exposure.",
+                remediation="Set allow_nested_items_to_be_public to false and restrict network_rules default_action to Deny.",
+                risk_factors=resolved_factors,
+                calculated_score=score,
+                details={"reasons": reasons},
+            )
+        ]
+
+
+class AzureKeyVaultPurgeProtectionRule(Rule):
+    rule_id = "AZR-KV-001"
+    name = "Azure Key Vault Purge Protection Disabled"
+    description = (
+        "Detects Key Vaults created or updated without purge protection or soft delete enabled."
+    )
+    default_severity = Severity.HIGH
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.type != "azurerm_key_vault" or resource.action == ActionType.DELETE:
+            return []
+
+        after = resource.after or {}
+        purge_enabled = after.get("purge_protection_enabled")
+        soft_delete_days = after.get("soft_delete_retention_days")
+
+        disabled_reasons: list[str] = []
+        if purge_enabled is False:
+            disabled_reasons.append("purge_protection_enabled is false")
+        if soft_delete_days is not None and soft_delete_days < 7:
+            disabled_reasons.append(
+                f"soft_delete_retention_days is {soft_delete_days} (less than 7)"
+            )
+
+        if not disabled_reasons:
+            return []
+
+        base_factors = RiskFactors(
+            change_impact=4.0,
+            security_exposure=3.5,
+            reversibility=4.5,
+            uncertainty=0.5,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+
+        return [
+            Finding(
+                rule_id=self.rule_id,
+                rule_name=self.name,
+                severity=self.default_severity,
+                resource_address=resource.address,
+                resource_type=resource.type,
+                action=resource.action,
+                what_changed=f"Key Vault '{resource.address}' lacks protection: {'; '.join(disabled_reasons)}.",
+                why_it_matters="Without purge protection, secrets, keys, and certificates can be permanently purged immediately without recovery.",
+                remediation="Enable purge_protection_enabled = true and configure adequate soft delete retention.",
+                risk_factors=resolved_factors,
+                calculated_score=score,
+                details={"reasons": disabled_reasons},
+            )
+        ]
+
+
+class AzureDatabaseDeletionReplacementRule(Rule):
+    rule_id = "AZR-DB-001"
+    name = "Azure Database Deletion or Replacement"
+    description = (
+        "Detects deletion or forced replacement of stateful Azure database and cache services."
+    )
+    default_severity = Severity.CRITICAL
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.type not in AZURE_DATABASE_TYPES:
+            return []
+
+        if resource.action not in (ActionType.DELETE, ActionType.REPLACE):
+            return []
+
+        base_factors = RiskFactors(
+            change_impact=5.0,
+            security_exposure=1.0,
+            reversibility=5.0,
+            uncertainty=1.0,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+
+        action_label = (
+            "deleted" if resource.action == ActionType.DELETE else "replaced (destroy and recreate)"
+        )
+        return [
+            Finding(
+                rule_id=self.rule_id,
+                rule_name=self.name,
+                severity=self.default_severity,
+                resource_address=resource.address,
+                resource_type=resource.type,
+                action=resource.action,
+                what_changed=f"Azure database resource '{resource.address}' ({resource.type}) is scheduled to be {action_label}.",
+                why_it_matters="Deleting or replacing databases risks data loss and extended downtime unless failover replicas exist.",
+                remediation="Review immutable attribute modifications causing recreation, ensure recent backups exist, and verify deletion intentions.",
+                risk_factors=resolved_factors,
+                calculated_score=score,
+                details={"resource_type": resource.type, "action": resource.action.value},
+            )
+        ]

preflight/rules/base.py

@@ -0,0 +1,24 @@
+"""Base rule interface and evaluation context."""
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+
+from preflight.models import Environment, Finding, ResourceChange, Severity
+
+
+@dataclass(frozen=True)
+class RuleContext:
+    environment: Environment
+
+
+class Rule(ABC):
+    """Abstract base class for all Preflight detection rules."""
+
+    rule_id: str
+    name: str
+    description: str
+    default_severity: Severity
+
+    @abstractmethod
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        """Evaluate a resource change against this rule and return any findings."""

preflight/rules/gcp.py

@@ -0,0 +1,250 @@
+"""GCP specific rules."""
+
+from typing import Any
+
+from preflight.models import (
+    ActionType,
+    Finding,
+    ResourceChange,
+    RiskFactors,
+    Severity,
+)
+from preflight.rules.base import Rule, RuleContext
+from preflight.scoring import score_finding
+
+PUBLIC_CIDRS = {"0.0.0.0/0", "::/0"}
+PUBLIC_IDENTITIES = {"allusers", "allauthenticatedusers"}
+
+
+def _gcp_firewall_allows_admin(allow_blocks: list[Any]) -> tuple[bool, str]:
+    for block in allow_blocks:
+        if not isinstance(block, dict):
+            continue
+        proto = str(block.get("protocol", "")).lower()
+        ports = block.get("ports", [])
+
+        if proto in ("all", "-1") or (proto == "tcp" and not ports):
+            return True, f"all traffic ({proto})"
+
+        port_list = [str(p) for p in ports] if isinstance(ports, list) else []
+        found_ports: list[str] = []
+        for p in port_list:
+            if p == "22":
+                found_ports.append("SSH:22")
+            elif p == "3389":
+                found_ports.append("RDP:3389")
+            elif "-" in p:
+                parts = p.split("-", 1)
+                try:
+                    low, high = int(parts[0]), int(parts[1])
+                    if low <= 22 <= high:
+                        found_ports.append("SSH:22")
+                    if low <= 3389 <= high:
+                        found_ports.append("RDP:3389")
+                except ValueError:
+                    pass
+        if found_ports:
+            return True, ", ".join(found_ports)
+
+    return False, ""
+
+
+class GcpFirewallPublicAdminIngressRule(Rule):
+    rule_id = "GCP-FW-001"
+    name = "GCP Firewall Public Administrative Ingress"
+    description = "Detects compute firewall rules exposing management ports (22, 3389) or all traffic to 0.0.0.0/0."
+    default_severity = Severity.CRITICAL
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.type != "google_compute_firewall" or resource.action == ActionType.DELETE:
+            return []
+
+        after = resource.after or {}
+        direction = str(after.get("direction", "INGRESS")).upper()
+        if direction != "INGRESS":
+            return []
+
+        ranges = after.get("source_ranges") or []
+        range_set = {str(r).strip() for r in ranges} if isinstance(ranges, list) else set()
+        matched_cidrs = range_set.intersection(PUBLIC_CIDRS)
+        if not matched_cidrs:
+            return []
+
+        allow_blocks = after.get("allow") or []
+        if not isinstance(allow_blocks, list):
+            return []
+
+        matches_admin, port_desc = _gcp_firewall_allows_admin(allow_blocks)
+        if not matches_admin:
+            return []
+
+        base_factors = RiskFactors(
+            change_impact=3.5,
+            security_exposure=5.0,
+            reversibility=1.0,
+            uncertainty=0.5,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+
+        return [
+            Finding(
+                rule_id=self.rule_id,
+                rule_name=self.name,
+                severity=self.default_severity,
+                resource_address=resource.address,
+                resource_type=resource.type,
+                action=resource.action,
+                what_changed=(
+                    f"Firewall rule '{resource.address}' allows ingress {port_desc} "
+                    f"from public internet ({', '.join(sorted(matched_cidrs))})."
+                ),
+                why_it_matters="Exposing SSH or RDP to all internet IP addresses exposes instances to automated port scanning and brute force attacks.",
+                remediation="Restrict source_ranges to trusted corporate CIDRs, bastion IPs, or use Identity-Aware Proxy (IAP) for TCP forwarding.",
+                risk_factors=resolved_factors,
+                calculated_score=score,
+                details={"source_ranges": sorted(matched_cidrs), "exposed_ports": port_desc},
+            )
+        ]
+
+
+class GcpStoragePublicAccessRule(Rule):
+    rule_id = "GCP-IAM-001"
+    name = "GCP Cloud Storage Public IAM Grant"
+    description = "Detects storage bucket IAM bindings or members that grant access to allUsers or allAuthenticatedUsers."
+    default_severity = Severity.CRITICAL
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.action == ActionType.DELETE or not resource.after:
+            return []
+
+        public_members: list[str] = []
+
+        if resource.type in (
+            "google_storage_bucket_iam_binding",
+            "google_storage_bucket_iam_policy",
+        ):
+            members = resource.after.get("members") or []
+            if isinstance(members, list):
+                public_members = [
+                    str(m) for m in members if str(m).strip().lower() in PUBLIC_IDENTITIES
+                ]
+
+        elif resource.type == "google_storage_bucket_iam_member":
+            member = str(resource.after.get("member", "")).strip().lower()
+            if member in PUBLIC_IDENTITIES:
+                public_members = [member]
+
+        elif resource.type == "google_storage_bucket_access_control":
+            entity = str(resource.after.get("entity", "")).strip().lower()
+            if entity in PUBLIC_IDENTITIES:
+                public_members = [entity]
+
+        if not public_members:
+            return []
+
+        role = str(resource.after.get("role", "custom"))
+        base_factors = RiskFactors(
+            change_impact=4.0,
+            security_exposure=5.0,
+            reversibility=2.0,
+            uncertainty=0.5,
+        )
+        resolved_factors, score = score_finding(base_factors, context.environment)
+
+        return [
+            Finding(
+                rule_id=self.rule_id,
+                rule_name=self.name,
+                severity=self.default_severity,
+                resource_address=resource.address,
+                resource_type=resource.type,
+                action=resource.action,
+                what_changed=(
+                    f"Storage IAM resource '{resource.address}' grants role '{role}' "
+                    f"to public identities ({', '.join(public_members)})."
+                ),
+                why_it_matters="Granting storage bucket permissions to allUsers or allAuthenticatedUsers exposes data publicly without authentication.",
+                remediation="Remove public identity grants and enforce uniform bucket-level access with targeted service account or user bindings.",
+                risk_factors=resolved_factors,
+                calculated_score=score,
+                details={"role": role, "public_members": public_members},
+            )
+        ]
+
+
+class GcpSqlDeletionProtectionRule(Rule):
+    rule_id = "GCP-SQL-001"
+    name = "Cloud SQL Deletion or Deletion Protection Disabled"
+    description = "Detects deletion or forced replacement of Cloud SQL instances, or disabling instance deletion protection."
+    default_severity = Severity.CRITICAL
+
+    def evaluate(self, resource: ResourceChange, context: RuleContext) -> list[Finding]:
+        if resource.type != "google_sql_database_instance":
+            return []
+
+        # 1. Instance Deletion or Recreation
+        if resource.action in (ActionType.DELETE, ActionType.REPLACE):
+            base_factors = RiskFactors(
+                change_impact=5.0,
+                security_exposure=1.0,
+                reversibility=5.0,
+                uncertainty=1.0,
+            )
+            resolved_factors, score = score_finding(base_factors, context.environment)
+            action_label = (
+                "deleted"
+                if resource.action == ActionType.DELETE
+                else "replaced (destroy and recreate)"
+            )
+
+            return [
+                Finding(
+                    rule_id=self.rule_id,
+                    rule_name=self.name,
+                    severity=Severity.CRITICAL,
+                    resource_address=resource.address,
+                    resource_type=resource.type,
+                    action=resource.action,
+                    what_changed=f"Cloud SQL instance '{resource.address}' is scheduled to be {action_label}.",
+                    why_it_matters="Destroying or replacing a managed database causes downtime and irreversible data loss unless failover replicas exist.",
+                    remediation="Verify immutable configuration parameters causing replacement, ensure automated backups are current, and confirm deletion intent.",
+                    risk_factors=resolved_factors,
+                    calculated_score=score,
+                    details={"action": resource.action.value},
+                )
+            ]
+
+        # 2. Deletion Protection Disabled
+        after = resource.after or {}
+        settings = after.get("settings") if isinstance(after.get("settings"), dict) else {}
+        deletion_prot = after.get("deletion_protection")
+        if deletion_prot is None and settings:
+            deletion_prot = settings.get("deletion_protection")
+
+        if deletion_prot is False:
+            base_factors = RiskFactors(
+                change_impact=3.0,
+                security_exposure=1.0,
+                reversibility=3.5,
+                uncertainty=0.5,
+            )
+            resolved_factors, score = score_finding(base_factors, context.environment)
+
+            return [
+                Finding(
+                    rule_id=self.rule_id,
+                    rule_name=self.name,
+                    severity=Severity.HIGH,
+                    resource_address=resource.address,
+                    resource_type=resource.type,
+                    action=resource.action,
+                    what_changed=f"Cloud SQL instance '{resource.address}' has deletion_protection set to false.",
+                    why_it_matters="Disabling deletion protection leaves production databases vulnerable to accidental deletion via Terraform or API calls.",
+                    remediation="Set deletion_protection = true to safeguard against inadvertent database destruction.",
+                    risk_factors=resolved_factors,
+                    calculated_score=score,
+                    details={"deletion_protection": False},
+                )
+            ]
+
+        return []