prowler 5.17.0__py3-none-any.whl → 5.18.0__py3-none-any.whl

prowler/providers/azure/services/keyvault/keyvault_service.py

@@ -1,3 +1,4 @@
+from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass
 from datetime import datetime
 from typing import List, Optional, Union
@@ -20,99 +21,155 @@ class KeyVault(AzureService):
         self.key_vaults = self._get_key_vaults(provider)
 
     def _get_key_vaults(self, provider):
+        """
+        Get all KeyVaults with parallel processing.
+
+        Optimizations:
+        1. Uses list_by_subscription() for full Vault objects
+        2. Processes vaults in parallel using __threading_call__
+        3. Each vault's keys/secrets/monitor fetched in parallel
+        """
         logger.info("KeyVault - Getting key_vaults...")
         key_vaults = {}
+
         for subscription, client in self.clients.items():
             try:
-                key_vaults.update({subscription: []})
-                key_vaults_list = client.vaults.list()
-                for keyvault in key_vaults_list:
-                    resource_group = keyvault.id.split("/")[4]
-                    keyvault_name = keyvault.name
-                    keyvault_properties = client.vaults.get(
-                        resource_group, keyvault_name
-                    ).properties
-                    keys = self._get_keys(
-                        subscription, resource_group, keyvault_name, provider
-                    )
-                    secrets = self._get_secrets(
-                        subscription, resource_group, keyvault_name
-                    )
-                    key_vaults[subscription].append(
-                        KeyVaultInfo(
-                            id=getattr(keyvault, "id", ""),
-                            name=getattr(keyvault, "name", ""),
-                            location=getattr(keyvault, "location", ""),
-                            resource_group=resource_group,
-                            properties=VaultProperties(
-                                tenant_id=getattr(keyvault_properties, "tenant_id", ""),
-                                enable_rbac_authorization=getattr(
-                                    keyvault_properties,
-                                    "enable_rbac_authorization",
-                                    False,
-                                ),
-                                private_endpoint_connections=[
-                                    PrivateEndpointConnection(id=conn.id)
-                                    for conn in (
-                                        getattr(
-                                            keyvault_properties,
-                                            "private_endpoint_connections",
-                                            [],
-                                        )
-                                        or []
-                                    )
-                                ],
-                                enable_soft_delete=getattr(
-                                    keyvault_properties, "enable_soft_delete", False
-                                ),
-                                enable_purge_protection=getattr(
-                                    keyvault_properties,
-                                    "enable_purge_protection",
-                                    False,
-                                ),
-                                public_network_access_disabled=(
-                                    getattr(
-                                        keyvault_properties,
-                                        "public_network_access",
-                                        "Enabled",
-                                    )
-                                    == "Disabled"
-                                ),
-                            ),
-                            keys=keys,
-                            secrets=secrets,
-                            monitor_diagnostic_settings=self._get_vault_monitor_settings(
-                                keyvault_name, resource_group, subscription
-                            ),
-                        )
-                    )
+                key_vaults[subscription] = []
+                vaults_list = list(client.vaults.list_by_subscription())
+
+                if not vaults_list:
+                    continue
+
+                # Prepare items for parallel processing
+                items = [
+                    {
+                        "subscription": subscription,
+                        "keyvault": vault,
+                        "provider": provider,
+                    }
+                    for vault in vaults_list
+                ]
+
+                # Process all KeyVaults in parallel
+                results = self.__threading_call__(self._process_single_keyvault, items)
+                key_vaults[subscription] = results
+
             except Exception as error:
                 logger.error(
                     f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
+
         return key_vaults
 
+    def _process_single_keyvault(self, item: dict) -> Optional["KeyVaultInfo"]:
+        """Process a single KeyVault in parallel."""
+        subscription = item["subscription"]
+        keyvault = item["keyvault"]
+        provider = item["provider"]
+
+        try:
+            resource_group = keyvault.id.split("/")[4]
+            keyvault_name = keyvault.name
+            keyvault_properties = keyvault.properties
+
+            # Fetch keys, secrets, and monitor in parallel
+            with ThreadPoolExecutor(max_workers=3) as executor:
+                keys_future = executor.submit(
+                    self._get_keys,
+                    subscription,
+                    resource_group,
+                    keyvault_name,
+                    provider,
+                )
+                secrets_future = executor.submit(
+                    self._get_secrets, subscription, resource_group, keyvault_name
+                )
+                monitor_future = executor.submit(
+                    self._get_vault_monitor_settings,
+                    keyvault_name,
+                    resource_group,
+                    subscription,
+                )
+
+                keys = keys_future.result()
+                secrets = secrets_future.result()
+                monitor_settings = monitor_future.result()
+
+            return KeyVaultInfo(
+                id=getattr(keyvault, "id", ""),
+                name=getattr(keyvault, "name", ""),
+                location=getattr(keyvault, "location", ""),
+                resource_group=resource_group,
+                properties=VaultProperties(
+                    tenant_id=getattr(keyvault_properties, "tenant_id", ""),
+                    enable_rbac_authorization=getattr(
+                        keyvault_properties,
+                        "enable_rbac_authorization",
+                        False,
+                    ),
+                    private_endpoint_connections=[
+                        PrivateEndpointConnection(id=conn.id)
+                        for conn in (
+                            getattr(
+                                keyvault_properties,
+                                "private_endpoint_connections",
+                                [],
+                            )
+                            or []
+                        )
+                    ],
+                    enable_soft_delete=getattr(
+                        keyvault_properties, "enable_soft_delete", False
+                    ),
+                    enable_purge_protection=getattr(
+                        keyvault_properties,
+                        "enable_purge_protection",
+                        False,
+                    ),
+                    public_network_access_disabled=(
+                        getattr(
+                            keyvault_properties,
+                            "public_network_access",
+                            "Enabled",
+                        )
+                        == "Disabled"
+                    ),
+                ),
+                keys=keys,
+                secrets=secrets,
+                monitor_diagnostic_settings=monitor_settings,
+            )
+
+        except Exception as error:
+            logger.error(
+                f"KeyVault {keyvault.name} in {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return None
+
     def _get_keys(self, subscription, resource_group, keyvault_name, provider):
         logger.info(f"KeyVault - Getting keys for {keyvault_name}...")
         keys = []
+        keys_dict = {}
+
         try:
             client = self.clients[subscription]
             keys_list = client.keys.list(resource_group, keyvault_name)
             for key in keys_list:
-                keys.append(
-                    Key(
-                        id=getattr(key, "id", ""),
-                        name=getattr(key, "name", ""),
+                key_obj = Key(
+                    id=getattr(key, "id", ""),
+                    name=getattr(key, "name", ""),
+                    enabled=getattr(key.attributes, "enabled", False),
+                    location=getattr(key, "location", ""),
+                    attributes=KeyAttributes(
                         enabled=getattr(key.attributes, "enabled", False),
-                        location=getattr(key, "location", ""),
-                        attributes=KeyAttributes(
-                            enabled=getattr(key.attributes, "enabled", False),
-                            created=getattr(key.attributes, "created", 0),
-                            updated=getattr(key.attributes, "updated", 0),
-                            expires=getattr(key.attributes, "expires", 0),
-                        ),
-                    )
+                        created=getattr(key.attributes, "created", 0),
+                        updated=getattr(key.attributes, "updated", 0),
+                        expires=getattr(key.attributes, "expires", 0),
+                    ),
                 )
+                keys.append(key_obj)
+                keys_dict[key_obj.name] = key_obj
+
         except Exception as error:
             logger.error(
                 f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -124,12 +181,19 @@ class KeyVault(AzureService):
                 # TODO: review the following line
                 credential=provider.session,
             )
-            properties = key_client.list_properties_of_keys()
-            for prop in properties:
-                policy = key_client.get_key_rotation_policy(prop.name)
-                for key in keys:
-                    if key.name == prop.name:
-                        key.rotation_policy = KeyRotationPolicy(
+            properties = list(key_client.list_properties_of_keys())
+
+            if properties:
+                items = [
+                    {"key_client": key_client, "prop": prop} for prop in properties
+                ]
+                rotation_results = self.__threading_call__(
+                    self._get_single_rotation_policy, items
+                )
+
+                for name, policy in rotation_results:
+                    if policy and name in keys_dict:
+                        keys_dict[name].rotation_policy = KeyRotationPolicy(
                             id=getattr(policy, "id", ""),
                             lifetime_actions=[
                                 KeyRotationLifetimeAction(action=action.action)
@@ -142,8 +206,25 @@ class KeyVault(AzureService):
             logger.warning(
                 f"Subscription name: {subscription} -- has no access policy configured for keyvault {keyvault_name}"
             )
+
         return keys
 
+    def _get_single_rotation_policy(self, item: dict) -> tuple:
+        """Thread-safe rotation policy retrieval."""
+        key_client = item["key_client"]
+        prop = item["prop"]
+
+        try:
+            policy = key_client.get_key_rotation_policy(prop.name)
+            return (prop.name, policy)
+        except HttpResponseError:
+            return (prop.name, None)
+        except Exception as error:
+            logger.warning(
+                f"KeyVault - Failed to get rotation policy for key {prop.name}: {error}"
+            )
+            return (prop.name, None)
+
     def _get_secrets(self, subscription, resource_group, keyvault_name):
         logger.info(f"KeyVault - Getting secrets for {keyvault_name}...")
         secrets = []
@@ -177,6 +258,7 @@ class KeyVault(AzureService):
             logger.error(
                 f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
+
         return secrets
 
     def _get_vault_monitor_settings(self, keyvault_name, resource_group, subscription):
@@ -192,8 +274,9 @@ class KeyVault(AzureService):
             )
         except Exception as error:
             logger.error(
-                f"Subscription name: {self.subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
+
         return monitor_diagnostics_settings
 
 

prowler/providers/azure/services/mysql/mysql_flexible_server_audit_log_connection_activated/mysql_flexible_server_audit_log_connection_activated.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "mysql_flexible_server_audit_log_connection_activated",
-  "CheckTitle": "Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server",
+  "CheckTitle": "MySQL flexible server has audit_log_events including CONNECTION",
   "CheckType": [],
   "ServiceName": "mysql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "Microsoft.DBforMySQL/flexibleServers",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Set audit_log_enabled to include CONNECTION on MySQL Servers.",
-  "Risk": "Enabling CONNECTION helps MySQL Database to log items such as successful and failed connection attempts to the server. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/mysql/single-server/how-to-configure-audit-logs-portal",
+  "Description": "**Azure Database for MySQL Flexible Server** audit configuration includes the `CONNECTION` event in `audit_log_events`.",
+  "Risk": "Without **CONNECTION auditing**, login attempts are invisible, weakening detection of **brute-force**, **credential stuffing**, and anomalous access. This enables unnoticed account takeover and lateral movement, impacting **confidentiality** and **integrity**, and hinders **forensics** and timely response.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/MySQL/configure-audit-log-events-for-mysql-flexible-servers.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.tenable.com/audits/items/CIS_Microsoft_Azure_Foundations_v2.0.0_L2.audit:06ec721d4c0ea9169db2b0c6876c5f38",
-      "Terraform": ""
+      "CLI": "az mysql flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name audit_log_events --value CONNECTION",
+      "NativeIaC": "```bicep\n// Set MySQL Flexible Server audit_log_events to include CONNECTION\nresource cfg 'Microsoft.DBforMySQL/flexibleServers/configurations@2021-05-01' = {\n  name: '<example_resource_name>/audit_log_events'\n  properties: {\n    value: 'CONNECTION' // Critical: ensures 'CONNECTION' is logged, making the check PASS\n  }\n}\n```",
+      "Other": "1. In the Azure Portal, go to Azure Database for MySQL flexible server\n2. Select your server, then go to Server parameters\n3. Search for audit_log_events\n4. Set its value to CONNECTION\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_mysql_flexible_server_configuration\" \"<example_resource_name>\" {\n  name                = \"audit_log_events\"\n  resource_group_name = \"<example_resource_group>\"\n  server_name         = \"<example_server_name>\"\n  value               = \"CONNECTION\" # Critical: includes CONNECTION in audit logs to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. From Azure Home select the Portal Menu. 2. Select Azure Database for MySQL servers. 3. Select a database. 4. Under Settings, select Server parameters. 5. Update audit_log_enabled parameter to ON. 6. Update audit_log_events parameter to have at least CONNECTION checked. 7. Click Save. 8. Under Monitoring, select Diagnostic settings. 9. Select + Add diagnostic setting. 10. Provide a diagnostic setting name. 11. Under Categories, select MySQL Audit Logs. 12. Specify destination details. 13. Click Save.",
-      "Url": "https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation"
+      "Text": "Include `CONNECTION` in `audit_log_events` to capture login activity. Centralize and retain **audit logs**, restrict access by **least privilege**, and protect logs from tampering. Monitor for anomalous sign-in patterns and alert. Pair with **defense-in-depth** controls (MFA, network allow-listing) to reduce exposure.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_audit_log_connection_activated"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "There are further costs incurred for storage of logs. For high traffic databases these logs will be significant. Determine your organization's needs before enabling."

prowler/providers/azure/services/mysql/mysql_flexible_server_audit_log_enabled/mysql_flexible_server_audit_log_enabled.metadata.json

@@ -1,30 +1,37 @@
 {
   "Provider": "azure",
   "CheckID": "mysql_flexible_server_audit_log_enabled",
-  "CheckTitle": "Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server",
+  "CheckTitle": "MySQL flexible server has audit_log_enabled set to ON",
   "CheckType": [],
   "ServiceName": "mysql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "Microsoft.DBforMySQL/flexibleServers",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable audit_log_enabled on MySQL Servers.",
-  "Risk": "Enabling audit_log_enabled helps MySQL Database to log items such as connection attempts to the server, DDL/DML access, and more. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/mysql/single-server/how-to-configure-audit-logs-portal",
+  "Description": "**Azure Database for MySQL Flexible Server** with `audit_log_enabled` set to `ON` generates **audit logs** for connections, authentication, DDL/DML, and administrative actions.",
+  "Risk": "Missing **audit logs** reduces **accountability** and obscures activity affecting **confidentiality** and **integrity**. Unauthorized logins, privilege abuse, or suspicious queries may go undetected, impeding **forensics**, slowing incident response, and enabling covert data exfiltration.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/tutorial-configure-audit",
+    "https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation",
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/scripts/sample-cli-audit-logs"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.tenable.com/audits/items/CIS_Microsoft_Azure_Foundations_v1.5.0_L2.audit:c073639a1ce546b535ba73afbf6542aa",
-      "Terraform": ""
+      "CLI": "az mysql flexible-server parameter set --name audit_log_enabled --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --value ON",
+      "NativeIaC": "```bicep\n// Enable audit logs on an existing MySQL Flexible Server\nresource server 'Microsoft.DBforMySQL/flexibleServers@2021-12-01-preview' existing = {\n  name: '<example_resource_name>'\n}\n\nresource audit 'Microsoft.DBforMySQL/flexibleServers/configurations@2021-12-01-preview' = {\n  name: 'audit_log_enabled'\n  parent: server\n  properties: {\n    value: 'ON' // CRITICAL: turns audit_log_enabled ON to pass the check\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal\n2. Go to: Azure Database for MySQL flexible server > Your server\n3. Under Settings, select Server parameters\n4. Find audit_log_enabled and set it to ON\n5. Click Save",
+      "Terraform": "```hcl\n# Enable audit logs on MySQL Flexible Server\nresource \"azurerm_mysql_flexible_server_configuration\" \"<example_resource_name>\" {\n  name                = \"audit_log_enabled\"\n  resource_group_name = \"<example_resource_name>\"\n  server_name         = \"<example_resource_name>\"\n  value               = \"ON\" # CRITICAL: enables audit logging to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. Login to Azure Portal using https://portal.azure.com. 2. Select Azure Database for MySQL Servers. 3. Select a database. 4. Under Settings, select Server parameters. 5. Update audit_log_enabled parameter to ON 6. Under Monitoring, select Diagnostic settings. 7. Select + Add diagnostic setting. 8. Provide a diagnostic setting name. 9. Under Categories, select MySQL Audit Logs. 10. Specify destination details. 11. Click Save.",
-      "Url": "https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation"
+      "Text": "Enable **audit logging** (`audit_log_enabled=ON`) and select events that matter. Export `MySqlAuditLogs` to a centralized store, enforce **least privilege** on log access, set retention, and create alerts for anomalies. Regularly review logs as part of **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_audit_log_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/mysql/mysql_flexible_server_minimum_tls_version_12/mysql_flexible_server_minimum_tls_version_12.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "mysql_flexible_server_minimum_tls_version_12",
-  "CheckTitle": "Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server",
+  "CheckTitle": "MySQL flexible server enforces TLS 1.2 or higher",
   "CheckType": [],
   "ServiceName": "mysql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "Microsoft.DBforMySQL/flexibleServers",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Ensure TLS version on MySQL flexible servers is set to the default value.",
-  "Risk": "TLS connectivity helps to provide a new layer of security by connecting database server to client applications using Transport Layer Security (TLS). Enforcing TLS connections between database server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/mysql/concepts-ssl-connection-security",
+  "Description": "**Azure Database for MySQL Flexible Server** uses the `tls_version` setting to permit only **modern TLS** for client connections, requiring `TLSv1.2+` and excluding `TLSv1.0` and `TLSv1.1`.",
+  "Risk": "Allowing legacy TLS (`TLSv1.0`/`TLSv1.1`) weakens **confidentiality** and **integrity** of data in transit. Attackers can force downgrades and perform **man-in-the-middle** interception, exposing credentials and queries or altering results, leading to unauthorized access and data exfiltration.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/MySQL/mysql-flexible-server-tls-version.html",
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/security-tls-how-to-connect"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az mysql flexible-server parameter set --name tls_version --resource-group <resourceGroupName> --server-name <serverName> --value TLSV1.2",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/MySQL/mysql-flexible-server-tls-version.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-mysql-is-using-the-latest-version-of-tls-encryption#terraform"
+      "CLI": "az mysql flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name tls_version --value TLSv1.2",
+      "NativeIaC": "```bicep\n// Set MySQL Flexible Server to enforce TLS 1.2\nresource tlsVersion 'Microsoft.DBforMySQL/flexibleServers/configurations@2022-01-01' = {\n  name: '<example_resource_name>/tls_version'\n  properties: {\n    value: 'TLSv1.2' // Critical: enforces minimum TLS 1.2 and rejects TLS 1.0/1.1\n  }\n}\n```",
+      "Other": "1. In Azure portal, go to Azure Database for MySQL flexible server <example_resource_name>\n2. Select Server parameters\n3. Search for tls_version\n4. Set the value to TLSv1.2\n5. Click Save",
+      "Terraform": "```hcl\n# Enforce TLS 1.2 on MySQL Flexible Server\nresource \"azurerm_mysql_flexible_server_configuration\" \"tls\" {\n  name                = \"tls_version\"\n  resource_group_name = \"<example_resource_group>\"\n  server_name         = \"<example_server_name>\"\n  value               = \"TLSv1.2\" # Critical: sets minimum TLS to 1.2 (no 1.0/1.1)\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. Login to Azure Portal using https://portal.azure.com 2. Go to Azure Database for MySQL flexible servers 3. For each database, click on Server parameters under Settings 4. In the search box, type in tls_version 5. Click on the VALUE dropdown, and ensure only TLSV1.2 is selected for tls_version",
-      "Url": "https://docs.microsoft.com/en-us/azure/mysql/howto-configure-ssl"
+      "Text": "Enforce a **minimum TLS** of `TLSv1.2` (prefer `TLSv1.3`) and disable `TLSv1.0`/`TLSv1.1`. Ensure clients and drivers support modern TLS, deprecate weak cipher suites, and validate in staging. Apply **defense in depth** with private connectivity and restricted network access.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_minimum_tls_version_12"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "encryption"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/mysql/mysql_flexible_server_ssl_connection_enabled/mysql_flexible_server_ssl_connection_enabled.metadata.json

@@ -1,30 +1,37 @@
 {
   "Provider": "azure",
   "CheckID": "mysql_flexible_server_ssl_connection_enabled",
-  "CheckTitle": "Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server",
+  "CheckTitle": "MySQL Flexible Server enforces SSL connections",
   "CheckType": [],
   "ServiceName": "mysql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
-  "ResourceType": "Microsoft.DBforMySQL/flexibleServers",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable SSL connection on MYSQL Servers.",
-  "Risk": "SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.",
-  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/mysql/single-server/concepts-ssl-connection-security",
+  "Description": "**Azure Database for MySQL Flexible Server** uses the `require_secure_transport` parameter to enforce **encrypted connections**. This evaluation determines whether the server is configured to require **TLS/SSL** for all client sessions.",
+  "Risk": "Without **TLS enforcement**, credentials and queries may traverse the network in cleartext, enabling **man-in-the-middle**, **credential theft**, tampering, and data exfiltration. This directly impacts **confidentiality** and **integrity** and can lead to compliance violations.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-networking",
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-troubleshoot-common-connection-issues",
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-connect-tls-ssl"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
-      "NativeIaC": "",
-      "Other": "https://www.tenable.com/policies/[type]/AC_AZURE_0131",
-      "Terraform": ""
+      "CLI": "az mysql flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name require_secure_transport --value ON",
+      "NativeIaC": "```bicep\n// Enforce SSL/TLS by enabling require_secure_transport on MySQL Flexible Server\nresource reqSecureTransport 'Microsoft.DBforMySQL/flexibleServers/configurations@2023-12-30' = {\n  name: '<example_resource_name>/require_secure_transport'\n  properties: {\n    value: 'ON' // Critical: turns on SSL enforcement (require_secure_transport)\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal\n2. Go to: Azure Database for MySQL Flexible Server > <your server>\n3. Select Server parameters\n4. Find require_secure_transport and set it to ON\n5. Click Save\n6. Verify by refreshing Server parameters and confirming the value is ON",
+      "Terraform": "```hcl\n# Enforce SSL/TLS on MySQL Flexible Server\nresource \"azurerm_mysql_flexible_server_configuration\" \"secure\" {\n  name                = \"require_secure_transport\"\n  resource_group_name = \"<example_resource_group>\"\n  server_name         = \"<example_server_name>\"\n  value               = \"ON\" # Critical: enables SSL enforcement\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. Login to Azure Portal using https://portal.azure.com 2. Go to Azure Database for MySQL servers 3. For each database, click on Connection security 4. In SSL settings, click on ENABLED to Enforce SSL connections",
-      "Url": "https://docs.microsoft.com/en-us/azure/mysql/single-server/how-to-configure-ssl"
+      "Text": "Set `require_secure_transport=ON` and permit only **TLS 1.2+**. Ensure clients validate certificates and use FQDNs. Combine with **private access** (Private Link or VNet), restrictive firewall rules, and **least privilege** to reduce exposure. *Avoid legacy TLS or plaintext connections.*",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_ssl_connection_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "encryption"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.metadata.json

@@ -1,30 +1,39 @@
 {
   "Provider": "azure",
   "CheckID": "network_bastion_host_exists",
-  "CheckTitle": "Ensure an Azure Bastion Host Exists",
+  "CheckTitle": "Azure subscription has at least one Bastion Host",
   "CheckType": [],
   "ServiceName": "network",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "Network",
+  "ResourceType": "microsoft.network/bastionhosts",
   "ResourceGroup": "network",
-  "Description": "The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.",
-  "Risk": "The Azure Bastion service allows organizations a more secure means of accessing Azure Virtual Machines over the Internet without assigning public IP addresses to those Virtual Machines. The Azure Bastion service provides Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to Virtual Machines using TLS within a web browser, thus preventing organizations from opening up 3389/TCP and 22/TCP to the Internet on Azure Virtual Machines. Additional benefits of the Bastion service includes Multi-Factor Authentication, Conditional Access Policies, and any other hardening measures configured within Azure Active Directory using a central point of access.",
-  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku",
+  "Description": "**Azure subscription** contains an **Azure Bastion host** for secure RDP/SSH brokering over TLS on `443/TCP` to virtual machines using private IPs. The assessment identifies whether such a bastion is available.",
+  "Risk": "Absent **Bastion**, admins often assign public IPs or open `22/3389`, expanding attack surface.\n\nThis enables Internet brute force, credential stuffing, and RDP/SSH exploits, leading to unauthorized access, data exfiltration, and lateral movement. CIA impact: confidentiality/integrity loss and potential downtime from ransomware.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/powershell/module/az.network/get-azbastion?view=azps-9.2.0",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.network/bastionhosts",
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Network/bastion-host-exists.html",
+    "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku",
+    "https://learn.microsoft.com/en-us/azure/firewall/deploy-ps"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az network bastion create --location <location> --name <name of bastion host> --public-ip-address <public IP address name or ID> --resource-group <resource group name or ID> --vnet-name <virtual network containing subnet called 'AzureBastionSubnet'> --scale-units <integer> --sku Standard [--disable-copy- paste true|false] [--enable-ip-connect true|false] [--enable-tunneling true|false]",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Network/bastion-host-exists.html",
-      "Terraform": ""
+      "CLI": "az network bastion create --name <BASTION_NAME> --public-ip-address <PUBLIC_IP_NAME> --resource-group <RESOURCE_GROUP> --vnet-name <VNET_NAME> --location <LOCATION>",
+      "NativeIaC": "```bicep\n// Minimal Bicep to ensure at least one Bastion Host exists in the subscription\nparam location string = resourceGroup().location\n\nresource vnet 'Microsoft.Network/virtualNetworks@2022-07-01' = {\n  name: '<example_resource_name>-vnet'\n  location: location\n  properties: {\n    addressSpace: { addressPrefixes: ['10.0.0.0/24'] }\n    subnets: [\n      {\n        name: 'AzureBastionSubnet'\n        properties: { addressPrefix: '10.0.0.0/27' }\n      }\n    ]\n  }\n}\n\nresource pip 'Microsoft.Network/publicIPAddresses@2022-07-01' = {\n  name: '<example_resource_name>-pip'\n  location: location\n  sku: { name: 'Standard' }\n  properties: { publicIPAllocationMethod: 'Static' }\n}\n\nresource bastion 'Microsoft.Network/bastionHosts@2024-10-01' = {\n  name: '<example_resource_name>'\n  location: location\n  sku: { name: 'Basic' }\n  properties: {\n    ipConfigurations: [\n      {\n        name: 'IpConf'\n        properties: {\n          subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, 'AzureBastionSubnet') } // Critical: attaches Bastion to required AzureBastionSubnet so resource can be created\n          publicIPAddress: { id: pip.id } // Critical: associates required Public IP with Bastion\n        }\n      }\n    ]\n  }\n}\n```",
+      "Other": "1. In the Azure portal, go to Networking > Bastions > Create\n2. Select your Subscription and a Resource group\n3. Enter a Name and Region\n4. Under Virtual network, select an existing VNet or click Create new\n5. Ensure a subnet named AzureBastionSubnet exists with a /27 address space; create it if prompted\n6. For Public IP address, click Create new and accept defaults\n7. Click Review + create, then Create\n8. After deployment completes, the subscription now has a Bastion Host (check passes)",
+      "Terraform": "```hcl\n# Minimal Terraform to create one Bastion Host (fixes FAIL by ensuring existence)\nresource \"azurerm_resource_group\" \"example\" {\n  name     = \"<example_resource_name>\"\n  location = \"eastus\"\n}\n\nresource \"azurerm_virtual_network\" \"example\" {\n  name                = \"<example_resource_name>-vnet\"\n  location            = azurerm_resource_group.example.location\n  resource_group_name = azurerm_resource_group.example.name\n  address_space       = [\"10.0.0.0/24\"]\n}\n\nresource \"azurerm_subnet\" \"bastion\" {\n  name                 = \"AzureBastionSubnet\"\n  resource_group_name  = azurerm_resource_group.example.name\n  virtual_network_name = azurerm_virtual_network.example.name\n  address_prefixes     = [\"10.0.0.0/27\"]\n}\n\nresource \"azurerm_public_ip\" \"example\" {\n  name                = \"<example_resource_name>-pip\"\n  location            = azurerm_resource_group.example.location\n  resource_group_name = azurerm_resource_group.example.name\n  allocation_method   = \"Static\"\n  sku                 = \"Standard\"\n}\n\nresource \"azurerm_bastion_host\" \"example\" {\n  name                = \"<example_resource_name>\"\n  location            = azurerm_resource_group.example.location\n  resource_group_name = azurerm_resource_group.example.name\n\n  # Critical: creating the Bastion Host resource is what changes the check to PASS\n  sku = \"Basic\"  # Critical: required for Bastion creation\n\n  ip_configuration {                     \n    name                 = \"IpConf\"\n    subnet_id            = azurerm_subnet.bastion.id            # Critical: attaches Bastion to AzureBastionSubnet\n    public_ip_address_id = azurerm_public_ip.example.id         # Critical: associates required Public IP\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal* 1. Click on Bastions 2. Select the Subscription 3. Select the Resource group 4. Type a Name for the new Bastion host 5. Select a Region 6. Choose Standard next to Tier 7. Use the slider to set the Instance count 8. Select the Virtual network or Create new 9. Select the Subnet named AzureBastionSubnet. Create a Subnet named AzureBastionSubnet using a /26 CIDR range if it doesn't already exist. 10. Selct the appropriate Public IP address option. 11. If Create new is selected for the Public IP address option, provide a Public IP address name. 12. If Use existing is selected for Public IP address option, select an IP address from Choose public IP address 13. Click Next: Tags > 14. Configure the appropriate Tags 15. Click Next: Advanced > 16. Select the appropriate Advanced options 17. Click Next: Review + create > 18. Click Create From Azure CLI az network bastion create --location <location> --name <name of bastion host> --public-ip-address <public IP address name or ID> --resource-group <resource group name or ID> --vnet-name <virtual network containing subnet called 'AzureBastionSubnet'> --scale-units <integer> --sku Standard [--disable-copy- paste true|false] [--enable-ip-connect true|false] [--enable-tunneling true|false] From PowerShell Create the appropriate Virtual network settings and Public IP Address settings. $subnetName = 'AzureBastionSubnet' $subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix <IP address range in CIDR notation making sure to use a /26> $virtualNet = New-AzVirtualNetwork -Name <virtual network name> - ResourceGroupName <resource group name> -Location <location> -AddressPrefix <IP address range in CIDR notation> -Subnet $subnet $publicip = New-AzPublicIpAddress -ResourceGroupName <resource group name> - Name <public IP address name> -Location <location> -AllocationMethod Dynamic -Sku Standard",
-      "Url": "https://learn.microsoft.com/en-us/powershell/module/az.network/get-azbastion?view=azps-9.2.0"
+      "Text": "Standardize on **Azure Bastion** for admin access.\n\nRemove VM public IPs and deny inbound `22`/`3389` via perimeter controls and NSGs. Apply **least privilege** and just-in-time access, integrate **Entra ID** with **MFA** and conditional access, monitor sessions/logs, and segment networks so only Bastion can reach management ports.",
+      "Url": "https://hub.prowler.com/check/network_bastion_host_exists"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "internet-exposed"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "The Azure Bastion service incurs additional costs and requires a specific virtual network configuration. The Standard tier offers additional configuration options compared to the Basic tier and may incur additional costs for those added features."