chore:[NEXT-376] Rename the CMK policy #2349
Closed
+1
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughThe changes in this pull request primarily involve updates to the SQL insert statements for the Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
rnithinpaladin
requested review from
plyubich,
arunpaladin,
ershad-paladin,
go-jay and
kevin-paladin
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
installer/resources/pacbot_app/files/DB_Policy.sql(1 hunks)
🔇 Additional comments (1)
installer/resources/pacbot_app/files/DB_Policy.sql (1)
241-241: Verify policy configuration parameters
Please verify the following configuration parameters:
- The target type is set to 'vaults' - confirm if this is correct for database tier resources
- The key vault names 'cc-production-vault,cc-user-access-vault' are correct for your environment
- The key vault key 'Owner' and value 'AzSQLManager' are appropriate for database tier access
✅ Verification successful
Based on the search results, I can now provide a definitive response about the policy configuration parameters:
Configuration parameters are correctly set for database tier resources
The policy configuration in the codebase shows:
- The target type "vaults" is correct as this policy is specifically for Azure Key Vault configuration for database tier resources
- The key vault names "cc-production-vault,cc-user-access-vault" are confirmed as the default and expected values for database tier encryption
- The key vault key "Owner" and value "AzSQLManager" are appropriate for database tier access as they are specifically configured for SQL database management
This is evidenced by the policy definition found in the DB_Policy.sql file which shows these exact parameters being used for the Azure Database Tier Customer Managed Key policy.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify the key vault configuration in other policies
# Check if these key vault names are used in other policies
echo "Checking key vault names usage..."
rg -l "cc-production-vault|cc-user-access-vault" --type sql
# Check if the target type 'vaults' is used in other database-related policies
echo "Checking target type usage..."
rg '"targetType":"vaults"' --type sql
Length of output: 298
Script:
#!/bin/bash
# Let's examine the actual policy configuration in DB_Policy.sql
echo "Checking policy configuration in DB_Policy.sql..."
cat installer/resources/pacbot_app/files/DB_Policy.sql
# Let's also check for any other database-related policies
echo -e "\nSearching for other database policy files..."
fd -e sql -e json . | grep -i "db\|database"
# Let's check for similar target types in other policies
echo -e "\nChecking other target types in policies..."
rg '"targetType"' --type sql -A 1 -B 1
Length of output: 66171
Script:
#!/bin/bash
# Let's specifically check for the target type 'vaults' and key vault configurations
echo "Checking for 'vaults' target type..."
rg '"targetType":\s*"vaults"' --type sql -A 5 -B 5
echo -e "\nChecking for key vault configurations..."
rg "cc-production-vault|cc-user-access-vault|AzSQLManager" --type sql -A 5 -B 5
# Let's also check for database-related policies and their target types
echo -e "\nChecking for database-related policies..."
rg "database|sql|db" --type sql -A 2 -B 2
Length of output: 66059
| @@ -238,7 +238,7 @@ INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisp | |||
| INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisplayName, policyDesc, resolution, resolutionUrl, targetType, assetGroup, alexaKeyword, policyParams, policyFrequency, policyExecutable, policyRestUrl, policyType, policyArn, severity, category, autoFixAvailable, autoFixEnabled, allowList, waitingTime, maxEmailNotification, templateName, templateColumns, fixType, warningMailSubject, fixMailSubject, warningMessage, fixMessage, violationMessage, elapsedTime, userId, createdDate, modifiedDate, status) VALUES ('Azure_Create_Network_Security_Group_log_alert','Azure_Account_Create_Network_Security_Group_log_alert','Azure_Create_Network_Security_Group_log_alert','Enable Log Alert for Create/Update Network Security Group',' Ensure that an activity log alert is created for the Create or Update Network Security Group events','create a Microsoft Azure activity log alert for Create or Update Network Security Group event','https://github.com/PaladinCloud/CE/wiki/Azure-Policy#enable-log-alert','subscription','azure','Create_Network_Security_Group','{\"params\":[{\"encrypt\":false,\"value\":\"check-for-azure-activity-log-alert\",\"key\":\"policyKey\"},{\"key\":\"failure\",\"value\":\"selected alert rule is not configured to create or Update Network Security Group\",\"isValueNew\":true,\"encrypt\":false},{\"key\":\"SUCCESS\",\"value\":\"selected alert rule is configured to create or Update Network Security Group\",\"isValueNew\":true,\"encrypt\":false},{\"key\":\"field\",\"value\":\"operationName\",\"isValueNew\":true,\"encrypt\":false},{\"key\":\"equals\",\"value\":\"Microsoft.Network/networkSecurityGroups/write\",\"isValueNew\":true,\"encrypt\":false},{\"key\":\"policyName\",\"value\":\"Create or Update Network Security Group log alert\",\"isValueNew\":true,\"encrypt\":false},{\"encrypt\":false,\"value\":\"high\",\"key\":\"severity\"},{\"encrypt\":false,\"value\":\"operations\",\"key\":\"policyCategory\"},{\"encrypt\":false,\"value\":\"\",\"key\":\"policyOwner\"}],\"environmentVariables\":[],\"policyId\":\"Azure_Create_Network_Security_Group_log_alert\",\"autofix\":false,\"alexaKeyword\":\"Create_Network_Security_Group\",\"policyRestUrl\":\"\",\"targetType\":\"subscription\",\"pac_ds\":\"azure\",\"assetGroup\":\"azure\",\"policyUUID\":\"Azure_Account_Create_Network_Security_Group_log_alert\",\"policyType\":\"ManagePolicy\"}','0 0/6 * * ? *',NULL,NULL,'ManagePolicy','arn:aws:events:us-east-1:***REMOVED***:rule/Azure_Account_Create_Network_Security_Group_log_alert','high','security','false','false',NULL,24,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,24,'ASGC','2022-05-24','2022-05-24','ENABLED'); | |||
| INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisplayName, policyDesc, resolution, resolutionUrl, targetType, assetGroup, alexaKeyword, policyParams, policyFrequency, policyExecutable, policyRestUrl, policyType, policyArn, severity, category, autoFixAvailable, autoFixEnabled, allowList, waitingTime, maxEmailNotification, templateName, templateColumns, fixType, warningMailSubject, fixMailSubject, warningMessage, fixMessage, violationMessage, elapsedTime, userId, createdDate, modifiedDate, status) VALUES ('Azure_Enable_Adaptive_Application_controls_version-1_SecurityCenter_virtualmachine','azure_virtualmachine_enable_adaptive_application','Enable_Adaptive_Application_controls','Enable Adaptive Application Controls','To enable the scanning of adaptive application controls and control which applications can run on eligible virtual machines (VMs) in Microsoft Azure, it is necessary to activate the monitoring of this feature. This allows Microsoft Defender for Cloud to use machine learning to analyze the applications running on each VM and suggest a list of known-safe applications, helping to harden the VMs against malware. By activating the Adaptive Application Control feature, which is an automated application to allowlist solution provided by Microsoft Defender for Cloud, only specific applications are allowed to run on Azure and non-Azure VMs, using both Windows and Linux.','Open the Security Center dashboard.,In the left pane select Adaptive application controls located under Advanced cloud defense and Follow the guidelines.','https://github.com/tmobile/pacbot/wiki/Policies#Enable-Adaptive-Application-Controls','virtualmachine','azure','Enable_Adaptive_Application_controls','{\"params\":[{\"encrypt\":false,\"value\":\"check-for-azure-security-rule\",\"key\":\"policyKey\"},{\"key\":\"policyName\",\"value\":\"Adaptive@Application@Controls@should@be@enabled@on@virtual@machines\",\"isValueNew\":true,\"encrypt\":false},{\"encrypt\":false,\"value\":\"high\",\"key\":\"severity\"},{\"encrypt\":false,\"value\":\"security\",\"key\":\"policyCategory\"},{\"encrypt\":false,\"value\":\"\",\"key\":\"policyOwner\"}],\"environmentVariables\":[],\"policyId\":\"Azure_Enable_Adaptive_Application_controls_version-1_SecurityCenter_virtualmachine\",\"autofix\":false,\"alexaKeyword\":\"enable adaptive controls\",\"policyRestUrl\":\"\",\"targetType\":\"virtualmachine\",\"pac_ds\":\"azure\",\"assetGroup\":\"azure\",\"policyUUID\":\"Azure_Enable_Adaptive_Application_controls_version-1\",\"policyType\":\"ManagePolicy\"}','0 0/12 * * ? *','','','ManagePolicy','arn:aws:events:us-east-1:***REMOVED***:rule/azure_virtualmachine_enable_adaptive_application','high','security','false','false',NULL,24,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,24,'ASGC','2019-10-25','2019-10-25','ENABLED'); | |||
| INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisplayName, policyDesc, resolution, resolutionUrl, targetType, assetGroup, alexaKeyword, policyParams, policyFrequency, policyExecutable, policyRestUrl, policyType, policyArn, severity, category, autoFixAvailable, autoFixEnabled, allowList, waitingTime, maxEmailNotification, templateName, templateColumns, fixType, warningMailSubject, fixMailSubject, warningMessage, fixMessage, violationMessage, elapsedTime, userId, createdDate, modifiedDate, status) VALUES ('Azure_Enable_CMK_Encryption_For_Storage_Account_version-1_storageaccount','azure_enable_storage_account_customer_managed_key_encryption','EnableStorageAccountCMKEncryption','Enable Azure Storage Account Customer Managed Keys','Customer Managed Keys allow customers to control their own encryption keys for Azure Storage accounts, providing an extra layer of security and enabling greater regulatory compliance. This feature allows customers to generate, store, and revoke their own encryption keys in Azure Key Vault, ensuring that they have full control over who can access their data. Additionally, customers can rotate their encryption keys as needed to further enhance security. Using Customer Managed Keys is a best practice for ensuring the highest level of security for Azure Storage account data. ','create the Microsoft Azure Key Vault where the required Customer Managed Key and also create the Customer Managed Key (CMK), required to encrypt data within Microsoft Azure Storage account','https://github.com/PaladinCloud/CE/wiki/Azure-Policy#use-cmk-to-encrypt-azure-storage','storageaccount','azure','EnableStorageAccountCMKEncryption','{\"params\":[{\"encrypt\":false,\"value\":\"check-customer-managed-keys-encryption-enabled-for-storage-account\",\"key\":\"policyKey\"},{\"encrypt\":false,\"value\":\",\",\"key\":\"splitterChar\"},{\"encrypt\":false,\"value\":\"Application,Environment,Stack,Role\",\"key\":\"mandatoryTags\",\"isMandatory\":true,\"description\":\"Assets should have these mandatory tags\",\"defaultVal\":\"Application,Environment,Stack,Role\",\"displayName\":\"Mandatory tags\"},{\"encrypt\":false,\"value\":\"high\",\"key\":\"severity\"},{\"encrypt\":false,\"value\":\"security\",\"key\":\"policyCategory\"},{\"encrypt\":false,\"value\":\"\",\"key\":\"policyOwner\"}],\"environmentVariables\":[],\"policyId\":\"Azure_Enable_CMK_Encryption_For_Storage_Account_version-1_storageaccount\",\"autofix\":false,\"alexaKeyword\":\"EnableStorageAccountCMKEncryption\",\"policyRestUrl\":\"\",\"targetType\":\"storageaccount\",\"pac_ds\":\"azure\",\"assetGroup\":\"azure\",\"policyUUID\":\"azure_enable_storage_account_customer_managed_key_encryption\",\"policyType\":\"ManagePolicy\"}','0 0/6 * * ? *','','','ManagePolicy','arn:aws:events:us-east-1:***REMOVED***:rule/azure_enable_storage_account_customer_managed_key_encryption','high','security','false','false',NULL,24,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,24,'ASGC','2022-05-18','2022-05-18','ENABLED'); | |||
| INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisplayName, policyDesc, resolution, resolutionUrl, targetType, assetGroup, alexaKeyword, policyParams, policyFrequency, policyExecutable, policyRestUrl, policyType, policyArn, severity, category, autoFixAvailable, autoFixEnabled, allowList, waitingTime, maxEmailNotification, templateName, templateColumns, fixType, warningMailSubject, fixMailSubject, warningMessage, fixMessage, violationMessage, elapsedTime, userId, createdDate, modifiedDate, status) VALUES ('Azure_Enable_Database_Tier_Customer_Managed_Key','Azure_Enable_Database_Tier_Customer_Managed_Key','Azure_Enable_Database_Tier_Customer_Managed_Key','Create AWS KMS Customer Master Key for Database-Tier','Using your own AWS KMS Customer Master Key (CMK) for encryption of data in your database-tier provides you with complete control over encryption key ownership and usage. It\'s recommended to create an Amazon KMS Customer Master Key (CMK) for your database tier to protect data-at-rest in your AWS web stack and meet security and compliance requirements. You can easily rotate, audit, and disable the key with Amazon KMS. Additionally, it\'s advised to tag AWS resources in your database tier to better manage and organize your resources.','create and configure a dedicated Customer-Managed Key (CMK) for the Azure cloud resources provisioned within your Database tier','https://github.com/PaladinCloud/CE/wiki/Azure-Policy#use-cmk-to-encrypt-azure-storage','vaults','azure','Enable_Database_Tier_Customer_Managed_Key','{\"assetGroup\":\"azure\",\"policyId\":\"Azure_Enable_Database_Tier_Customer_Managed_Key\",\"policyRestUrl\":\"\",\"environmentVariables\":[],\"policyUUID\":\"Azure_Enable_Database_Tier_Customer_Managed_Key\",\"policyType\":\"ManagePolicy\",\"pac_ds\":\"azure\",\"targetType\":\"vaults\",\"params\":[{\"encrypt\":false,\"value\":\"check-for-azure-keyvault-rule-alert\",\"key\":\"policyKey\"},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"selected Customer Master Key is not an Database-tier resource\",\"key\":\"failure\"},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"selected Customer Master Key is an Database-tier resource\",\"key\":\"SUCCESS\"},{\"isValueNew\":true,\"defaultVal\":\"cc-production-vault,cc-user-access-vault\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault name\",\"description\":\"Keyvault name\",\"value\":\"cc-production-vault,cc-user-access-vault\",\"key\":\"keyValutName\",\"isMandatory\":true},{\"isValueNew\":true,\"defaultVal\":\"Owner\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault key\",\"description\":\"Keyvault key\",\"value\":\"Owner\",\"key\":\"keyVaultKey\",\"isMandatory\":true},{\"isValueNew\":true,\"defaultVal\":\"AzSQLManager\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault value\",\"description\":\"Keyvault value\",\"value\":\"AzSQLManager\",\"key\":\"keyVaultValue\",\"isMandatory\":true},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"Ensure Database Tier Customer-Managed Key\",\"key\":\"policyName\"},{\"encrypt\":false,\"value\":\"high\",\"key\":\"severity\"},{\"encrypt\":false,\"value\":\"security\",\"key\":\"policyCategory\"},{\"encrypt\":false,\"value\":\"\",\"key\":\"policyOwner\"}],\"autofix\":false,\"alexaKeyword\":\"Enable_Database_Tier_Customer_Managed_Key\"}','0 0/6 * * ? *',NULL,NULL,'ManagePolicy','arn:aws:events:us-east-1:***REMOVED***:rule/Azure_Enable_Database_Tier_Customer_Managed_Key','high','security','false','false',NULL,24,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,24,'ASGC','2022-05-25','2022-05-25','ENABLED'); | |||
| INSERT IGNORE INTO cf_PolicyTable (policyId, policyUUID, policyName, policyDisplayName, policyDesc, resolution, resolutionUrl, targetType, assetGroup, alexaKeyword, policyParams, policyFrequency, policyExecutable, policyRestUrl, policyType, policyArn, severity, category, autoFixAvailable, autoFixEnabled, allowList, waitingTime, maxEmailNotification, templateName, templateColumns, fixType, warningMailSubject, fixMailSubject, warningMessage, fixMessage, violationMessage, elapsedTime, userId, createdDate, modifiedDate, status) VALUES ('Azure_Enable_Database_Tier_Customer_Managed_Key','Azure_Enable_Database_Tier_Customer_Managed_Key','Azure_Enable_Database_Tier_Customer_Managed_Key','Create and configure Customer Managed Key for Database Tier','Using your own Azure Key Vault Customer Managed Key (CMK) for encrypting data in your database-tier ensures full control over key management, enhancing security and compliance. Create a Customer Managed Key in Azure Key Vault and associate it with the Database tier resources. Ensure proper tagging for better resource management.','https://github.com/PaladinCloud/CE/wiki/Azure-Policy#use-cmk-to-encrypt-azure-storage','vaults','azure','Enable_Database_Tier_Customer_Managed_Key','{\"assetGroup\":\"azure\",\"policyId\":\"Azure_Enable_Database_Tier_Customer_Managed_Key\",\"policyRestUrl\":\"\",\"environmentVariables\":[],\"policyUUID\":\"Azure_Enable_Database_Tier_Customer_Managed_Key\",\"policyType\":\"ManagePolicy\",\"pac_ds\":\"azure\",\"targetType\":\"vaults\",\"params\":[{\"encrypt\":false,\"value\":\"check-for-azure-keyvault-rule-alert\",\"key\":\"policyKey\"},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"selected Customer Master Key is not an Database-tier resource\",\"key\":\"failure\"},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"selected Customer Master Key is an Database-tier resource\",\"key\":\"SUCCESS\"},{\"isValueNew\":true,\"defaultVal\":\"cc-production-vault,cc-user-access-vault\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault name\",\"description\":\"Keyvault name\",\"value\":\"cc-production-vault,cc-user-access-vault\",\"key\":\"keyValutName\",\"isMandatory\":true},{\"isValueNew\":true,\"defaultVal\":\"Owner\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault key\",\"description\":\"Keyvault key\",\"value\":\"Owner\",\"key\":\"keyVaultKey\",\"isMandatory\":true},{\"isValueNew\":true,\"defaultVal\":\"AzSQLManager\",\"encrypt\":false,\"isEdit\":true,\"displayName\":\"Keyvault value\",\"description\":\"Keyvault value\",\"value\":\"AzSQLManager\",\"key\":\"keyVaultValue\",\"isMandatory\":true},{\"isValueNew\":true,\"encrypt\":false,\"value\":\"Ensure Database Tier Customer-Managed Key\",\"key\":\"policyName\"},{\"encrypt\":false,\"value\":\"high\",\"key\":\"severity\"},{\"encrypt\":false,\"value\":\"security\",\"key\":\"policyCategory\"},{\"encrypt\":false,\"value\":\"\",\"key\":\"policyOwner\"}],\"autofix\":false,\"alexaKeyword\":\"Enable_Database_Tier_Customer_Managed_Key\"}','0 0/6 * * ? *',NULL,NULL,'ManagePolicy','arn:aws:events:us-east-1:***REMOVED***:rule/Azure_Enable_Database_Tier_Customer_Managed_Key','high','security','false','false',NULL,24,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,24,'ASGC','2022-05-25','2022-05-25','ENABLED'); | |||
There was a problem hiding this comment.
Fix typo in keyVault parameter name
There's a typo in the parameter key 'keyValutName' which should be 'keyVaultName'.
Update the parameter name in the policyParams JSON:
-"key\":\"keyValutName\"
+"key\":\"keyVaultName\"Committable suggestion skipped: line range outside the PR's diff.
Fix incorrect resolution URL
The resolution URL points to the storage CMK policy documentation instead of the database tier CMK policy documentation.
Update the resolution URL in the INSERT statement:
-'https://github.com/PaladinCloud/CE/wiki/Azure-Policy#use-cmk-to-encrypt-azure-storage'
+'https://github.com/PaladinCloud/CE/wiki/Azure-Policy#use-cmk-to-encrypt-database-tier'Committable suggestion skipped: line range outside the PR's diff.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Please include a summary of the changes and the related issues. Please also include relevant motivation and context. List
any dependencies that are required for this change.
Problem
Solution
Fixes # (issue if any)
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also
list any relevant details for your test configuration
Checklist:
Other Information:
List any documentation updates that are needed for the Wiki
Summary by CodeRabbit
New Features
Bug Fixes