-
Notifications
You must be signed in to change notification settings - Fork 688
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1736 from fatima99s/postgresqlPrivateAccess
privateAccessEnabled
- Loading branch information
Showing
3 changed files
with
187 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
plugins/azure/postgresqlserver/postgresqlPrivateEndpoints.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| var async = require('async'); | ||
| const helpers = require('../../../helpers/azure'); | ||
|
|
||
| module.exports = { | ||
| title: 'PostgreSQL Server Private Endpoints Configured', | ||
| category: 'PostgreSQL Server', | ||
| domain: 'Databases', | ||
| description: 'Ensures that PostgreSQL Servers are accessible only through private endpoints', | ||
| more_info: 'Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. Private Endpoint uses a private IP address from your VNet, effectively bringing the service such as Azure SQL Server into your VNet.', | ||
| recommended_action: 'Ensure that Private Endpoints are configured properly and Public Network Access is disabled for PostgreSQL Server', | ||
| link: 'https://learn.microsoft.com/en-us/azure/private-link/private-link-overview', | ||
| apis: ['servers:listPostgres'], | ||
|
|
||
| run: function(cache, settings, callback) { | ||
| var results = []; | ||
| var source = {}; | ||
| var locations = helpers.locations(settings.govcloud); | ||
|
|
||
| async.each(locations.servers, function(location, rcb) { | ||
|
|
||
| var servers = helpers.addSource(cache, source, | ||
| ['servers', 'listPostgres', location]); | ||
|
|
||
| if (!servers) return rcb(); | ||
|
|
||
| if (servers.err || !servers.data) { | ||
| helpers.addResult(results, 3, | ||
| 'Unable to query for PostgreSQL servers: ' + helpers.addError(servers), location); | ||
| return rcb(); | ||
| } | ||
|
|
||
| if (!servers.data.length) { | ||
| helpers.addResult(results, 0, 'No PostgreSQL servers found', location); | ||
| return rcb(); | ||
| } | ||
|
|
||
| for (const server of servers.data) { | ||
| if (server.privateEndpointConnections && server.privateEndpointConnections.length) { | ||
| helpers.addResult(results, 0, 'Private Endpoints are configured for the PostgreSQL Server', location, server.id); | ||
| } else { | ||
| helpers.addResult(results, 2, 'Private Endpoints are not configured for the PostgreSQL Server', location, server.id); | ||
| } | ||
| } | ||
|
|
||
| rcb(); | ||
| }, function() { | ||
| callback(null, results, source); | ||
| }); | ||
| } | ||
| }; |
136 changes: 136 additions & 0 deletions
136
plugins/azure/postgresqlserver/postgresqlPrivateEndpoints.spec.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,136 @@ | ||
| var expect = require('chai').expect; | ||
| var privateEndpoints = require('./postgresqlPrivateEndpoints'); | ||
|
|
||
| const listPostgres = [ | ||
| { | ||
| 'sku': { | ||
| 'name': 'B_Gen5_1', | ||
| 'tier': 'Basic', | ||
| 'family': 'Gen5', | ||
| 'capacity': 1 | ||
| }, | ||
| 'location': 'eastus', | ||
| 'tags': { "key": "value" }, | ||
| 'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.DBforPostgreSQL/servers/server1', | ||
| 'name': 'server1', | ||
| 'type': 'Microsoft.DBforPostgreSQL/servers', | ||
| 'administratorLogin': 'test', | ||
| 'storageProfile': { | ||
| 'storageMB': 5120, | ||
| 'backupRetentionDays': 7, | ||
| 'geoRedundantBackup': 'Disabled', | ||
| 'storageAutogrow': 'Enabled' | ||
| }, | ||
| 'version': '11', | ||
| 'sslEnforcement': 'Enabled', | ||
| 'minimalTlsVersion': 'TLS1_0', | ||
| 'userVisibleState': 'Ready', | ||
| 'fullyQualifiedDomainName': 'server1.postgres.database.azure.com', | ||
| 'earliestRestoreDate': '2021-03-10T12:45:13.233+00:00', | ||
| 'replicationRole': '', | ||
| 'masterServerId': '', | ||
| 'byokEnforcement': 'Disabled', | ||
| 'privateEndpointConnections': [], | ||
| 'infrastructureEncryption': 'Disabled', | ||
| 'publicNetworkAccess': 'Enabled' | ||
| }, | ||
| { | ||
| 'sku': { | ||
| 'name': 'B_Gen5_1', | ||
| 'tier': 'Basic', | ||
| 'family': 'Gen5', | ||
| 'capacity': 1 | ||
| }, | ||
| 'location': 'eastus', | ||
| 'tags': { "key": "value" }, | ||
| 'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.DBforPostgreSQL/servers/server1', | ||
| 'name': 'server1', | ||
| 'type': 'Microsoft.DBforPostgreSQL/servers', | ||
| 'administratorLogin': 'test', | ||
| 'storageProfile': { | ||
| 'storageMB': 5120, | ||
| 'backupRetentionDays': 7, | ||
| 'geoRedundantBackup': 'Disabled', | ||
| 'storageAutogrow': 'Enabled' | ||
| }, | ||
| 'version': '11', | ||
| 'sslEnforcement': 'Enabled', | ||
| 'minimalTlsVersion': 'TLS1_2', | ||
| 'userVisibleState': 'Ready', | ||
| 'fullyQualifiedDomainName': 'server1.postgres.database.azure.com', | ||
| 'earliestRestoreDate': '2021-03-10T12:45:13.233+00:00', | ||
| 'replicationRole': '', | ||
| 'masterServerId': '', | ||
| 'byokEnforcement': 'Disabled', | ||
| 'privateEndpointConnections': [ | ||
| { | ||
| 'id': '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Sql/servers/test-server/privateEndpointConnections/test-endpoint', | ||
| 'provisioningState': 'Ready' | ||
| } | ||
| ], | ||
| 'infrastructureEncryption': 'Disabled', | ||
| 'publicNetworkAccess': 'Enabled' | ||
| } | ||
|
|
||
| ]; | ||
|
|
||
| const createCache = (listPostgres) => { | ||
| return { | ||
| servers: { | ||
| listPostgres: { | ||
| 'eastus': { | ||
| data: listPostgres | ||
| } | ||
| } | ||
| } | ||
| }; | ||
| }; | ||
|
|
||
| describe('privateEndpoints', function() { | ||
| describe('run', function() { | ||
| it('should give passing result if no servers', function(done) { | ||
| const cache = createCache({}); | ||
| privateEndpoints.run(cache, {}, (err, results) => { | ||
| expect(results.length).to.equal(1); | ||
| expect(results[0].status).to.equal(0); | ||
| expect(results[0].message).to.include('No PostgreSQL servers found'); | ||
| expect(results[0].region).to.equal('eastus'); | ||
| done(); | ||
| }); | ||
| }); | ||
|
|
||
| it('should give failing result if private endpoints are not configured', function(done) { | ||
| const cache = createCache([listPostgres[0]]); | ||
| privateEndpoints.run(cache, {}, (err, results) => { | ||
| expect(results.length).to.equal(1); | ||
| expect(results[0].status).to.equal(2); | ||
| expect(results[0].message).to.include('Private Endpoints are not configured for the PostgreSQL Server'); | ||
| expect(results[0].region).to.equal('eastus'); | ||
| done(); | ||
| }); | ||
| }); | ||
|
|
||
| it('should give should give passing result if private endpoints are configured', function(done) { | ||
| const cache = createCache([listPostgres[1]]); | ||
| privateEndpoints.run(cache, {}, (err, results) => { | ||
| expect(results.length).to.equal(1); | ||
| expect(results[0].status).to.equal(0); | ||
| expect(results[0].message).to.include('Private Endpoints are configured for the PostgreSQL Server'); | ||
| expect(results[0].region).to.equal('eastus'); | ||
| done(); | ||
| }); | ||
| }); | ||
|
|
||
| it('should give UnKnown result if unable to query postgreSQL Server', function(done) { | ||
| const cache = createCache(null); | ||
| privateEndpoints.run(cache, {}, (err, results) => { | ||
| expect(results.length).to.equal(1); | ||
| expect(results[0].status).to.equal(3); | ||
| expect(results[0].message).to.include('Unable to query for PostgreSQL servers: '); | ||
| expect(results[0].region).to.equal('eastus'); | ||
| done(); | ||
| }); | ||
| }); | ||
|
|
||
| }) | ||
| }) |