SAAS-20313/Dns-management-domain

exports.js

@@ -989,7 +989,9 @@ module.exports = {
         'eventHubMinimumTLSversion'     : require(__dirname + '/plugins/azure/eventhub/eventHubMinimumTLSversion.js'),
 
         'accessLogsEnabled'             : require(__dirname + '/plugins/azure/frontdoor/accessLogsEnabled.js'),
-        'frontDoorMinimumTlsVersion'    : require(__dirname + '/plugins/azure/frontdoor/frontDoorMinimumTlsVersion.js')
+        'frontDoorMinimumTlsVersion'    : require(__dirname + '/plugins/azure/frontdoor/frontDoorMinimumTlsVersion.js'),
+        'frontDoorAzureManagedDomain'   : require(__dirname + '/plugins/azure/frontdoor/frontDoorAzureManagedDomain.js')
+
     },
     github: {
         'publicKeysRotated'             : require(__dirname + '/plugins/github/users/publicKeysRotated.js'),
@@ -1478,4 +1480,4 @@ module.exports = {
         'securityNotificationsEnabled'  : require(__dirname + '/plugins/alibaba/securitycenter/securityNotificationsEnabled.js'),
         'vulnerabilityScanEnabled'      : require(__dirname + '/plugins/alibaba/securitycenter/vulnerabilityScanEnabled.js')
     }
-};
+};

plugins/azure/frontdoor/frontDoorAzureManagedDomain.js

@@ -0,0 +1,73 @@
+var async = require('async');
+var helpers = require('../../../helpers/azure');
+
+module.exports = {
+    title: 'Front Door Azure Managed DNS',
+    category: 'Front Door',
+    domain: 'Content Delivery',
+    description: 'Ensures that Front Door standard and premium profile custom domains are configured to use Azure Managed DNS',
+    more_info: 'Azure Managed DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure.',
+    recommended_action: 'Ensure that Non-Azure validated domains for Front Door profiles are using Azure Managed DNS.',
+    link: 'https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain?tabs=powershell#azure-front-door-managed-certificates-for-non-azure-pre-validated-domains',
+    apis: ['profiles:list', 'customDomain:listByFrontDoorProfiles'],
+
+    run: function(cache, settings, callback) {
+        const results = [];
+        const source = {};
+        const locations = helpers.locations(settings.govcloud);
+        async.each(locations.profiles, (location, rcb) => {
+            const profiles = helpers.addSource(cache, source,
+                ['profiles', 'list', location]);
+
+            if (!profiles) return rcb();
+
+            if (profiles.err || !profiles.data) {
+                helpers.addResult(results, 3,
+                    'Unable to query Azure Front Door profiles: ' + helpers.addError(profiles), location);
+                return rcb();
+            }
+
+            if (!profiles.data.length) {
+                helpers.addResult(results, 0, 'No existing Azure Front Door profiles found', location);
+                return rcb();
+            }
+
+            var frontDoorProfile = false;
+            profiles.data.forEach(function(profile) {
+                if (!profile.id || profile.kind != 'frontdoor') return;
+
+                frontDoorProfile = true;
+                var failingDomains = {};
+                const customDomains = helpers.addSource(cache, source,
+                    ['customDomain', 'listByFrontDoorProfiles', location, profile.id]);
+                if (!customDomains || customDomains.err || !customDomains.data) {
+                    helpers.addResult(results, 3,
+                        'Unable to query Front Door custom domains: ' + helpers.addError(customDomains), location, profile.id);
+                } else if (!customDomains.data.length) {
+                    helpers.addResult(results, 0, 'No existing Front Door custom domains found', location, profile.id);
+                } else {
+                    failingDomains = customDomains.data.filter(customDomain => {
+                        return (!customDomain.azureDnsZone);
+                    }).map(function(customDomain) {
+                        return customDomain.name; 
+                    });
+
+                    if (failingDomains.length){
+                        helpers.addResult(results, 2,
+                            `Front Door profile custom domains are not using Azure managed DNS: ${failingDomains.join(', ')}`, location, profile.id);
+                    } else {
+                        helpers.addResult(results, 0,
+                            'Front Door profile custom domains are using Azure managed DNS', location, profile.id);
+                    }
+                }
+            });
+
+            if (!frontDoorProfile) {
+                helpers.addResult(results, 0, 'No existing Azure Front Door profiles found', location);
+            }
+            rcb();
+        }, function() {
+            callback(null, results, source);
+        });
+    }
+};

plugins/azure/frontdoor/frontDoorAzureManagedDomain.spec.js

@@ -0,0 +1,233 @@
+var expect = require('chai').expect;
+var frontDoorAzureManagedDomain = require('./frontDoorAzureManagedDomain.js');
+
+const profiles = [
+    {
+        "id": "/subscriptions/234/resourcegroups/sadeedrg/providers/Microsoft.Cdn/profiles/test-profile",
+        "type": "Microsoft.Cdn/profiles",
+        "name": "test-profile",
+        "location": "Global",
+        "kind": "frontdoor",
+        "tags": {},
+        "sku": {
+            "name": "Standard_Microsoft"
+        },
+        "properties": {
+            "resourceState": "Active",
+            "provisioningState": "Succeeded"
+        }
+    },
+    {
+        "id": "/subscriptions/234/resourcegroups/sadeedrg/providers/Microsoft.Cdn/profiles/test-profile",
+        "type": "Microsoft.Cdn/profiles",
+        "name": "test-profile",
+        "location": "Global",
+        "kind": "frontdoor",
+        "tags": {},
+        "sku": {
+            "name": "Standard_Microsoft"
+        },
+        "properties": {
+            "resourceState": "Active",
+            "provisioningState": "Succeeded"
+        }
+    },
+    {
+        "id": "/subscriptions/26a1a07e-06dd-4892-92c9-e4996b0fc546/resourcegroups/meerab-rg/providers/Microsoft.Cdn/profiles/mehak-fd",
+        "type": "Microsoft.Cdn/profiles",
+        "name": "mehak-fd",
+        "location": "Global",
+        "kind": "frontdoor",
+        "tags": {},
+        "sku": {
+            "name": "Premium_AzureFrontDoor"
+        },
+        "properties": {
+            "originResponseTimeoutSeconds": 60,
+            "frontDoorId": "40590271-c2c4-4264-8061-45b884a91a70",
+            "resourceState": "Active",
+            "provisioningState": "Succeeded"
+        }
+    }
+];
+
+
+const customDomain = [
+    {
+        "id": "/subscriptions/26a1a07e-06dd-4892-92c9-e4996b0fc546/resourcegroups/meerab-rg/providers/Microsoft.Cdn/profiles/mehak-fd/customdomains/test-naim-app-srvenv-appserviceenvironment-net",
+        "type": "Microsoft.Cdn/profiles/customdomains",
+        "name": "test-naim-app-srvenv-appserviceenvironment-net",
+        "hostName": "test.naim-app-srvenv.appserviceenvironment.net",
+        "tlsSettings": {
+            "certificateType": "ManagedCertificate",
+            "minimumTlsVersion": "TLS12",
+            "secret": null
+        },
+        "validationProperties": {
+            "validationToken": "mh0nl1m0syywj6m6bt5s9hksxw1sk4h9",
+            "expirationDate": "2023-08-07T20:07:11.5302594+00:00"
+        },
+        "azureDnsZone": {
+            "id": "/subscriptions/a7ddb462-bd4a-4c99-bda2-e008b2ab62f8/resourceGroups/naim-resources/providers/Microsoft.Network/dnszones/naim-app-srvenv.appserviceenvironment.net"
+        },
+        "domainValidationState": "Pending",
+        "preValidatedCustomDomainResourceId": null,
+        "provisioningState": "Succeeded",
+        "deploymentStatus": "NotStarted"
+    },
+    {
+
+    },
+    {
+        "id": "/subscriptions/26a1a07e-06dd-4892-92c9-e4996b0fc546/resourcegroups/meerab-rg/providers/Microsoft.Cdn/profiles/mehak-fd/customdomains/test-naim-app-srvenv-appserviceenvironment-net",
+        "type": "Microsoft.Cdn/profiles/customdomains",
+        "name": "test-naim-app-srvenv-appserviceenvironment-net",
+        "hostName": "test.naim-app-srvenv.appserviceenvironment.net",
+        "tlsSettings": {
+            "certificateType": "ManagedCertificate",
+            "minimumTlsVersion": "TLS1",
+            "secret": null
+        },
+        "validationProperties": {
+            "validationToken": "mh0nl1m0syywj6m6bt5s9hksxw1sk4h9",
+            "expirationDate": "2023-08-07T20:07:11.5302594+00:00"
+        },
+        "azureDnsZone": null,
+        "domainValidationState": "Pending",
+        "preValidatedCustomDomainResourceId": null,
+        "provisioningState": "Succeeded",
+        "deploymentStatus": "NotStarted"
+    },
+]
+
+const createCache = (profiles, customDomains) => {
+    let customDomain = {};
+    if (profiles.length) {
+        customDomain[profiles[0].id] = {
+            data: customDomains
+        };
+    }
+
+
+    return {
+        profiles: {
+            list: {
+                'global': {
+                    data: profiles
+                }
+            }
+        },
+        customDomain: {
+            listByFrontDoorProfiles: {
+                'global': customDomain
+            }
+        }
+    };
+};
+
+const createErrorCache = (key) => {
+    if (key == 'profile') {
+        return {
+            profiles: {
+                list: {
+                    'global': {}
+                }
+            }
+        };
+    } else if (key === 'customDomains') {
+        return {
+            profiles: {
+                list: {
+                    'global': {
+                        data: [profiles[0]]
+                    }
+                }
+            },
+            customDomains: {
+                listByFrontDoorProfiles: {
+                    'global': {}
+                }
+            }
+        };
+    } else {
+        const profileId = (profiles && profiles.length) ? profiles[0].id : null;
+        const customDomains = (customDomains && customDomains.length) ? customDomains[0].id : null;
+        return {
+            profiles: {
+                list: {
+                    'global': {
+                        data: [profiles[0]]
+                    }
+                }
+            },
+            diagnosticSettings: {
+                customDomains: {
+                    'global': {
+                        data: {}
+                    }
+                }
+            }
+        };
+    }
+};
+
+describe('frontDoorAzureManagedDomain', function () {
+    describe('run', function () {
+
+        it('should give unknown if Unable to query Azure Front Door profiles:', function (done) {
+            const cache = createErrorCache('profile');
+            frontDoorAzureManagedDomain.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query Azure Front Door profiles');
+                expect(results[0].region).to.equal('global');
+                done();
+            });
+        });
+
+
+        it('should give unknown if Unable to query Front Door custom domains:', function (done) {
+            const cache = createErrorCache('customDomains');
+            frontDoorAzureManagedDomain.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query Front Door custom domains:');
+                expect(results[0].region).to.equal('global');
+                done();
+            });
+        });
+
+        it('should give pass if No existing Front Door custom domains found', function (done) {
+            const cache = createCache([profiles[0]], customDomain[1]);
+            frontDoorAzureManagedDomain.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('No existing Front Door custom domains found');
+                expect(results[0].region).to.equal('global');
+                done();
+            });
+        });
+
+        it('should give pass result if AFD profile custom domain is using Azure managed DNS', function (done) {
+            const cache = createCache([profiles[2]], [customDomain[0]]);
+            frontDoorAzureManagedDomain.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('Front Door profile custom domains are using Azure managed DNS');
+                expect(results[0].region).to.equal('global');
+                done();
+            });
+        });
+
+        it('should give fail result if AFD profile custom domain is not using Azure managed DNS', function (done) {
+            const cache = createCache([profiles[2]], [customDomain[2]]);
+            frontDoorAzureManagedDomain.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].message).to.include('Front Door profile custom domains are not using Azure managed DNS:');
+                expect(results[0].region).to.equal('global');
+                done();
+            });
+        });
+    });
+});