feat: Added queries for Azure CIS for BigQuery - Free

transformations/azure/compliance-free/models/azure_compliance__cis_v1_3_0_free.sql

@@ -1,26 +1,24 @@
-{{ config(enabled=block_bigquery()) }}
-
 with
     aggregated as (
         ({{iam_custom_subscription_owner_roles('cis_v1.3.0','1.21')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_servers('cis_v1.3.0','2.1')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_app_service('cis_v1.3.0','2.2')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_sql_servers('cis_v1.3.0','2.3')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_sql_servers_on_machines('cis_v1.3.0','2.4')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_storage('cis_v1.3.0','2.5')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_k8s('cis_v1.3.0','2.6')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_container_registeries('cis_v1.3.0','2.7')}})
-        union
+        {{ union() }}
         ({{security_defender_on_for_key_vault('cis_v1.3.0','2.8')}})
  )
 select 
-        ('{{ run_started_at }}')::timestamp as policy_execution_time,
+        {{ gen_timestamp() }},
         aggregated.*
 from aggregated

transformations/azure/macros/iam/custom_subscription_owner_roles.sql

@@ -92,6 +92,57 @@ meets_actions AS (
     FROM definition_actions
     GROUP BY _cq_id
 )
+SELECT
+    id                                                             AS resource_id,
+    '{{framework}}' As framework,
+    '{{check_id}}' As check_id,
+    'Ensure That No Custom Subscription Administrator Roles Exist' AS title,
+    subscription_id                                                AS subscription_id,
+    CASE
+        WHEN has_wide_scope AND has_all_action
+        THEN 'fail'
+        ELSE 'pass'
+    END                                                            AS status
+FROM custom_roles 
+    JOIN meets_scopes USING (_cq_id) JOIN meets_actions USING (_cq_id)
+{% endmacro %}
+
+{% macro bigquery__iam_custom_subscription_owner_roles(framework, check_id) %}
+WITH custom_roles AS (
+    SELECT *
+    FROM {{ full_table_name("azure_authorization_role_definitions") }}
+    WHERE JSON_VALUE(properties.type) = 'CustomRole'
+),
+assignable_scopes AS (
+    SELECT
+        _cq_id,
+        JSON_VALUE(scope) AS assignable_scope
+    FROM custom_roles,
+    UNNEST(JSON_EXTRACT_STRING_ARRAY(properties.assignableScopes)) AS scope
+),
+meets_scopes AS (
+    SELECT
+        _cq_id,
+        LOGICAL_OR(assignable_scope = '/' OR REGEXP_CONTAINS(assignable_scope, r'^\/subscriptions\/[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$')) AS has_wide_scope
+    FROM assignable_scopes
+    GROUP BY _cq_id
+),
+--check if definition matches actions
+definition_actions AS (
+    SELECT
+        _cq_id,
+        JSON_VALUE(actions) AS action
+    FROM custom_roles,
+    UNNEST(JSON_EXTRACT_ARRAY(properties.permissions)) AS p,
+    UNNEST(JSON_EXTRACT_STRING_ARRAY(p.actions)) AS actions
+),
+meets_actions AS (
+    SELECT
+        _cq_id,
+        LOGICAL_OR(action = '*') AS has_all_action
+    FROM definition_actions
+    GROUP BY _cq_id
+)
 SELECT
     id                                                             AS resource_id,
     '{{framework}}' As framework,

transformations/azure/macros/security/defender_on_for_app_service.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'AppServices'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_app_service(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for App Service (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'AppServices'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_container_registeries.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'ContainerRegistry'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_container_registeries(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for Container Registries (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'ContainerRegistry'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_k8s.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'KubernetesService'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_k8s(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for Kubernetes (Automatic)' as title,
+  subscription_id,
+  case
+   when JSON_VALUE(properties.pricingTier) = 'Standard'
+   then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'KubernetesService'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_key_vault.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'KeyVaults'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_key_vault(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for Key Vault (Manual)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'KeyVaults'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_servers.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'VirtualMachines'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_servers(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for Servers (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'VirtualMachines'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_sql_servers.sql

@@ -33,3 +33,18 @@ SELECT
 FROM azure_security_pricings asp
 WHERE name = 'SqlServers'
 {% endmacro %}
+
+{% macro bigquery__security_defender_on_for_sql_servers(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+	'Ensure that Azure Defender is set to On for Azure SQL database servers (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'SqlServers'
+{% endmacro %}

transformations/azure/macros/security/defender_on_for_sql_servers_on_machines.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'SqlserverVirtualMachines'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_sql_servers_on_machines(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+'Ensure that Azure Defender is set to On for SQL servers on machines (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'SqlserverVirtualMachines'
 {% endmacro %}

transformations/azure/macros/security/defender_on_for_storage.sql

@@ -32,4 +32,19 @@ SELECT
   end
 FROM azure_security_pricings asp
 WHERE name = 'StorageAccounts'
+{% endmacro %}
+
+{% macro bigquery__security_defender_on_for_storage(framework, check_id) %}
+SELECT
+  id,
+  '{{framework}}' As framework,
+  '{{check_id}}' As check_id,
+  'Ensure that Azure Defender is set to On for Storage (Automatic)' as title,
+  subscription_id,
+  case
+    when JSON_VALUE(properties.pricingTier) = 'Standard'
+    then 'pass' else 'fail'
+  end
+FROM {{ full_table_name("azure_security_pricings") }} asp
+WHERE name = 'StorageAccounts'
 {% endmacro %}