Merge pull request #2033 from AkhtarAmir/H-plugin/batch-account-aad-e…

…nabled

Plugin Batch Account AAD Auth enabled

exports.js

@@ -1191,6 +1191,7 @@ module.exports = {
 
         'batchAccountCmkEncrypted'      : require(__dirname + '/plugins/azure/batchAccounts/batchAccountCmkEncrypted.js'),
         'batchAccountDiagnosticLogs'    : require(__dirname + '/plugins/azure/batchAccounts/batchAccountDiagnosticLogs.js'),
+        'batchAccountsAADEnabled'       : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsAADEnabled.js'),
         'batchAccountsHasTags'          : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsHasTags.js'),
         'batchAccountsPublicAccess'     : require(__dirname + '/plugins/azure/batchAccounts/batchAccountsPublicAccess.js'),
 

plugins/azure/batchAccounts/batchAccountsAADEnabled.js

@@ -0,0 +1,57 @@
+var async = require('async');
+var helpers = require('../../../helpers/azure/');
+
+module.exports = {
+    title: 'Batch Account AAD Auth Enabled',
+    category: 'Batch',
+    domain: 'Compute',
+    severity: 'Medium',
+    description: 'Ensures that Batch account has Azure Active Directory (AAD) authentication mode enabled.',
+    more_info: 'Enabling Azure Active Directory (AAD) authentication for Batch account ensures enhanced security by restricting the service API authentication to Microsoft Entra ID that prevents access through less secure shared key methods, thereby safeguarding batch resources from unauthorized access.',
+    recommended_action: 'Enable Active Directory authentication mode for all Batch accounts.',
+    link: 'https://learn.microsoft.com/en-us/azure/batch/batch-aad-auth',
+    apis: ['batchAccounts:list'],
+    realtime_triggers: ['microsoftbatch:batchaccounts:write', 'microsoftbatch:batchaccounts:delete'],
+
+    run: function(cache, settings, callback) {
+        var results = [];
+        var source = {};
+        var locations = helpers.locations(settings.govcloud);
+
+        async.each(locations.batchAccounts, function(location, rcb) {
+
+            var batchAccounts = helpers.addSource(cache, source,
+                ['batchAccounts', 'list', location]);
+
+            if (!batchAccounts) return rcb();
+
+            if (batchAccounts.err || !batchAccounts.data) {
+                helpers.addResult(results, 3, 'Unable to query for Batch accounts: ' + helpers.addError(batchAccounts), location);
+                return rcb();
+            }
+            if (!batchAccounts.data.length) {
+                helpers.addResult(results, 0, 'No existing Batch accounts found', location);
+                return rcb();
+            }
+
+            for (let batchAccount of batchAccounts.data) {
+                if (!batchAccount.id) continue;
+
+                let found = batchAccount.allowedAuthenticationModes && 
+                            batchAccount.allowedAuthenticationModes.length?
+                    batchAccount.allowedAuthenticationModes.some(mode => mode.toUpperCase() === 'AAD') : false;
+
+                if (found) {
+                    helpers.addResult(results, 0, 'Batch account has Active Directory authentication enabled', location, batchAccount.id);
+                } else {
+                    helpers.addResult(results, 2, 'Batch account does not have Active Directory authentication enabled', location, batchAccount.id);
+                }
+
+            }
+
+            rcb();
+        }, function() {
+            callback(null, results, source);
+        });
+    }
+};

plugins/azure/batchAccounts/batchAccountsAADEnabled.spec.js

@@ -0,0 +1,94 @@
+
+var expect = require('chai').expect;
+var batchAccountsAADEnabled = require('./batchAccountsAADEnabled');
+
+const batchAccounts = [
+    {
+        "id": "/subscriptions/1234566/resourceGroups/dummy/providers/Microsoft.Batch/batchAccounts/test",
+        "name": "test",
+        "type": "Microsoft.Batch/batchAccounts",
+        "location": "eastus",
+        "accountEndpoint": "test.eastus.batch.azure.com",
+        "nodeManagementEndpoint": "123456789.eastus.service.batch.azure.com",
+        "allowedAuthenticationModes": ["SharedKey", "AAD", "TaskAuthenticationToken"]
+    },
+    {
+        "id": "/subscriptions/1234566/resourceGroups/dummy/providers/Microsoft.Batch/batchAccounts/test",
+        "name": "test",
+        "type": "Microsoft.Batch/batchAccounts",
+        "location": "eastus",
+        "accountEndpoint": "test.eastus.batch.azure.com",
+        "nodeManagementEndpoint": "123456789.eastus.service.batch.azure.com",
+    },
+];
+
+const createCache = (batchAccounts) => {
+    return {
+        batchAccounts: {
+            list: {
+                'eastus': {
+                    data: batchAccounts
+                }
+            }
+        }
+    }
+};
+
+const createErrorCache = () => {
+    return {
+        batchAccounts: {
+            list: {
+                'eastus': {}
+            }
+        }
+    };
+};
+
+describe('batchAccountsAADEnabled', function () {
+    describe('run', function () {
+
+        it('should give unknown result if unable to query for Batch accounts:', function (done) {
+            const cache = createCache(null);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query for Batch accounts:');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give passing result if no Batch account exist', function (done) {
+            const cache = createCache([]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('No existing Batch accounts found');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give passing result if Batch account is configured with AAD Authentication', function (done) {
+            const cache = createCache([batchAccounts[0]]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('Batch account has Active Directory authentication enabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give failing result if Batch account is not configured with AAD Authentication', function (done) {
+            const cache = createCache([batchAccounts[1]]);
+            batchAccountsAADEnabled.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].message).to.include('Batch account does not have Active Directory authentication enabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+    });
+});