Merge pull request #2069 from AkhtarAmir/FS-Azure/MLRegisteryPlublicA…

…ccess

Fs azure/ml registery plublic access

exports.js

@@ -745,6 +745,7 @@ module.exports = {
         'mlWorkspaceCMKEncrypted'       : require(__dirname + '/plugins/azure/machinelearning/mlWorkspaceCMKEncrypted.js'),
         'workspaceLoggingEnabled'       : require(__dirname + '/plugins/azure/machinelearning/workspaceLoggingEnabled.js'),
         'mlWorkspaceHasTags'            : require(__dirname + '/plugins/azure/machinelearning/mlWorkspaceHasTags.js'),
+        'mlRegistryPublicAccess'        : require(__dirname + '/plugins/azure/machinelearning/mlRegistryPublicAccess.js'),
 
 
         'minimumTlsVersion'             : require(__dirname + '/plugins/azure/redisCache/minimumTlsVersion.js'),

helpers/azure/api.js

@@ -380,7 +380,11 @@ var calls = {
     machineLearning: {
         listWorkspaces: {
             url: 'https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.MachineLearningServices/workspaces?api-version=2024-04-01'
-        }
+        },
+        listRegistries: {
+            url: 'https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.MachineLearningServices/registries?api-version=2024-04-01'
+        },
+
     },
     loadBalancers: {
         listAll: {

plugins/azure/machinelearning/mlRegistryPublicAccess.js

@@ -0,0 +1,56 @@
+var async = require('async');
+var helpers = require('../../../helpers/azure');
+
+module.exports = {
+    title: 'Machine Learning Registry Public Access Disabled',
+    category: 'AI & ML',
+    domain: 'Machine Learning',
+    severity: 'Medium',
+    description: 'Ensures that Azure Machine Learning registries are not publicly accessible.',
+    more_info: 'Disabling public network access for Azure Machine Learning registries helps prevent data leakage risks by ensuring that your registries are not accessible over the public internet. Configuring network isolation with private endpoints prevents the network traffic from going over the public internet and brings Azure Machine Learning registry service to your Virtual network preventing exposure of sensitive data.',
+    recommended_action: 'Ensure that Azure Machine Learning registries have public network access disabled.',
+    link: 'https://learn.microsoft.com/en-us/azure/machine-learning/how-to-registry-network-isolation',
+    apis: ['machineLearning:listRegistries'],
+    realtime_triggers: ['microsoftmachinelearningservices:registries:write','microsoftmachinelearningservices:registries:delete'],
+
+    run: function(cache, settings, callback) {
+        const results = [];
+        const source = {};
+        const locations = helpers.locations(settings.govcloud);
+
+        async.each(locations.machineLearning, function(location, rcb) {
+            var machineLearningRegistries = helpers.addSource(cache, source,
+                ['machineLearning', 'listRegistries', location]);
+
+            if (!machineLearningRegistries) return rcb();
+
+            if (machineLearningRegistries.err || !machineLearningRegistries.data) {
+                helpers.addResult(results, 3,
+                    'Unable to query for Machine Learning registries: ' + helpers.addError(machineLearningRegistries), location);
+                return rcb();
+            }
+
+            if (!machineLearningRegistries.data.length) {
+                helpers.addResult(results, 0, 'No existing Machine Learning registries found', location);
+                return rcb();
+            }
+
+            for (let registry of machineLearningRegistries.data) {
+                if (!registry.id) continue; 
+
+                if (registry.publicNetworkAccess && registry.publicNetworkAccess.toLowerCase()=='disabled') {
+                    helpers.addResult(results, 0,
+                        'Machine Learning registry has public network access disabled', location, registry.id);
+                } else {
+                    helpers.addResult(results, 2,
+                        'Machine Learning registry has public network access enabled', location, registry.id);
+                }
+            }
+
+            rcb();
+        }, function() {
+            // Global checking goes here
+            callback(null, results, source);
+        });
+    }
+};

plugins/azure/machinelearning/mlRegistryPublicAccess.spec.js

@@ -0,0 +1,94 @@
+var expect = require('chai').expect;
+var mlRegistryPublicAccess = require('./mlRegistryPublicAccess');
+
+const registry = [
+    {
+        "id": "/subscriptions/12345667/resourceGroups/test/providers/Microsoft.MachineLearningServices/registries/test1",
+        "name": "test",
+        "type": "Microsoft.MachineLearningServices/registries",
+        "tags": {
+            "test": "test"
+        },
+        "publicNetworkAccess" : "Disabled"
+
+      },
+      {
+        "id": "/subscriptions/12345667/resourceGroups/test/providers/Microsoft.MachineLearningServices/registries/test1",
+        "name": "test",
+        "type": "Microsoft.MachineLearningServices/registries",
+        "publicNetworkAccess" : "Enabled"
+      },
+
+];
+
+const createCache = (registries) => {
+    return {
+        machineLearning: {
+            listRegistries: {
+                'eastus': {
+                    data: registries
+                }
+            }
+        }
+    };
+};
+
+const createErrorCache = () => {
+    return {
+        machineLearning: {
+            listRegistries: {
+                'eastus': {}
+            }
+        }
+    };
+};
+
+describe('mlRegistryPublicAccess', function() {
+    describe('run', function() {
+        it('should give passing result if no Machine Learning registry found', function(done) {
+            const cache = createCache([]);
+            mlRegistryPublicAccess.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('No existing Machine Learning registries found');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give unknown result if unable to query for Machine Learning registry', function(done) {      
+            const cache = createErrorCache();
+            mlRegistryPublicAccess.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(3);
+                expect(results[0].message).to.include('Unable to query for Machine Learning registries: ');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+
+        it('should give passing result if Machine Learning registry has public access disabled', function(done) {
+            const cache = createCache([registry[0]]);
+            mlRegistryPublicAccess.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(0);
+                expect(results[0].message).to.include('Machine Learning registry has public network access disabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+        it('should give failing result if Machine Learning registry does not have  public access disabled', function(done) {
+            const cache = createCache([registry[1]]);
+            mlRegistryPublicAccess.run(cache, {}, (err, results) => {
+                expect(results.length).to.equal(1);
+                expect(results[0].status).to.equal(2);
+                expect(results[0].message).to.include('Machine Learning registry has public network access enabled');
+                expect(results[0].region).to.equal('eastus');
+                done();
+            });
+        });
+
+    });
+});

plugins/azure/machinelearning/workspacePublicAccessDisabled.js

@@ -11,7 +11,7 @@ module.exports = {
     recommended_action: 'Ensure that Azure Machine Learning workspaces have public network access disabled.',
     link: 'https://learn.microsoft.com/en-us/azure/machine-learning/how-to-secure-workspace-vnet',
     apis: ['machineLearning:listWorkspaces'],
-    realtime_triggers: ['microsoftcognitiveservices:accounts:write','microsoftcognitiveservices:accounts:delete'],
+    realtime_triggers: ['microsoft:machinelearningservices:workspaces:write', 'microsoft:machinelearningservices:workspaces:delete'],
 
     run: function(cache, settings, callback) {
         const results = [];