id: azure-openai-public-access-disabled
info:
  name: Azure OpenAI Public Network Access Not Disabled
  author: princechaddha
  severity: high
  description: |
    Ensure that public network access (i.e. all network access) to Microsoft Azure OpenAI service instances is disabled in order to enhance security by preventing unauthorized access.
  impact: |
    Enabling public network access to Azure OpenAI service instances can lead to unauthorized access, compromising the security and integrity of the instances.
  remediation: |
    Configure the Azure OpenAI service instances to disable public network access to secure them against unauthorized external access.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/cognitive-services-apis-create-account-cli?tabs=windows
  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

flow: |
  code(1);
  for (let ServiceData of iterate(template.serviceList)) {
    ServiceData = JSON.parse(ServiceData);
    set("name", ServiceData.name);
    set("resourceGroup", ServiceData.resourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account list --output json --query '[?(kind==`OpenAI`)].{"name":name,"resourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serviceList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account show --name "$name" --resource-group "$resourceGroup" --query '{networkAcls:properties.networkAcls.defaultAction,publicNetworkAccess:properties.publicNetworkAccess}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"networkAcls": "Allow"'
          - '"networkAcls": "null"'

      - type: word
        words:
          - '"publicNetworkAccess": "Enabled"'

    extractors:
      - type: dsl
        dsl:
          - '"$name in $resourceGroup has public network access enabled"'

# digest: 4b0a00483046022100f76c46c4264a3bf40baa855f85ab60367b1415b3322d30660690c626a1f8ad8d022100ae1116fff9546e6fa5855c5f2c7c68c1fad5e3fb6baa65e49635691eca9206d8:922c64590222798bb761d5b6d8e72950