id: azure-search-service-managed-identity-disabled
info:
  name: Azure Search Service Managed Identity Not Enabled
  author: princechaddha
  severity: medium
  description: |
    Ensure that your Microsoft Azure Search Service instances have system-assigned managed identities enabled in order to allow secure application access to other Azure resources such as storage accounts and key vaults.
  impact: |
    Not enabling system-assigned managed identities on Azure Search Service instances can lead to insecure access patterns and potential misconfigurations when accessing other Azure resources.
  remediation: |
    Enable system-assigned managed identities on your Azure Search Service instances to secure access to Azure resources.
  reference:
    - https://docs.microsoft.com/en-us/azure/search/search-managed-identities
  tags: cloud,devops,azure,microsoft,azure-search,azure-cloud-config

flow: |
  code(1);
  for (let ResourceGroupName of iterate(template.resourceGroupNames)) {
    set("resourceGroup", ResourceGroupName);
    code(2);
    for (let SearchServiceName of iterate(template.searchServiceNames)) {
      set("name", SearchServiceName);
      code(3);
    }
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az group list --query "[].name"

    extractors:
      - type: json
        name: resourceGroupNames
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az search service list --resource-group "$resourceGroup" --query '[].{Name:name}'

    extractors:
      - type: json
        name: searchServiceNames
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az search service show --name "$name" --resource-group "$resourceGroup" --query '{"ManagedIdentity": identity}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"ManagedIdentity": null'

    extractors:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " does not have managed identity enabled"'
# digest: 4a0a004730450221009802e7dc511290b415a7645c9adfed67f490fbc2a84f6eb82493a55d3e26b6320220423badc61ae0ff1a89bc230ed640ed133a59cd8756ed06c301bfb7fd1fd24673:922c64590222798bb761d5b6d8e72950