id: azure-blob-immutable-not-enabled
info:
  name: Azure Blob Immutable Storage Not Enabled
  author: princechaddha
  severity: high
  description: |
    Ensure that Immutable Blob Storage feature is enabled for Microsoft Azure Storage blob containers that hold sensitive and business-critical information. Immutable Blob Storage enables you to store critical, production data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-specified time interval. Azure blob objects can be created and read, but not modified or deleted, for the duration of the retention interval configured. The feature supports two types of policies that you can apply to a container for retaining the data within the specified container in a non-modifiable and delete-protected state.
  impact: |
    Failure to enable Immutable Blob Storage can result in critical data being modified or deleted, which could lead to regulatory compliance issues and potential data loss.
  remediation: |
    Apply an appropriate time-based immutability policy or a legal hold policy to your Azure Storage blob containers to protect sensitive and business-critical data from being modified or deleted.
  reference:
    - https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage
  tags: cloud,devops,azure,microsoft,azure-blob-storage,azure-cloud-config

flow: |
  code(1);
  for (let AccountData of iterate(template.accountList)) {
    AccountData = JSON.parse(AccountData);
    set("name", AccountData.Name);
    code(2);
    let containerList = template.code_2_response;
    let ContainerData = JSON.parse(containerList);
    ContainerData.forEach(container => {
      set("currentContainer", JSON.stringify(container));
      javascript(1);
    });
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az storage account list --query '[*].{"Name":name}'

    extractors:
      - type: json
        name: accountList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az storage container list --account-name "$name" --query '[*].{"ContainerName":name, "TimeBasedRetentionPolicy":properties.hasImmutabilityPolicy, "LegalHoldPolicy": properties.hasLegalHold}'

javascript:
  - code: |
          let container = JSON.parse(template.currentContainer);
          if (!container.TimeBasedRetentionPolicy && !container.LegalHoldPolicy) {
            let result = `Blob container '${container.ContainerName}' in account '${template.name}' does not have Immutable Blob Storage enabled.`;
            Export(result);
          }
    extractors:
      - type: dsl
        dsl:
          - response
# digest: 490a0046304402202f47bb9c98de7e67b628e99ed6429cf57c274bd314a383ffbd01ad4c1275ab82022054631aa9a4a8925752d47c9ada309e4c7c228416b5afeecf186ed555f956c9e8:922c64590222798bb761d5b6d8e72950