56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
id: azure-openai-private-endpoints-unconfigured
|
|
info:
|
|
name: Azure OpenAI Service Instances Not Using Private Endpoints
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
To reduce the risk of exposure to external threats and strengthens overall security for your Azure OpenAI interactions, ensure that your Azure OpenAI service instances are accessed exclusively through private endpoint connections.
|
|
impact: |
|
|
Not using private endpoints for OpenAI service instances can expose them to external threats, compromising the security of your Azure environment.
|
|
remediation: |
|
|
Configure all Azure OpenAI service instances to use private endpoints to enhance security and ensure that these instances are not accessible over the public internet.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview
|
|
tags: cloud,devops,azure,microsoft,openai,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let ServiceInstance of iterate(template.serviceList)) {
|
|
ServiceInstance = JSON.parse(ServiceInstance);
|
|
set("name", ServiceInstance.Name);
|
|
set("resourceGroup", ServiceInstance.ResourceGroup);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az cognitiveservices account list --output json --query '[?(kind==`OpenAI`)].{Name:name, ResourceGroup:resourceGroup}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: serviceList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az cognitiveservices account show --name "$name" --resource-group "$resourceGroup" --query 'properties.privateEndpointConnections'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '[]'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'name + " in " + resourceGroup + " does not have private endpoint connections configured"'
|
|
# digest: 490a0046304402202193979a2311816ab574cf04f464c82c1ebd91b4121e588dfb25464a95d188eb0220237cc1b0d15aa5a8ab279cb9d11f38d146491347d0d0bd8f42fde7b280424c9c:922c64590222798bb761d5b6d8e72950 |