56 lines
2.2 KiB
YAML
56 lines
2.2 KiB
YAML
id: azure-apim-public-access-disabled
|
|
info:
|
|
name: Azure API Management Public Network Access Disabled with Private Endpoint
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Azure API Management services configured with a private endpoint should not be publicly accessible to enhance security by ensuring that the API service instance is only accessible from within your private network, over Azure Private Link, limiting exposure to potential external threats and unauthorized access.
|
|
impact: |
|
|
If public network access is enabled for Azure API Management services with a private endpoint, it may expose sensitive APIs to external threats and unauthorized access, potentially leading to data breaches and other security vulnerabilities.
|
|
remediation: |
|
|
Disable public network access for Azure API Management services that are configured with a private endpoint to ensure they are only accessible via Azure Private Link within the private network.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-private-link
|
|
tags: cloud,devops,azure,microsoft,api-management,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let ServiceData of iterate(template.serviceList)) {
|
|
ServiceData = JSON.parse(ServiceData);
|
|
set("name", ServiceData.name);
|
|
set("resourceGroup", ServiceData.resourceGroup);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az apim list --output json --query '[*].{name:name, resourceGroup:resourceGroup}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: serviceList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az apim show --name "$name" --resource-group "$resourceGroup" --query 'publicNetworkAccess'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'Enabled'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'name + " in resource group " + resourceGroup + " has public network access enabled, which should be disabled."'
|
|
# digest: 490a0046304402207bbd30ab04b847d2afc9435af2b414644d4f6ae0df1047ccf2580a1c596b8a9a02204d5d48b1c9fe4c65cd8c2ea1de2e2d0f63e60796a03f02a394587cb903c1e929:922c64590222798bb761d5b6d8e72950 |