rage.fail

azure-storage-network-acls-property

explicit azure emits HasPolicy

match (record)

{ "field": "properties.networkAcls", "resource_type": "Microsoft.Storage/storageAccounts" }

emit

source type	`ObjectStorage`
target type	`Policy`
source	`<storageAccount node>`
target	`<networkAcls ResourcePolicy node>`

Narrative

{account.name} has networkAcls.defaultAction={networkAcls.defaultAction} with {count(ipRules)} IP rules and {count(virtualNetworkRules)} VNet rules. publicNetworkAccess={properties.publicNetworkAccess}.

Raw rule rules/explicit/azure-storage.yaml

id: azure-storage-network-acls-property
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Storage/storageAccounts
  field: properties.networkAcls
emit:
  source_type: ObjectStorage
  target_type: Policy
  source: <storageAccount node>
  target: <networkAcls ResourcePolicy node>
  api_source: Microsoft.Storage/storageAccounts GET
  evidence_field: properties.networkAcls
  narrative: '{account.name} has networkAcls.defaultAction={networkAcls.defaultAction} with {count(ipRules)}
    IP rules and {count(virtualNetworkRules)} VNet rules. publicNetworkAccess={properties.publicNetworkAccess}.'