#!/bin/sh

# shellcheck disable=SC1090
# shellcheck disable=SC2034
# shellcheck disable=SC2154

# audit_azure_compute_services
#
# Check Azure Compute Services
#
# Refer to Section(s) 3 Page(s) 63-8 CIS Microsoft Azure Foundations Benchmark v5.0.0
# Refer to CIS Microsoft Azure Compute Services Benchmark
#
# 2.1     App Service Apps
# 2.1.1   Ensure 'Java version' is currently supported (if in use) - TBD
# 2.1.2   Ensure 'Python version' is currently supported (if in use) - TBD
# 2.1.3   Ensure 'PHP version' is currently supported (if in use) - TBD
# 2.1.4   Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' - TBD
# 2.1.5   Ensure 'FTP State' is set to 'FTPS only' or 'Disabled' - TBD
# 2.1.6   Ensure 'HTTP version' is set to '2.0' (if in use) - TBD
# 2.1.7   Ensure 'HTTPS Only' is set to 'On' - TBD
# 2.1.8   Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher - TBD
# 2.1.9   Ensure end-to-end TLS encryption is enabled - TBD
# 2.1.10  Ensure 'Remote debugging' is set to 'Off' - TBD
# 2.1.11  Ensure incoming client certificates are enabled and required (if in use) - TBD
# 2.1.12  Ensure 'App Service authentication' is set to 'Enabled' - TBD
# 2.1.13  Ensure managed identities are configured - TBD
# 2.1.14  Ensure public network access is disabled - TBD
# 2.1.15  Ensure App Service plan SKU supports private endpoints - TBD
# 2.1.16  Ensure private endpoints are used to access App Service apps - TBD
# 2.1.17  Ensure private endpoints used to access App Service apps use private DNS zones - TBD
# 2.1.18  Ensure app is integrated with a virtual network - TBD
# 2.1.19  Ensure configuration is routed through the virtual network integration - TBD
# 2.1.20  Ensure all traffic is routed through the virtual network - TBD
# 2.1.21  Ensure cross-origin resource sharing does not allow all origins - TBD
#
# 2.2     App Service Deployment Slots
# 2.2.1   Ensure 'Java version' is currently supported (if in use) - TBD
# 2.2.2   Ensure 'Python version' is currently supported (if in use) - TBD
# 2.2.3   Ensure 'PHP version' is currently supported (if in use) - TBD
# 2.2.4   Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' - TBD
# 2.2.5   Ensure 'FTP State' is set to 'FTPS only' or 'Disabled' - TBD
# 2.2.6   Ensure 'HTTP version' is set to '2.0' (if in use) - TBD
# 2.2.7   Ensure 'HTTPS Only' is set to 'On' - TBD
# 2.2.8   Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher - TBD
# 2.2.9   Ensure end-to-end TLS encryption is enabled - TBD
# 2.2.10  Ensure 'Remote debugging' is set to 'Off' - TBD
# 2.2.11  Ensure incoming client certificates are enabled and required (if in use) - TBD
# 2.2.12  Ensure 'App Service authentication' is set to 'Enabled' - TBD
# 2.2.13  Ensure managed identities are configured - TBD
# 2.2.14  Ensure deployment slot is integrated with a virtual network - TBD
# 2.2.15  Ensure configuration is routed through the virtual network integration - TBD
# 2.2.16  Ensure all traffic is routed through the virtual network - TBD
# 2.2.17  Ensure cross-origin resource sharing does not allow all origins - TBD
# 
# 2.3     Function Apps
# 2.3.1   Ensure 'Java version' is currently supported (if in use) - TBD
# 2.3.2   Ensure 'Python version' is currently supported (if in use) - TBD
# 2.3.3   Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' - TBD
# 2.3.5   Ensure 'HTTP version' is set to '2.0' (if in use) - TBD
# 2.3.6   Ensure 'HTTPS Only' is set to 'On' - TBD
# 2.3.7   Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher - TBD
# 2.3.8   Ensure end-to-end TLS encryption is enabled - TBD
# 2.3.9   Ensure 'Remote debugging' is set to 'Off' - TBD
# 2.3.10  Ensure incoming client certificates are enabled and required (if in use) - TBD
# 2.3.11  Ensure 'App Service authentication' is set to 'Enabled' - TBD
# 2.3.12  Ensure managed identities are configured - TBD
# 2.3.13  Ensure public network access is disabled - TBD
# 2.3.14  Ensure function app is integrated with a virtual network - TBD
# 2.3.15  Ensure configuration is routed through the virtual network integration - TBD
# 2.3.16  Ensure all traffic is routed through the virtual network - TBD
# 2.3.17  Ensure cross-origin resource sharing does not allow all origins - TBD
#
# 2.4     Functions Deployment Slots
# 2.4.1   Ensure 'Java version' is currently supported (if in use) - TBD
# 2.4.2   Ensure 'Python version' is currently supported (if in use) - TBD
# 2.4.3   Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' - TBD
# 2.4.4   Ensure 'FTP state' is set to 'FTPS only' or 'Disabled' - TBD
# 2.4.5   Ensure 'HTTP version' is set to '2.0' (if in use) - TBD
# 2.4.6   Ensure 'HTTPS Only' is set to 'On' - TBD
# 2.4.7   Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher - TBD
# 2.4.8   Ensure end-to-end TLS encryption is enabled - TBD
# 2.4.9   Ensure 'Remote debugging' is set to 'Off' - TBD
# 2.4.10  Ensure incoming client certificates are enabled and required (if in use) - TBD
# 2.4.11  Ensure managed identities are configured - TBD
# 2.4.12  Ensure public network access is disabled - TBD
# 2.4.13  Ensure deployment slot is integrated with a virtual network - TBD
# 2.4.14  Ensure configuration is routed through the virtual network integration - TBD
# 2.4.15  Ensure all traffic is routed through the virtual network - TBD
# 2.4.16  Ensure cross-origin resource sharing does not allow all origins - TBD
# 2.5     Ensure Azure Key Vaults are Used to Store Secrets - TBD
# 2.6     Ensure App Service Environment is deployed with an internal load balancer - TBD
# 2.7     Ensure App Service Environment is provisioned with v3 or higher - TBD
# 2.8     Ensure App Service Environment has internal encryption enabled - TBD
# 2.9     Ensure App Service Environment has TLS 1.0 and 1.1 disabled - TBD
#
# 3.      Azure Container Instances
# 3.1     Ensure Private Virtual Networks are used for Container Instances - TBD
# 3.2     Ensure a Managed Identity is used for interactions with other Azure services - TBD
# 3.3     Ensure the principle of least privilege is used when assigning roles to a Managed Identity - TBD
#
# 4.      Azure CycleCloud
# 4.1     Ensure SSL is configured for CycleCloud
#
# 5.      Azure Dedicated Host
#
# 6.      Azure Functions
#
# 7.      Azure Kubernetes Service
#
# 8.      Azure Quantum
#
# 9.      Azure Service Fabric
#
# 10.     Azure Spot Virtual Machines
#
# 11.     Azure Spring Apps
#
# 12.     Azure Virtual Desktop
#
# 13.     Azure VM Image Builder
#
# 14.     Azure VMware Solution
#
# 15.     Azure Batch
# 15.1    Ensure Batch account is set to use customer-managed keys to encrypt data - TBD
# 15.2    Ensure Batch pools disk encryption is set enabled - TBD
# 15.3    Ensure local authentication methods for accounts are disabled - TBD
# 15.4    Ensure Private endpoints are considered for Batch accounts - TBD
# 15.5    Ensure public network access is disabled for Batch accounts - TBD
# 15.6    Ensure private DNS zones for private endpoints that connect to Batch accounts are configured - TBD
# 15.7    Ensure Diagnostics settings logs for Batch accounts are enabled - TBD
#
# 16.     Linux Virtual Machines
#
# 17.     SQL Server on Azure Virtual Machines
#
# 18.     Static Web Apps
#
# 19.     VM Scale Sets
#
# 20.     Virtual Machines
# 20.1    Ensure Virtual Machines are utilizing Managed Disks
# 20.2    Ensure that 'OS and Data' disks are encrypted with 'Customer Managed Key' (CMK)
# 20.3    Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
# 20.4    Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks'
# 20.5    Ensure that 'Enable Data Access Authentication Mode' is 'Checked'
# 20.6    Ensure that Only Approved Extensions Are Installed
# 20.7    Ensure that Endpoint Protection for all Virtual Machines is installed
# 20.8    [Legacy] Ensure that VHDs are Encrypted
# 20.9    Ensure only MFA enabled identities can access privileged Virtual Machine 
# 20.10   Ensure Trusted Launch is enabled on Virtual Machines 
# 20.11   Ensure that encryption at host is enabled
#
# Refer to Section(s) 2-20 Page(s) 22-341 CIS Microsoft Azure Compute Services Benchmark v2.0.0
#
# This requires the Azure CLI to be installed and configured
#.

audit_azure_compute_services () {
  print_function "audit_azure_compute_services"
  check_message  "Azure Compute Services"
  audit_azure_app_service_apps
  audit_azure_app_service_deployment_slots
  audit_azure_function_apps
  audit_azure_function_deployment_slots
  audit_azure_key_vault_certificates
  audit_azure_key_vault_secrets
  audit_azure_app_service_ase
  audit_azure_container_instances
  audit_azure_cycle_cloud
  audit_azure_batch
  audit_azure_vms
}
