#!/bin/sh

# shellcheck disable=SC1090
# shellcheck disable=SC2034
# shellcheck disable=SC2154

# audit_azure_storage_logging
#
# Check Azure Storage Logging
#
# 17.8  Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests
# 17.9  Ensure Storage Logging is Enabled for Blob  Service for 'Read', 'Write', and 'Delete' requests
# 17.10 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests
#
# Refer to Section(s) 17.8 Page(s) 205-13 Microsoft Azure Storage Services Benchmark v1.0.0
#
# Refer to CIS Microsoft Azure Compute Services Benchmark
#.

audit_azure_storage_logging () {
  print_function "audit_azure_storage_logging"
  check_message  "Azure Storage Logging"
  retention_days="90"
  log_value="rwd"
  command="az storage account list --query \"[].name\" --output tsv"
  command_message    "${command}"
  s_accounts=$( eval "${command}" )
  if [ -z "${s_accounts}" ]; then
    info_message "No Storage Accounts found"
    return
  fi
  for s_account in ${s_accounts}; do
    # 17.8  Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests
    # 17.9  Ensure Storage Logging is Enabled for Blob  Service for 'Read', 'Write', and 'Delete' requests
    # 17.10 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests
    for service_type in queue blob table; do
      for request_type in read write delete; do
        check_azure_storage_logging_value "Storage Logging" "${s_account}" "${service_type}" "[].${service_type}.${request_type}"      "eq" "true"              ""
      done
      check_azure_storage_logging_value   "Storage Logging" "${s_account}" "${service_type}" "[].${service_type}.retentionPolicy.days" "eq" "${retention_days}" "${log_value}"
    done
  done
}
