turbot/azure_compliance

Query: network_interface_ip_forwarding_disabled

Usage

powerpipe query azure_compliance.query.network_interface_ip_forwarding_disabled

SQL

with vm_using_nic as (
select
id as vm_id,
name as vm_name,
resource_group,
_ctx,
region,
subscription_id,
b ->> 'id' as nic_id
from
azure_compute_virtual_machine as c,
jsonb_array_elements(network_interfaces) as b
)
select
v.vm_id as resource,
case
when i.enable_ip_forwarding then 'alarm'
else 'ok'
end as status,
case
when i.enable_ip_forwarding then v.vm_name || ' using ' || i.name || ' network interface enabled with IP forwarding.'
else v.vm_name || ' using ' || i.name || ' network interface disabled with IP forwarding.'
end as reason
, v.resource_group as resource_group
, sub.display_name as subscription
from
azure_subscription as sub,
vm_using_nic as v
left join azure_network_interface as i on i.id = v.nic_id;

Controls

The query is being used by the following controls: