turbot/steampipe-mod-terraform-azure-compliance

Control: Gateway subnets should not be configured with a network security group

Description

Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.network_security_group_not_configured_gateway_subnets

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.network_security_group_not_configured_gateway_subnets --share

SQL

This control uses a named query:

with all_subnet as (
select
*
from
terraform_resource
where
type = 'azurerm_subnet'
), network_security_group_association as (
select
*
from
terraform_resource
where
type = 'azurerm_subnet_network_security_group_association'
)
select
a.address as resource,
case
when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is not null then 'alarm'
when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is null then 'ok'
else 'skip'
end as status,
split_part(a.address, '.', 2) || case
when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is not null then ' Gateway subnet configured with network security group'
when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is null then ' Gateway subnet not configured with network security group'
else ' not of gateway subnet type'
end || '.' reason
, a.path || ':' || a.start_line
from
all_subnet as a
left join network_security_group_association as s on a.name = ( split_part((s.attributes_std ->> 'subnet_id'), '.', 2));

Tags