Control: Gateway subnets should not be configured with a network security group
Description
Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet.
Usage
Run the control in your terminal:
powerpipe control run terraform_azure_compliance.control.network_security_group_not_configured_gateway_subnets
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run terraform_azure_compliance.control.network_security_group_not_configured_gateway_subnets --share
SQL
This control uses a named query:
with all_subnet as ( select * from terraform_resource where type = 'azurerm_subnet'), network_security_group_association as ( select * from terraform_resource where type = 'azurerm_subnet_network_security_group_association')select a.address as resource, case when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is not null then 'alarm' when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is null then 'ok' else 'skip' end as status, split_part(a.address, '.', 2) || case when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is not null then ' Gateway subnet configured with network security group' when (a.attributes_std ->> 'name')::text = 'GatewaySubnet' and (s.attributes_std ->> 'subnet_id') is null then ' Gateway subnet not configured with network security group' else ' not of gateway subnet type' end || '.' reason , a.path || ':' || a.start_linefrom all_subnet as a left join network_security_group_association as s on a.name = ( split_part((s.attributes_std ->> 'subnet_id'), '.', 2));