feat(query): implements "Beta - Storage Account Using Unsafe SMB Channel Encryption"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources of type "azurerm_storage_account" has the "share_properties.smb.channel_encryption_type" array set to ["AES-256-GCM"].

• Quoting CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0 page 482:

  • "Implement SMB channel encryption with AES-256-GCM for SMB file shares to ensure data confidentiality and integrity in transit. This method offers strong protection against eavesdropping and man-in-the-middle attacks, safeguarding sensitive information.."
  • "AES-256-GCM encryption enhances the security of data transmitted over SMB channels by safeguarding it from unauthorized interception and tampering."

• In the CIS Benchmark it is also stated that, by default, "the following SMB channel encryption algorithms are allowed: AES-128-CCM, AES-128-GCM, AES-256-GCM". (all "Possible values" from the terraform documentation).

Proposed Changes

• Implemented the missing query.

• The query will flag a "azurerm_storage_account" resource given any one of these 6 scenarios :

  • Undefined "share_properties" block
  • Undefined "share_properties.smb" block
  • Undefined "share_properties.smb.versions" field
  • Having its "share_properties.smb.channel_encryption_type" field set to []
  • Having its "share_properties.smb.channel_encryption_type" field not include the "AES-256-GCM" value
  • Having its "share_properties.smb.channel_encryption_type" include the "AES-256-GCM" value together with other, weaker, AES versions.

• Note the "issueType" will be "MissingAttribute" for the first 3 scenarios and "IncorrectValue" for the last 3.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0