feat(query): implements "Beta - Containers Without Soft Delete"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources of type "azurerm_storage_account" configure a value of 7 to 365 on their "blob_properties.container_delete_retention_policy.days" field.

• Quoting CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0 page 489: "Containers can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting a container results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if containers are deleted from the storage account, the containers are recoverable for a specific period of time, which is defined in the "Retention policies," ranging from 7 to 365 days."

• Through the Terraform documentation for the resource we can see a "container_delete_retention_policy" block left empty will assume the default value of 7 for the missing "days" field. With this all we have to do is ensure the "delete_retention_policy" block is defined and that the value associated with the "days" field, if set, is higher than 6.

Proposed Changes

• Implemented the missing query.

• The query will flag any "azurerm_storage_account" resource that does not set the "blob_properties" block, or does set it but does not set a "container_delete_retention_policy" block within. Additionally it will flag if the "days" field is set to a value lower than 6.

• Note that a check to ensure the days field is "valid" as in between 1 and 365 was not done since those would be found in the "terraform plan" stage. (was tested)

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0

[cx-eduardo-semanas]

LGTM, great job