Skip to content

Commit 2410600

Browse files
BenjaminEngesetBenjaminEngeset
authored
feat(new): Added Azure.Redis.EntraID (Azure#2900)
* feat(new): Added Azure.Redis.EntraID * docs: Added link for data access policy
1 parent 1e28104 commit 2410600

File tree

5 files changed

+159
-0
lines changed

5 files changed

+159
-0
lines changed

‎docs/CHANGELOG-v1.md

+3
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3636
- Virtual Machine Scale Sets:
3737
- Check that automatic instance repairs are enabled by @BenjaminEngeset.
3838
[#2895](https://github.com/Azure/PSRule.Rules.Azure/issues/2895)
39+
- Azure Cache for Redis:
40+
- Verify that cache instances have Entra ID authentication enabled by @BenjaminEngeset.
41+
[#2899](https://github.com/Azure/PSRule.Rules.Azure/issues/2899)
3942

4043
## v1.37.0-B0034 (pre-release)
4144

‎docs/en/rules/Azure.Redis.EntraID.md

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
severity: Critical
3+
pillar: Security
4+
category: SE:05 Identity and access management
5+
resource: Azure Cache for Redis
6+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Redis.EntraID/
7+
---
8+
9+
# Use Entra ID authentication with cache instances
10+
11+
## SYNOPSIS
12+
13+
Use Entra ID authentication with cache instances.
14+
15+
## DESCRIPTION
16+
17+
Azure Cache for Redis provides two authentication methods for accessing cache instances: access keys and Microsoft Entra ID. Entra ID authentication offers centralized identity management and enhanced security features.
18+
19+
Some advantages of using Entra ID authentication over access keys include:
20+
21+
- Support for Azure Multi-Factor Authentication (MFA).
22+
- Conditional access policies with Conditional Access.
23+
24+
Disabling local authentication methods is not supported. However, regenerating the access keys will invalidate any previously used access keys, rendering them unusable for accessing the cache instance.
25+
26+
See documentation references below for additional limitations and important information.
27+
28+
## RECOMMENDATION
29+
30+
Consider using Entra ID authentication with cache instances.
31+
32+
## EXAMPLES
33+
34+
### Configure with Azure template
35+
36+
To deploy cache instances that pass this rule:
37+
38+
- Set the `properties.redisConfiguration.aad-enabled` to `'True'`.
39+
40+
For example:
41+
42+
```json
43+
{
44+
"type": "Microsoft.Cache/redis",
45+
"apiVersion": "2023-08-01",
46+
"name": "[parameters('name')]",
47+
"location": "[parameters('location')]",
48+
"properties": {
49+
"minimumTlsVersion": "1.2",
50+
"redisVersion": "latest",
51+
"sku": {
52+
"name": "Premium",
53+
"family": "P",
54+
"capacity": 1
55+
},
56+
"redisConfiguration": {
57+
"aad-enabled": "True"
58+
}
59+
}
60+
}
61+
```
62+
63+
### Configure with Bicep
64+
65+
To deploy cache instances that pass this rule:
66+
67+
- Set the `properties.redisConfiguration.aad-enabled` to `'True'`.
68+
69+
For example:
70+
71+
```bicep
72+
resource cache 'Microsoft.Cache/redis@2023-08-01' = {
73+
name: name
74+
location: location
75+
properties: {
76+
minimumTlsVersion: '1.2'
77+
redisVersion: 'latest'
78+
sku: {
79+
name: 'Premium'
80+
family: 'P'
81+
capacity: 1
82+
}
83+
redisConfiguration: {
84+
'aad-enabled': 'True'
85+
}
86+
}
87+
}
88+
```
89+
90+
## NOTES
91+
92+
Microsoft Entra ID based authentication isn't supported in the Enterprise tiers of Azure Cache for Redis Enterprise.
93+
94+
## LINKS
95+
96+
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)
97+
- [Use Microsoft Entra ID for cache authentication](https://learn.microsoft.com/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication)
98+
- [Configure role-based access control with Data Access Policy](https://learn.microsoft.com/azure/azure-cache-for-redis/cache-configure-role-based-access-control)
99+
- [Azure security baseline for Azure Cache for Redis](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-cache-for-redis-security-baseline)
100+
- [IM-1: Use centralized identity and authentication system](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-cache-for-redis-security-baseline#im-1-use-centralized-identity-and-authentication-system)
101+
- [Azure resource deployment](https://learn.microsoft.com/azure/templates/microsoft.cache/redis#rediscommonpropertiesredisconfiguration)

‎src/PSRule.Rules.Azure/rules/Azure.Redis.Rule.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,26 @@ spec:
9393
field: properties.publicNetworkAccess
9494
equals: Disabled
9595

96+
---
97+
# Synopsis: Use Entra ID authentication with cache instances.
98+
apiVersion: github.com/microsoft/PSRule/v1
99+
kind: Rule
100+
metadata:
101+
name: Azure.Redis.EntraID
102+
ref: AZR-000427
103+
tags:
104+
release: GA
105+
ruleSet: 2024_06
106+
Azure.WAF/pillar: Security
107+
labels:
108+
Azure.MCSB.v1/control: 'IM-1'
109+
spec:
110+
type:
111+
- Microsoft.Cache/Redis
112+
condition:
113+
field: properties.redisConfiguration.aad-enabled
114+
equals: 'True'
115+
96116
#endregion Rules
97117

98118
#region Selectors

‎tests/PSRule.Rules.Azure.Tests/Azure.Redis.Tests.ps1

+24
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,30 @@ Describe 'Azure.Redis' -Tag 'Redis' {
313313
$ruleResult.Length | Should -Be 5;
314314
$ruleResult.TargetName | Should -BeIn 'redis-A', 'redis-B', 'redis-C', 'redis-Q', 'redis-R';
315315
}
316+
317+
318+
It 'Azure.Redis.EntraID' {
319+
$filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Redis.EntraID' };
320+
321+
# Fail
322+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' });
323+
$ruleResult.Length | Should -Be 3;
324+
$ruleResult.TargetName | Should -BeIn 'redis-A', 'redis-B', 'redis-C';
325+
326+
$ruleResult[0].Reason | Should -BeExactly "Path properties.redisConfiguration.aad-enabled: The field 'properties.redisConfiguration.aad-enabled' does not exist.";
327+
$ruleResult[1].Reason | Should -BeExactly "Path properties.redisConfiguration.aad-enabled: Is set to ''.";
328+
$ruleResult[2].Reason | Should -BeExactly "Path properties.redisConfiguration.aad-enabled: Is set to 'False'.";
329+
330+
# Pass
331+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' });
332+
$ruleResult.Length | Should -Be 9;
333+
$ruleResult.TargetName | Should -BeIn 'redis-D', 'redis-E', 'redis-F', 'redis-G', 'redis-H', 'redis-I', 'redis-J', 'redis-Q', 'redis-R';
334+
335+
# None
336+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'None' });
337+
$ruleResult.Length | Should -Be 7;
338+
$ruleResult.TargetName | Should -BeIn 'redis-K', 'redis-L', 'redis-M', 'redis-N', 'redis-O', 'redis-P', 'redis-S';
339+
}
316340
}
317341

318342
Context 'With Configuration Option' -Tag 'Configuration' {

‎tests/PSRule.Rules.Azure.Tests/Resources.Redis.json

+11
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@
6060
},
6161
"enableNonSslPort": true,
6262
"redisConfiguration": {
63+
"aad-enabled": null,
6364
"maxclients": "2000",
6465
"maxmemory-policy": "volatile-lru"
6566
},
@@ -225,6 +226,7 @@
225226
}
226227
],
227228
"redisConfiguration": {
229+
"aad-enabled": "False",
228230
"maxclients": "256",
229231
"maxmemory-reserved": "2",
230232
"maxfragmentationmemory-reserved": "12",
@@ -413,6 +415,7 @@
413415
}
414416
],
415417
"redisConfiguration": {
418+
"aad-enabled": "True",
416419
"maxclients": "1000",
417420
"maxmemory-reserved": "150",
418421
"maxfragmentationmemory-reserved": "0",
@@ -577,6 +580,7 @@
577580
"minimumTlsVersion": "1.2",
578581
"enableNonSslPort": false,
579582
"redisConfiguration": {
583+
"aad-enabled": "True",
580584
"maxclients": "2000",
581585
"maxmemory-policy": "volatile-lru"
582586
},
@@ -747,6 +751,7 @@
747751
"publicNetworkAccess": "Disabled",
748752
"enableNonSslPort": false,
749753
"redisConfiguration": {
754+
"aad-enabled": "True",
750755
"maxclients": "2000",
751756
"maxmemory-policy": "volatile-lru"
752757
},
@@ -780,6 +785,7 @@
780785
"minimumTlsVersion": "1.2",
781786
"enableNonSslPort": false,
782787
"redisConfiguration": {
788+
"aad-enabled": "True",
783789
"maxclients": "2000",
784790
"maxmemory-policy": "volatile-lru"
785791
},
@@ -815,6 +821,7 @@
815821
"minimumTlsVersion": "1.2",
816822
"enableNonSslPort": false,
817823
"redisConfiguration": {
824+
"aad-enabled": "True",
818825
"maxclients": "2000",
819826
"maxmemory-policy": "volatile-lru"
820827
},
@@ -846,6 +853,7 @@
846853
"minimumTlsVersion": "1.2",
847854
"enableNonSslPort": false,
848855
"redisConfiguration": {
856+
"aad-enabled": "True",
849857
"maxclients": "2000",
850858
"maxmemory-policy": "volatile-lru"
851859
},
@@ -877,6 +885,7 @@
877885
"minimumTlsVersion": "1.2",
878886
"enableNonSslPort": false,
879887
"redisConfiguration": {
888+
"aad-enabled": "True",
880889
"maxclients": "2000",
881890
"maxmemory-policy": "volatile-lru"
882891
},
@@ -1044,6 +1053,7 @@
10441053
"minimumTlsVersion": "1.2",
10451054
"publicNetworkAccess": "Enabled",
10461055
"redisConfiguration": {
1056+
"aad-enabled": "True",
10471057
"maxclients": "256",
10481058
"maxmemory-reserved": "30",
10491059
"maxfragmentationmemory-reserved": "30",
@@ -1085,6 +1095,7 @@
10851095
"minimumTlsVersion": "1.2",
10861096
"publicNetworkAccess": "Enabled",
10871097
"redisConfiguration": {
1098+
"aad-enabled": "True",
10881099
"maxclients": "256",
10891100
"maxmemory-reserved": "30",
10901101
"maxfragmentationmemory-reserved": "30",

0 commit comments

Comments
 (0)