1+ var expect = require ( 'chai' ) . expect ;
2+ var keyVaultPublicAccess = require ( './keyVaultPublicAccess' ) ;
3+
4+ const vaults = [
5+ {
6+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test1" ,
7+ "name" : "test1" ,
8+ "type" : "Microsoft.KeyVault/vaults" ,
9+ "publicNetworkAccess" : "Disabled"
10+
11+ } ,
12+ {
13+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test2" ,
14+ "name" : "test2" ,
15+ "type" : "Microsoft.KeyVault/vaults" ,
16+ "publicNetworkAccess" : "Enabled" ,
17+ "networkAcls" : {
18+ "defaultAction" : "Deny" ,
19+ "ipRules" : [
20+ {
21+ "value" : "10.0.0.0/16"
22+ }
23+ ]
24+ }
25+
26+ } ,
27+ {
28+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test3" ,
29+ "name" : "test3" ,
30+ "type" : "Microsoft.KeyVault/vaults" ,
31+ "publicNetworkAccess" : "Enabled" ,
32+ "networkAcls" : {
33+ "defaultAction" : "Allow" ,
34+ "ipRules" : [ ]
35+ }
36+
37+ } ,
38+ {
39+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test4" ,
40+ "name" : "test4" ,
41+ "type" : "Microsoft.KeyVault/vaults" ,
42+ "publicNetworkAccess" : "Enabled" ,
43+ "networkAcls" : {
44+ "defaultAction" : "Deny" ,
45+ "ipRules" : [
46+ {
47+ "value" : "0.0.0.0/0"
48+ }
49+ ]
50+ }
51+ } ,
52+ {
53+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test6" ,
54+ "name" : "test6" ,
55+ "type" : "Microsoft.KeyVault/vaults" ,
56+ "publicNetworkAccess" : "Enabled"
57+
58+ } ,
59+ {
60+ "id" : "/subscriptions/123/resourceGroups/test/providers/Microsoft.KeyVault/vaults/test7" ,
61+ "name" : "test7" ,
62+ "type" : "Microsoft.KeyVault/vaults" ,
63+ "publicNetworkAccess" : "Enabled" ,
64+ "networkAcls" : {
65+ "defaultAction" : "Deny" ,
66+ "ipRules" : [
67+ {
68+ "value" : "192.168.1.1"
69+ }
70+ ]
71+
72+ }
73+ }
74+ ] ;
75+
76+ const createCache = ( vaults ) => {
77+ return {
78+ vaults : {
79+ list : {
80+ 'eastus' : {
81+ data : vaults
82+ }
83+ }
84+ }
85+ } ;
86+ } ;
87+
88+ const createErrorCache = ( ) => {
89+ return {
90+ vaults : {
91+ list : {
92+ 'eastus' : {
93+ err : {
94+ message : 'error loading vaults'
95+ }
96+ }
97+ }
98+ }
99+ } ;
100+ } ;
101+
102+ describe ( 'keyVaultPublicAccess' , function ( ) {
103+ describe ( 'run' , function ( ) {
104+ it ( 'should give passing result if no key vaults found' , function ( done ) {
105+ const cache = createCache ( [ ] ) ;
106+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
107+ expect ( results . length ) . to . equal ( 1 ) ;
108+ expect ( results [ 0 ] . status ) . to . equal ( 0 ) ;
109+ expect ( results [ 0 ] . message ) . to . include ( 'No Key Vaults found' ) ;
110+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
111+ done ( ) ;
112+ } ) ;
113+ } ) ;
114+
115+ it ( 'should give unknown result if unable to query for key vaults' , function ( done ) {
116+ const cache = createErrorCache ( ) ;
117+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
118+ expect ( results . length ) . to . equal ( 1 ) ;
119+ expect ( results [ 0 ] . status ) . to . equal ( 3 ) ;
120+ expect ( results [ 0 ] . message ) . to . include ( 'Unable to query for Key Vaults' ) ;
121+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
122+ done ( ) ;
123+ } ) ;
124+ } ) ;
125+
126+ it ( 'should give passing result if public network access is disabled' , function ( done ) {
127+ const cache = createCache ( [ vaults [ 0 ] ] ) ;
128+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
129+ expect ( results . length ) . to . equal ( 1 ) ;
130+ expect ( results [ 0 ] . status ) . to . equal ( 0 ) ;
131+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is protected from outside traffic' ) ;
132+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
133+ done ( ) ;
134+ } ) ;
135+ } ) ;
136+
137+ it ( 'should give passing result if default action is deny and no public IPs allowed' , function ( done ) {
138+ const cache = createCache ( [ vaults [ 1 ] ] ) ;
139+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
140+ expect ( results . length ) . to . equal ( 1 ) ;
141+ expect ( results [ 0 ] . status ) . to . equal ( 0 ) ;
142+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is protected from outside traffic' ) ;
143+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
144+ done ( ) ;
145+ } ) ;
146+ } ) ;
147+
148+ it ( 'should give failing result if default action is allow' , function ( done ) {
149+ const cache = createCache ( [ vaults [ 2 ] ] ) ;
150+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
151+ expect ( results . length ) . to . equal ( 1 ) ;
152+ expect ( results [ 0 ] . status ) . to . equal ( 2 ) ;
153+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is open to outside traffic' ) ;
154+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
155+ done ( ) ;
156+ } ) ;
157+ } ) ;
158+
159+ it ( 'should give failing result if IPv4 public access is allowed' , function ( done ) {
160+ const cache = createCache ( [ vaults [ 3 ] ] ) ;
161+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
162+ expect ( results . length ) . to . equal ( 1 ) ;
163+ expect ( results [ 0 ] . status ) . to . equal ( 2 ) ;
164+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is open to outside traffic' ) ;
165+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
166+ done ( ) ;
167+ } ) ;
168+ } ) ;
169+
170+ it ( 'should give failing result if no network ACLs configured' , function ( done ) {
171+ const cache = createCache ( [ vaults [ 4 ] ] ) ;
172+ keyVaultPublicAccess . run ( cache , { } , ( err , results ) => {
173+ expect ( results . length ) . to . equal ( 1 ) ;
174+ expect ( results [ 0 ] . status ) . to . equal ( 2 ) ;
175+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is open to outside traffic' ) ;
176+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
177+ done ( ) ;
178+ } ) ;
179+ } ) ;
180+
181+ it ( 'should give passing result if IP is in allowed list' , function ( done ) {
182+ const cache = createCache ( [ vaults [ 5 ] ] ) ;
183+ keyVaultPublicAccess . run ( cache , { keyvault_allowed_ips : '192.168.1.1' } , ( err , results ) => {
184+ expect ( results . length ) . to . equal ( 1 ) ;
185+ expect ( results [ 0 ] . status ) . to . equal ( 0 ) ;
186+ expect ( results [ 0 ] . message ) . to . include ( 'Key Vault is protected from outside traffic' ) ;
187+ expect ( results [ 0 ] . region ) . to . equal ( 'eastus' ) ;
188+ done ( ) ;
189+ } ) ;
190+ } ) ;
191+ } ) ;
192+ } ) ;
0 commit comments