⭐ Azure: Add 79 new fields in 17 resources

[tas50]

Extend existing Azure resources with additional fields that surface important security and configuration properties directly, without requiring users to dig into the raw properties dict.

azure.subscription.computeService.disk

• networkAccessPolicy - Disk network access policy (AllowAll, AllowPrivate, DenyAll)
• publicNetworkAccess - Whether public network access is enabled for the disk

azure.subscription.networkService.subnet

• privateEndpointNetworkPolicies - Whether network policies are applied to private endpoints in the subnet
• privateLinkServiceNetworkPolicies - Whether network policies are applied to private link services in the subnet
• defaultOutboundAccess - Whether default outbound access is enabled for VMs in the subnet

azure.subscription.networkService.frontendIpConfig

• isPublic - Whether this frontend IP configuration uses a public IP address
• publicIpAddressId - Resource ID of the associated public IP address (empty if private)
• privateIpAddress - Private IP address (empty if public)

azure.subscription.networkService.interface

• enableIPForwarding - Whether IP forwarding is enabled on the network interface
• enableAcceleratedNetworking - Whether accelerated networking is enabled on the network interface
• primary - Whether this is a primary network interface on a VM

azure.subscription.networkService.securityrule

• protocol - Security rule protocol (Tcp, Udp, Icmp, Esp, Ah, or *)
• access - Security rule access (Allow or Deny)
• priority - Security rule priority (100-4096, lower is higher priority)
• sourcePortRange - Security rule source port range
• sourceAddressPrefix - Security rule source address prefix (CIDR or *)
• destinationAddressPrefix - Security rule destination address prefix (CIDR or *)
• description - Security rule description

azure.subscription.storageService.account

• minimumTlsVersion - Minimum TLS version enforced on the storage account
• allowBlobPublicAccess - Whether blob containers can be configured for public access
• enableHttpsTrafficOnly - Whether only HTTPS traffic is allowed
• publicNetworkAccess - Whether public network access is allowed
• allowSharedKeyAccess - Whether shared key access is allowed
• allowCrossTenantReplication - Whether cross-tenant replication is allowed
• isLocalUserEnabled - Whether local user accounts are enabled for SFTP/SSH
• isSftpEnabled - Whether SFTP is enabled
• isHnsEnabled - Whether hierarchical namespace (Data Lake Storage) is enabled
• networkRuleDefaultAction - Default action for network rule set (Allow or Deny)
• networkRuleBypass - Services that bypass the network rules (e.g. AzureServices, Logging, Metrics)
• networkRuleIpRanges - IP address or CIDR ranges allowed by network rules
• networkRuleVirtualNetworkSubnetIds - Virtual network subnet resource IDs allowed by network rules

azure.subscription.webService.appsite

• httpsOnly - Whether the app requires HTTPS only
• clientCertEnabled - Whether client certificate authentication is enabled
• clientCertMode - Client certificate mode (Required, Optional, OptionalInteractiveUser)
• enabled - Whether the app is enabled
• state - Current state of the app

azure.subscription.webService.appsiteconfig

• minTlsVersion - Minimum TLS version for the site (1.0, 1.1, 1.2)
• ftpsState - FTP state for the site (AllAllowed, FtpsOnly, Disabled)
• remoteDebuggingEnabled - Whether remote debugging is enabled
• http20Enabled - Whether HTTP 2.0 is enabled
• alwaysOn - Whether the app should always be loaded

azure.subscription.sqlService.server

• minimalTlsVersion - SQL Database server minimum TLS version
• publicNetworkAccess - Whether public network access is enabled
• restrictOutboundNetworkAccess - Whether outbound network access is restricted
• version - SQL server version
• state - SQL server state
• fullyQualifiedDomainName - SQL server fully qualified domain name

azure.subscription.postgreSqlService.flexibleServer

• version - PostgreSQL flexible server engine version

azure.subscription.postgreSqlService.server

• sslEnforcement - Whether SSL enforcement is enabled
• minimalTlsVersion - Minimum TLS version enforced on the server
• publicNetworkAccess - Whether public network access is enabled
• infrastructureEncryption - Whether infrastructure encryption is enabled (double encryption)
• version - PostgreSQL server engine version

azure.subscription.mySqlService.server

• sslEnforcement - Whether SSL enforcement is enabled
• minimalTlsVersion - Minimum TLS version enforced on the server
• publicNetworkAccess - Whether public network access is enabled
• infrastructureEncryption - Whether infrastructure encryption is enabled (double encryption)
• version - MySQL server engine version

azure.subscription.mySqlService.flexibleServer

• version - MySQL flexible server engine version

azure.subscription.cosmosDbService.account

• publicNetworkAccess - Whether public network access is enabled
• disableLocalAuth - Whether local authentication is disabled (requires Entra ID)
• isVirtualNetworkFilterEnabled - Whether virtual network filtering is enabled
• disableKeyBasedMetadataWriteAccess - Whether key-based metadata write access is disabled
• enableAutomaticFailover - Whether automatic failover is enabled
• enableMultipleWriteLocations - Whether multi-region write is enabled
• ipRangeFilter - IP address or CIDR ranges allowed by IP firewall rules

azure.subscription.keyVaultService.vault

• enableSoftDelete - Whether soft delete is enabled
• enablePurgeProtection - Whether purge protection is enabled
• softDeleteRetentionInDays - Number of days that deleted vaults and vault objects are retained
• publicNetworkAccess - Whether the vault is accessible from public networks
• enabledForDeployment - Whether the vault can be used for ARM deployment
• enabledForDiskEncryption - Whether the vault can be used for Azure Disk Encryption
• enabledForTemplateDeployment - Whether the vault can be used for ARM template deployment

azure.subscription.aksService.cluster

• enablePrivateCluster - Whether the AKS cluster API server is a private cluster
• enablePrivateClusterPublicFQDN - Whether the private cluster has a public FQDN
• disableRunCommand - Whether run command is disabled on the AKS cluster
• apiServerAuthorizedIPRanges - CIDR ranges authorized to access the AKS API server
• privateDnsZone - Private DNS zone mode for the AKS cluster

azure.subscription.cacheService.redisInstance

• minimumTlsVersion - Minimum TLS version required by the Redis cache

[github-actions]

Test Results

5 121 tests  ±0   5 117 ✅ ±0   2m 32s ⏱️ +9s
  418 suites ±0       4 💤 ±0 
   31 files   ±0       0 ❌ ±0 

Results for commit bf8b636. ± Comparison against base commit 51af60d.

♻️ This comment has been updated with latest results.

[tas50]

@czunker let me know if there was other items here

[czunker]

LGTM
Thanks @tas50