⚡ Lazy-load Azure network, AKS, IAM, and Redis sub-resources

[tas50]

Summary

Converts 23 eagerly-loaded sub-resource fields across 6 Azure resource types to lazy-loaded computed methods. This means sub-resource data is only fetched when a query actually references it, instead of being materialized on every scan.

What changed

Network resources (network.go):

• Load Balancer — 7 fields lazy-loaded: probes, backendPools, frontendIpConfigs, inboundNatPools, inboundNatRules, outboundRules, loadBalancerRules. Previously every LB list call parsed all 7 sub-resource arrays upfront. Now the list call returns just the LB metadata; sub-resources are only materialized from the cached Properties when accessed.
• Firewall — 5 fields: ipConfigurations, managementIpConfiguration, networkRules, natRules, applicationRules.
• Security Group — 3 fields: interfaces, securityRules, defaultSecurityRules.
• Virtual Network Gateway — 3 fields: ipConfigurations, bgpSettings, natRules.

AKS (aks.go):

• AKS Cluster — 2 fields: aadProfile, autoUpgradeProfile. These were parsed from the cluster Properties on every list even though most queries don't inspect them.

IAM (iam.go):

• Role Definition — 1 field: permissions. The permissions array is now lazy-loaded from the cached role definition properties.

Redis (redis.go):

• Redis Instance — 1 field: privateEndpointConnections. Parsed on demand instead of during the list call.

API call savings

Azure List APIs return the full resource object including all sub-resource arrays in the Properties blob. Before this PR, we were parsing all of those into MQL resources during the list call — meaning every sub-resource got CreateResource called even if no query ever touched it.

After this PR, the raw Properties struct is cached on the Internal struct, and sub-resources are only materialized when a query accesses the field. This eliminates thousands of unnecessary CreateResource + convert.JsonToDict calls during scan initialization.

Example: A subscription with 20 Load Balancers, each with ~5 probes, 3 backend pools, 4 frontend IPs, 2 NAT rules, 2 outbound rules, and 3 LB rules:

• Before: 20 × (5+3+4+2+2+3) = 380 CreateResource calls at scan start, even if the query is just azure.subscription.networkService.loadBalancers { name }
• After: 20 CreateResource calls at scan start. Sub-resources only created if the query traverses into them.

Also fixed

• Typo: outbundRule → outboundRule (resource name was misspelled)
• Added nil-safety guards on Properties access throughout network.go

Test plan

• make test/lint passes
• make providers/build/azure && make providers/install/azure
• Interactive verification with mql shell azure:
  • azure.subscription.networkService.loadBalancers { name probes backendPools }
  • azure.subscription.networkService.firewalls { name ipConfigurations networkRules }
  • azure.subscription.networkService.securityGroups { name securityRules defaultSecurityRules }
  • azure.subscription.aksService.clusters { name aadProfile autoUpgradeProfile }
  • azure.subscription.authorizationService.roleDefinitions { name permissions }
  • azure.subscription.cacheService.redisInstances { hostName privateEndpointConnections }

🤖 Generated with Claude Code

[mondoo-code-review]

Lazy-loading Azure network sub-resources reduces unnecessary API data processing, but a pre-existing resource name typo will cause outbound rule creation to fail at runtime.

Additional findings (file/line not in diff):

• 🟡 providers/azure/resources/network.go:2279 — Same pre-existing nil-safety issue: ipConfig.Properties.PrivateIPAddress accessed without checking ipConfig.Properties != nil in firewall ipConfigurations().

[github-actions]

Test Results

5 741 tests  ±0   5 737 ✅ ±0   2m 13s ⏱️ ±0s
  425 suites ±0       4 💤 ±0 
   33 files   ±0       0 ❌ ±0 

Results for commit 4d9c42c. ± Comparison against base commit a2d3027.

♻️ This comment has been updated with latest results.

Superseded by new review

[mondoo-code-review]

Azure network queries will be faster by lazy-loading sub-resources; also fixes a pre-existing outbound rule typo.

[mondoo-code-review]

Lazy-loading Azure network sub-resources improves query performance by deferring sub-resource creation until accessed.

[mondoo-code-review]

Duplicate struct definition in redis.go will cause a compilation failure, blocking all Azure Redis queries.

Superseded by new review

[mondoo-code-review]

Lazy-loading Azure sub-resources improves query performance by deferring sub-resource creation until accessed.