feat(arm): add CKV_AZURE_85 to ensure that Azure Defender is set to On for Kubernetes

checkov/arm/checks/resource/AzureDefenderOnKubernetes.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+from typing import Any
+from checkov.common.models.enums import CheckCategories, CheckResult
+from checkov.arm.base_resource_check import BaseResourceCheck
+
+
+class AzureDefenderOnKubernetes(BaseResourceCheck):
+    def __init__(self) -> None:
+        name = "Ensure that Azure Defender is set to On for Kubernetes"
+        id = "CKV_AZURE_85"
+        supported_resources = ("Microsoft.Security/pricings",)
+        categories = (CheckCategories.GENERAL_SECURITY,)
+        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,)
+
+    def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult:
+        if "name" in conf:
+            if conf["name"] != "KubernetesService":
+                return CheckResult.PASSED
+            properties = conf.get('properties')
+            if not properties or not isinstance(properties, dict):
+                return CheckResult.FAILED
+            pricingTier = properties.get('pricingTier')
+            if not pricingTier:
+                return CheckResult.FAILED
+            if pricingTier == "Free":
+                return CheckResult.FAILED
+            return CheckResult.PASSED
+        return CheckResult.FAILED
+
+
+
+check = AzureDefenderOnKubernetes()

tests/arm/checks/resource/example_AzureDefenderOnKubernetes/fail.json

@@ -0,0 +1,61 @@
+{
+"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+"contentVersion": "1.0.0.0",
+"parameters": {
+    "pricing": {
+        "type": "string",
+        "allowedValues": [
+            "Standard",
+            "Free"
+        ]
+    }
+},
+
+"resources": [
+    {
+        "type": "Microsoft.Security/pricings",
+        "apiVersion": "2017-08-01-preview",
+        "name": "KubernetesService",
+        "properties": {
+            "pricingTier": "Free"
+        }
+    },
+            {
+            "type": "Microsoft.Compute/disks",
+            "apiVersion": "2023-01-02",
+            "name": "[parameters('disks_acctestmd1_name')]",
+            "location": "westus2",
+            "tags": {
+                "environment": "staging"
+            },
+            "sku": {
+                "name": "Standard_LRS",
+                "tier": "Standard"
+            },
+            "properties": {
+                "creationData": {
+                    "createOption": "Empty"
+                },
+                "diskSizeGB": 1,
+                "diskIOPSReadWrite": 500,
+                "diskMBpsReadWrite": 60,
+                "encryption": {
+                    "type": "EncryptionAtRestWithPlatformKey"
+                },
+                "networkAccessPolicy": "AllowAll",
+                "publicNetworkAccess": "Enabled",
+                "diskState": "Unattached"
+            }
+        },
+    {
+        "type": "Microsoft.Security/pricings",
+        "apiVersion": "2018-06-01",
+        "name": "KubernetesService",
+        "dependsOn": [
+            "[concat('Microsoft.Security/pricings/AppServices')]"
+        ],
+        "properties": {
+            "pricingTier": "Free"
+        }
+    }
+]}

tests/arm/checks/resource/example_AzureDefenderOnKubernetes/pass.json

@@ -0,0 +1,49 @@
+{
+"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+"contentVersion": "1.0.0.0",
+"parameters": {
+    "pricing": {
+        "type": "string",
+        "allowedValues": [
+            "Standard",
+            "Free"
+        ]
+    }
+},
+"resources": [
+
+    {
+        "type": "Microsoft.Security/pricings",
+        "apiVersion": "2018-06-01",
+        "name": "KubernetesService",
+        "dependsOn": [
+            "[concat('Microsoft.Security/pricings/default')]"
+        ],
+        "properties": {
+            "pricingTier": "Standard"
+        }
+    },
+    {
+        "type": "Microsoft.Security/pricings",
+        "apiVersion": "2018-06-01",
+        "name": "KeyVaults",
+        "dependsOn": [
+            "[concat('Microsoft.Security/pricings/SqlServers')]"
+        ],
+        "properties": {
+            "pricingTier": "Free"
+        }
+    },
+    {
+        "type": "Microsoft.Security/pricings",
+        "apiVersion": "2018-06-01",
+        "name": "SqlServerVirtualMachines",
+        "dependsOn": [
+            "[concat('Microsoft.Security/pricings/AppServices')]"
+        ],
+        "properties": {
+            "pricingTier": "Free"
+        }
+    }
+]
+}

tests/arm/checks/resource/test_AzureDefenderOnKubernetes.py

@@ -0,0 +1,26 @@
+import unittest
+from pathlib import Path
+from checkov.arm.checks.resource.AzureDefenderOnKubernetes import check
+from checkov.arm.runner import Runner
+from checkov.runner_filter import RunnerFilter
+
+
+class TestAzureDefenderOnKubernetes(unittest.TestCase):
+    def test_summary(self):
+        # given
+        test_files_dir = Path(__file__).parent / "example_AzureDefenderOnKubernetes"
+
+        # when
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
+
+        # then
+        summary = report.get_summary()
+
+        self.assertEqual(summary['passed'], 3)
+        self.assertEqual(summary['failed'], 2)
+        self.assertEqual(summary['skipped'], 0)
+        self.assertEqual(summary['parsing_errors'], 0)
+
+
+if __name__ == "__main__":
+    unittest.main()