RESOURCE-507 Attribute Enhancement in Azure Network Security Group Resource

docs-chef-io/content/inspec/resources/azure_network_security_group.md

@@ -203,7 +203,20 @@ describe azure_network_security_group(resource_group: 'RESOURCE_GROUP', name: 'G
   it { should_not exist }
 end
 ```
+### Test that a Network Security group should not allow UDP from the internet
 
+```ruby
+describe azure_network_security_group(resource_group: 'RESOURCE_GROUP', name: 'GROUP_NAME') do
+  it { should_not allow_udp_from_internet }
+end
+```
+### Validating Number of days to retain flow log records.
+
+```ruby
+describe azure_network_security_group(resource_group: 'RESOURCE_GROUP', name: 'GROUP_NAME') do
+  its('flow_log_retention_period') { should eq 0 }
+end
+```
 ## Azure Permissions
 
 {{% azure_permissions_service_principal role="reader" %}}

libraries/azure_network_security_group.rb

@@ -131,6 +131,9 @@ def security_rules
     @security_rules ||= properties.securityRules
   end
 
+  def flow_log_retention_period
+    !properties.include?(:retentionPolicy) ? 0 : properties.retentionPolicy
+  end
   def default_security_rules
     return unless exists?
     @default_security_rules ||= properties.defaultSecurityRules
@@ -148,6 +151,20 @@ def allow_rdp_from_internet?
   end
   RSpec::Matchers.alias_matcher :allow_rdp_from_internet, :be_allow_rdp_from_internet
 
+  def allow_udp_from_internet?
+    return unless exists?
+    allow_port_from_internet?('53')
+  end
+  RSpec::Matchers.alias_matcher :allow_udp_from_internet, :be_allow_udp_from_internet
+
+  SPECIFIC_CRITERIA = %i(specific_port access_allow direction_inbound source_open not_icmp).freeze
+
+  def allow_http_from_internet?
+    return unless exists?
+    allow_port_from_internet?('80') || allow_port_from_internet?('443')
+  end
+  RSpec::Matchers.alias_matcher :allow_http_from_internet, :be_allow_http_from_internet
+
   SPECIFIC_CRITERIA = %i(specific_port access_allow direction_inbound source_open not_icmp).freeze
   def allow_port_from_internet?(specific_port)
     return unless exists?
@@ -156,6 +173,8 @@ def allow_port_from_internet?(specific_port)
   end
   RSpec::Matchers.alias_matcher :allow_port_from_internet, :be_allow_port_from_internet
 
+
+
   private
 
   def security_rules_properties

test/integration/verify/controls/azurerm_network_security_group.rb

@@ -70,6 +70,8 @@
 
   describe azure_network_security_group(resource_group: resource_group, name: nsg_insecure) do
     it { should allow_in(ip_range: '0.0.0.0', port: '22') }
+    it { should_not allow_udp_from_internet }
+    its('flow_log_retention_period') { should eq 0 }
     it { should allow(source_ip_range: '0.0.0.0', destination_port: '22', direction: 'inbound') }
     it { should allow_in(service_tag: 'Internet', port: %w{1433-1434 1521 4300-4350 5000-6000}) }
     it { should allow(source_service_tag: 'Internet', destination_port: %w{1433-1434 1521 4300-4350 5000-6000}, direction: 'inbound') }