Kubernetes Cluster "OS and Data Disks Encrypted with CMK" and "Temp Disks and Cache Not Encrypted.md" False Positive about steampipe-mod-azure-compliance

[misraved]

Thanks @fgomesz for raising this issue and providing good context on how the control should work.

We will pick this up shortly and hopefully fix and release it 👍 .

[github-actions]

'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.'

[github-actions]

'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.'

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

[cbruno10]

@bigdatasourav Is this something we can fix in the plugin, so the azure_kubernetes_cluster table can return the correct disk encryption information even if Steampipe is not whitelisted?

Else, are we able to detect if we're getting a response as if we're not whitelisted, so we can return the correct result in the query?

[bigdatasourav]

@cbruno10 @fgomesz In our tests, we get the disk encryption information even if Steampipe is not whitelisted.

Below are the steps we have followed to reproduce the above issue with the latest plugin and compliance version-

1. Created a cluster name test-cmk1 with disk-encryption-set and without enforcing the IP whitelist -

> select name, disk_encryption_set_id from azure_kubernetes_cluster where name = 'test-cmk1'
+-----------+--------------------------------------------------------------------------------------------------------------------------------------+
| name      | disk_encryption_set_id                                                                                                               |
+-----------+--------------------------------------------------------------------------------------------------------------------------------------+
| test-cmk1 | /subscriptions/d46d7416-f95f-4771-454354354/resourceGroups/demo/providers/Microsoft.Compute/diskEncryptionSets/test-cmk-disk |
+-----------+--------------------------------------------------------------------------------------------------------------------------------------+

Control output - (expected)

➜  steampipe-mod-azure-compliance git:(main) steampipe query azure_compliance.query.kubernetes_cluster_os_and_data_disks_encrypted_with_cmk
+---------------------------------------------------------------------------------------------------------------------------------------------+--------+------------------------------------------------------+----------------+-----------------+
| resource                                                                                                                                    | status | reason                                               | resource_group | subscription    |
+---------------------------------------------------------------------------------------------------------------------------------------------+--------+------------------------------------------------------+----------------+-----------------+
| /subscriptions/d46d7416-f95f-4771-454354354/resourcegroups/demo/providers/Microsoft.ContainerService/managedClusters/test-cmk1      | ok     | test-cmk1 os and data diska encrypted with CMK.      | demo           | new AAA |

2. Created a cluster name test-whitelist with disk-encryption-set and enforced the IP whitelist - (Steampipe is not whitelisted)

> select name, disk_encryption_set_id from azure_kubernetes_cluster where name = 'test-whitelist'
+----------------+--------------------------------------------------------------------------------------------------------------------------------------+
| name           | disk_encryption_set_id                                                                                                               |
+----------------+--------------------------------------------------------------------------------------------------------------------------------------+
| test-whitelist | /subscriptions/d46d7416-f95f-471-bbb5-529d4c769c/resourceGroups/demo/providers/Microsoft.Compute/diskEncryptionSets/test-cmk-disk |
+----------------+--------------------------------------------------------------------------------------------------------------------------------------+

Control output - (expected)

➜  steampipe-mod-azure-compliance git:(main) steampipe query azure_compliance.query.kubernetes_cluster_os_and_data_disks_encrypted_with_cmk
+---------------------------------------------------------------------------------------------------------------------------------------------+--------+------------------------------------------------------+----------------+-----------------+
| resource                                                                                                                                    | status | reason                                               | resource_group | subscription    |
+---------------------------------------------------------------------------------------------------------------------------------------------+--------+------------------------------------------------------+----------------+-----------------+
| /subscriptions/d46d7416-f95f-4771-bbb5-529d4c76659c/resourcegroups/demo/providers/Microsoft.ContainerService/managedClusters/test-whitelist | ok     | test-whitelist os and data diska encrypted with CMK. | demo           | newwarriors AAA |
+---------------------------------------------------------------------------------------------------------------------------------------------+--------+-----------------------------------

Please let us know if we miss anything.

[bigdatasourav]

Hey @fgomesz, We are closing this issue because we have not heard from you. Please feel free to reopen the issue if you want to share or discuss anything.