feat(query): implements "Beta - Resource Without Diagnostic Settings"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources that can be associated to a "azurerm_monitor_diagnostic_setting" resource have said association in place.

• Quoting CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0 page 194: "A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.

• Additionally, page 194 states : "Settings should be configured for all appropriate resources for your environment."

• The initial list of resources that will be supported is as follows:

azurerm_key_vault,
azurerm_application_gateway,
azurerm_firewall,
azurerm_lb,
azurerm_public_ip,
azurerm_frontdoor,
azurerm_cdn_frontdoor_profile,
azurerm_cdn_frontdoor_endpoint,
azurerm_cdn_profile,
azurerm_cdn_endpoint,
azurerm_storage_account,
azurerm_mssql_server,
azurerm_mssql_managed_instance,
azurerm_mssql_database,
azurerm_cosmosdb_account,
azurerm_linux_web_app,
azurerm_windows_web_app,
azurerm_linux_function_app,
azurerm_windows_function_app,
azurerm_kubernetes_cluster,
azurerm_eventhub_namespace,
azurerm_servicebus_namespace,
azurerm_container_registry,
azurerm_api_management

• Additionally any sample with a data source of type azurerm_subscription, will also trigger the query.

Proposed Changes

• Implemented the missing query.
• The query will flag if one of the valid resources / data source does not have a "azurerm_monitor_diagnostic_setting" resource with a "target_resource_id" that specifically targets said resources/ data source.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0