feat(query): implements "Beta - AKS Without Audit Logs"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources of type "azurerm_kubernetes_cluster" has proper audit logging enabled.

• Quoting CIS_Azure_Kubernetes_Service_(AKS)_Benchmark_V1.8.0 page 17: "2.1.1 Enable audit Logs (Manual) ... Exporting logs and metrics to a dedicated, persistent datastore ensures availability of audit data following a cluster security event, and provides a central location for analysis of log and metric data collated from multiple sources.".

Proposed Changes

• Implemented the missing query.

• To ensure audit logging is enabled the cluster must be associated with a "azurerm_monitor_diagnostic_setting" resource that includes either the "kube-audit" and/or "kube-audit-admin" categories.

• The association is set through the target_resource_id, the log categories included must be set with the "enabled_log" blocks. Support for legacy "log" blocks was also included. The enabled_log/log blocks should include the audit category in their "category" field.

• In the case of a "azurerm_kubernetes_cluster" being associated with a "azurerm_monitor_diagnostic_setting" where the legacy "log" blocks are used with the right category/ies but set "enabled" to false the query will point to the lines where enabled is set and point out it should be set to true to fix the issue.

• NOTE this is my own interpretation given the CIS Benchmark and the entry's name. In truth the "Remediation" from the Benchmark is not particularly explicit/restrictive with which particular categories must be included. All there is to go off is the following remediation step (6) : In the list of available logs, select the logs you wish to enable. For this example, enable the kube-audit and kube-audit-admin logs. Common logs include the kube-apiserver, kube-controller-manager, and kube-scheduler. You can return and change the collected logs once Log Analytics workspaces are enabled.; additionally it is suggested that not every single cluster must have these logs enabled but it seems like a manual decision that has to be done based on real world use context and cannot be done through static analysis.

• The official documentation puts extra emphasis on thekube-apiserver, kube-audit and kube-audit-admin categories over the kube-controller-manager and kube-scheduler. It could be argued if the kube-apiserver flag being included should be enough to prevent the query from flagging.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.17

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0

[cx-eduardo-semanas]

LGTM