Skip to content

feat(azure/vm): add new check vm_jit_access_enabled #8202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

puchy22
Copy link
Member

@puchy22 puchy22 commented Jul 7, 2025

Context

This PR introduces a new Azure security check: vm_jit_access_enabled.
It ensures that all Microsoft Azure Virtual Machines are configured to use Just-in-Time (JIT) access, reducing the attack surface for management ports.

Implements the requirements from Trend Micro Conformity and follows Prowler's check development and test standards.

Description

  • New check: vm_jit_access_enabled for Azure VMs, verifying JIT access is enabled.
  • Service update: Extended Defender service to model and retrieve JIT policies using the Azure SDK.
  • Unit tests: Comprehensive tests for all logic branches and edge cases, following Prowler conventions.
  • Changelog: Updated with new check entry under the latest unreleased version.

Checklist

API

  • Verify if API specs need to be regenerated.
  • Check if version updates are required (e.g., specs, Poetry, etc.).
  • Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@puchy22 puchy22 requested review from a team as code owners July 7, 2025 14:53
@github-actions github-actions bot added the provider/azure Issues/PRs related with the Azure provider label Jul 7, 2025
Copy link
Contributor

github-actions bot commented Jul 7, 2025

⚠️ Changes detected in the following folders without a corresponding update to the CHANGELOG.md:

  • prowler

Please add an entry to the corresponding CHANGELOG.md file to maintain a clear history of changes.

✅ All necessary CHANGELOG.md files have been updated. Great job! 🎉

Copy link

codecov bot commented Jul 7, 2025

Codecov Report

Attention: Patch coverage is 90.24390% with 4 lines in your changes missing coverage. Please review.

Project coverage is 81.37%. Comparing base (4477cec) to head (999a943).
Report is 3 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #8202      +/-   ##
==========================================
- Coverage   88.08%   81.37%   -6.72%     
==========================================
  Files         897      275     -622     
  Lines       27597     9759   -17838     
==========================================
- Hits        24309     7941   -16368     
+ Misses       3288     1818    -1470     
Flag Coverage Δ
prowler 81.37% <90.24%> (-6.72%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
prowler 81.37% <90.24%> (-6.72%) ⬇️
api ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
provider/azure Issues/PRs related with the Azure provider
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant