Skip to content

Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
emon22-ts wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a7db10
feat(ci-rules): add AZ-CI-001..004 CI/CD workflow security rules (iss…
emon22-ts Aug 26, 2026
8146a96
fix: evaluate job-level permissions in is_permissions_broad and add r…
emon22-ts Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,7 +477,9 @@ jobs:
pip-audit -r requirements.txt \
--ignore-vuln PYSEC-2025-217 \
--ignore-vuln CVE-2026-1839 \
--ignore-vuln CVE-2026-4372
--ignore-vuln CVE-2026-4372 \
--ignore-vuln CVE-2026-45830 \
--ignore-vuln CVE-2026-45833

# ── Software Bill of Materials (Syft, CycloneDX) ──────────────────────────
sbom:
Expand Down
160 changes: 95 additions & 65 deletions compliance/frameworks/cis_azure_benchmark.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@
"AZ-DB-004": {
"control_id": "4.1.2",
"control_name": "Ensure that 'Allow access to Azure services' for SQL Servers is disabled",
"description": "Enabling 'Allow access to Azure services' on a SQL Server firewall creates a rule that permits any Azure-hosted resource — including services from other tenants — to connect to the server. This significantly increases the attack surface. Access should be restricted to specific trusted IP ranges or private endpoints."
"description": "Enabling 'Allow access to Azure services' on a SQL Server firewall creates a rule that permits any Azure-hosted resource \u2014 including services from other tenants \u2014 to connect to the server. This significantly increases the attack surface. Access should be restricted to specific trusted IP ranges or private endpoints."
},
"AZ-IDN-004": {
"control_id": "1.16",
Expand Down Expand Up @@ -298,21 +298,81 @@
"control_name": "Managed Identity least privilege (not mapped in CIS Azure Foundations 2.0.0)",
"description": "Microsoft recommends least-privilege roles and scopes for managed identities. This check has no direct control in the repository's CIS Azure Foundations 2.0.0 benchmark."
},
"AZ-FUNC-001": {"control_id":"N/A-FUNC-001","control_name":"Function App HTTPS enforcement","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific HTTPS control."},
"AZ-FUNC-002": {"control_id":"N/A-FUNC-002","control_name":"Function App minimum TLS version","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific TLS control."},
"AZ-FUNC-003": {"control_id":"N/A-FUNC-003","control_name":"Function App FTP publishing","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific publishing control."},
"AZ-FUNC-004": {"control_id":"N/A-FUNC-004","control_name":"Function App remote debugging","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific debugging control."},
"AZ-FUNC-005": {"control_id":"N/A-FUNC-005","control_name":"Function App managed identity","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific identity control."},
"AZ-PE-001": {"control_id":"N/A-PE-001","control_name":"Storage public network access","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."},
"AZ-PE-002": {"control_id":"N/A-PE-002","control_name":"SQL public network access","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."},
"AZ-PE-003": {"control_id":"N/A-PE-003","control_name":"PostgreSQL public network access","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific private-networking control."},
"AZ-PE-004": {"control_id":"N/A-PE-004","control_name":"App Service public network access","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."},
"AZ-PE-005": {"control_id":"N/A-PE-005","control_name":"Recovery Services public network access","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."},
"AZ-PE-006": {"control_id":"N/A-PE-006","control_name":"Private endpoint connection approval","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the private-endpoint connection state."},
"AZ-BAK-001": {"control_id":"N/A-BAK-001","control_name":"Backup soft-delete protection","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup recovery control."},
"AZ-BAK-002": {"control_id":"N/A-BAK-002","control_name":"Backup vault immutability","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup immutability control."},
"AZ-BAK-004": {"control_id":"N/A-BAK-004","control_name":"Backup multi-user authorization","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup authorization control."},
"AZ-BAK-006": {"control_id":"N/A-BAK-006","control_name":"Backup security monitoring","description":"No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup monitoring control."},
"AZ-FUNC-001": {
"control_id": "N/A-FUNC-001",
"control_name": "Function App HTTPS enforcement",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific HTTPS control."
},
"AZ-FUNC-002": {
"control_id": "N/A-FUNC-002",
"control_name": "Function App minimum TLS version",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific TLS control."
},
"AZ-FUNC-003": {
"control_id": "N/A-FUNC-003",
"control_name": "Function App FTP publishing",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific publishing control."
},
"AZ-FUNC-004": {
"control_id": "N/A-FUNC-004",
"control_name": "Function App remote debugging",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific debugging control."
},
"AZ-FUNC-005": {
"control_id": "N/A-FUNC-005",
"control_name": "Function App managed identity",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific identity control."
},
"AZ-PE-001": {
"control_id": "N/A-PE-001",
"control_name": "Storage public network access",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."
},
"AZ-PE-002": {
"control_id": "N/A-PE-002",
"control_name": "SQL public network access",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."
},
"AZ-PE-003": {
"control_id": "N/A-PE-003",
"control_name": "PostgreSQL public network access",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific private-networking control."
},
"AZ-PE-004": {
"control_id": "N/A-PE-004",
"control_name": "App Service public network access",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."
},
"AZ-PE-005": {
"control_id": "N/A-PE-005",
"control_name": "Recovery Services public network access",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the service-specific Private Link control."
},
"AZ-PE-006": {
"control_id": "N/A-PE-006",
"control_name": "Private endpoint connection approval",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the private-endpoint connection state."
},
"AZ-BAK-001": {
"control_id": "N/A-BAK-001",
"control_name": "Backup soft-delete protection",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup recovery control."
},
"AZ-BAK-002": {
"control_id": "N/A-BAK-002",
"control_name": "Backup vault immutability",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup immutability control."
},
"AZ-BAK-004": {
"control_id": "N/A-BAK-004",
"control_name": "Backup multi-user authorization",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup authorization control."
},
"AZ-BAK-006": {
"control_id": "N/A-BAK-006",
"control_name": "Backup security monitoring",
"description": "No direct CIS Azure recommendation is assigned; OpenShield evaluates the Azure Backup monitoring control."
},
"AZ-SC-001": {
"control_id": "N/A-SC-001",
"control_name": "Container Registry admin user baseline (not mapped in CIS Azure Foundations 2.0.0)",
Expand Down Expand Up @@ -473,55 +533,25 @@
"control_name": "Ensure That 'Notify about alerts with the following severity' is Set to 'High'",
"description": "No enabled Azure Monitor action group with a notification receiver exists, and no Sentinel automation rule routes incidents onward. CIS 2.1.20 requires Defender security alerts to notify a monitored destination; this rule generalizes that requirement to the concrete Azure notification primitive (action groups) and the Sentinel-native incident routing mechanism (automation rules)."
},
"AZ-NET-018": {
"control_id": "N/A-NET-018",
"control_name": "Private Endpoint public access baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Private connectivity should replace unnecessary public PaaS exposure; CIS Azure Foundations 2.0.0 has no universal control covering every supported Private Link target."
},
"AZ-NET-019": {
"control_id": "N/A-NET-019",
"control_name": "Private Endpoint connection approval baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Private Endpoint connections must be approved to provide the intended private path; no universal CIS Azure Foundations 2.0.0 recommendation covers this state."
},
"AZ-NET-020": {
"control_id": "N/A-NET-020",
"control_name": "Private Endpoint DNS association baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Private Endpoints require service-appropriate private DNS integration; CIS Azure Foundations 2.0.0 has no universal recommendation for this association."
},
"AZ-NET-021": {
"control_id": "N/A-NET-021",
"control_name": "Private Endpoint FQDN resolution baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Private Endpoint names should resolve to private addresses; CIS Azure Foundations 2.0.0 has no universal recommendation for this resolution evidence."
},
"AZ-NET-022": {
"control_id": "N/A-NET-022",
"control_name": "Critical PaaS public exposure baseline (no universal CIS Azure Foundations 2.0.0 control)",
"description": "Critical PaaS resources should use private access or an approved exception; CIS Azure Foundations 2.0.0 provides service-specific rather than universal coverage."
},
"AZ-NET-023": {
"control_id": "N/A-NET-023",
"control_name": "Azure Firewall threat intelligence enforcement baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "AlertAndDeny blocks traffic involving known malicious addresses and domains; CIS Azure Foundations 2.0.0 has no direct recommendation for this mode."
},
"AZ-NET-024": {
"control_id": "N/A-NET-024",
"control_name": "Application Gateway WAF Prevention mode baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Prevention mode blocks matching application attacks; CIS Azure Foundations 2.0.0 has no direct recommendation for the gateway mode."
},
"AZ-NET-025": {
"control_id": "N/A-NET-025",
"control_name": "Application Gateway WAF diagnostic logging baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Access, performance, and firewall logs support perimeter monitoring; CIS Azure Foundations 2.0.0 has no direct universal recommendation for all categories."
},
"AZ-NET-026": {
"control_id": "N/A-NET-026",
"control_name": "Current WAF managed rules and bot protection baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Current base and bot managed rule sets protect the application perimeter; CIS Azure Foundations 2.0.0 has no direct rule-set-version recommendation."
},
"AZ-NET-027": {
"control_id": "N/A-NET-027",
"control_name": "Internet-facing application rate limiting baseline (no direct CIS Azure Foundations 2.0.0 control)",
"description": "Rate limiting protects public applications from abusive request volume; CIS Azure Foundations 2.0.0 has no direct Application Gateway rate-rule recommendation."
"AZ-CI-001": {
"control_id": "N/A-CI-001",
"control_name": "CI/CD Workflow Uses Long-Lived Azure Credentials",
"description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets."
},
"AZ-CI-002": {
"control_id": "N/A-CI-002",
"control_name": "CI/CD Workflow Has Unnecessarily Broad Token Permissions",
"description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes."
},
"AZ-CI-003": {
"control_id": "N/A-CI-003",
"control_name": "Third-Party Workflow Action Not Pinned to Immutable Commit SHA",
"description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags."
},
"AZ-CI-004": {
"control_id": "N/A-CI-004",
"control_name": "Untrusted Pull-Request Input Reaches Privileged Workflow Context",
"description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access."
}
}
}
60 changes: 15 additions & 45 deletions compliance/frameworks/iso27001.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,55 +533,25 @@
"control_name": "Reporting information security events",
"description": "No monitored destination exists for security alerts or Sentinel incidents. A.16.1.2 requires information security events to be reported through appropriate management channels as quickly as possible; an alert with no notified recipient cannot be reported or acted on."
},
"AZ-NET-018": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "PaaS resources using Private Link should not retain unnecessary public network exposure."
},
"AZ-NET-019": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Private Endpoint connections must be approved and operational."
},
"AZ-NET-020": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Private Endpoints require an associated service-appropriate Private DNS zone."
},
"AZ-NET-021": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Private Endpoint FQDNs must resolve to private addresses through the controlled network path."
},
"AZ-NET-022": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Critical PaaS resources restrict public exposure unless an approved exception exists."
"AZ-CI-001": {
"control_id": "A.9.2.4",
"control_name": "CI/CD Workflow Uses Long-Lived Azure Credentials",
"description": "CI/CD workflows should use workload identity federation (OIDC) instead of long-lived client secrets or storage keys stored as repository secrets."
},
"AZ-NET-023": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Azure Firewall denies traffic identified by Microsoft threat intelligence."
},
"AZ-NET-024": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Application Gateway WAF operates in Prevention mode at the application boundary."
"AZ-CI-002": {
"control_id": "A.9.2.3",
"control_name": "CI/CD Workflow Has Unnecessarily Broad Token Permissions",
"description": "Workflow GITHUB_TOKEN permissions should follow least privilege with an explicit permissions block granting only required scopes."
},
"AZ-NET-025": {
"control_id": "A.12.4.1",
"control_name": "Event logging",
"description": "Application Gateway WAF diagnostic categories are exported to an approved monitoring destination."
"AZ-CI-003": {
"control_id": "A.12.1.2",
"control_name": "Third-Party Workflow Action Not Pinned to Immutable Commit SHA",
"description": "Third-party GitHub Actions must be pinned to a full 40-character commit SHA to prevent supply-chain attacks via mutable tags."
},
"AZ-NET-026": {
"AZ-CI-004": {
"control_id": "A.14.2.5",
"control_name": "Secure system engineering principles",
"description": "Current managed application and bot rules are maintained at the web perimeter."
},
"AZ-NET-027": {
"control_id": "A.13.1.1",
"control_name": "Network controls",
"description": "Rate limiting protects internet-facing application entry points."
"control_name": "Untrusted Pull-Request Input Reaches Privileged Workflow Context",
"description": "Workflows triggered by pull_request_target or workflow_run must not check out or execute untrusted PR code in a context with secret access."
}
}
}
Loading