[Bug]: Key Vault: "Ensure 'Purge protection' is set to 'Enabled'" never fails because the rule queries properties.enablePurgeProtection
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 78/100
调研方向
打开 rules/findings/azure/keyvault/azure-keyvault-purge-protection-not-enabled.json，并将其条件与可恢复的 Key Vault 规则进行比较。检查 New-MonkeyVaultObject.ps1 如何规范化缺失值，然后针对未启用清除保护的 vault 运行该规则。完成标准是该 vault 未通过清除保护规则，而不是通过。
由索引模型根据 Issue 内容生成。
描述
What happened?
Every Key Vault without purge protection is reported as pass for azure_key_vault_purge_protection_disabled (rules/findings/azure/keyvault/azure-keyvault-purge-protection-not-enabled.json).
The rule condition is:
["properties.enablePurgeProtection", "eq", "false"]
properties holds the raw ARM properties of the vault. ARM only accepts true for enablePurgeProtection (Key Vault reference: "Enabling this functionality is irreversible - that is, the property does not accept false as its value"). A vault that never had purge protection enabled has no enablePurgeProtection value at all, and $null -eq $false is false, so the condition never matches.
New-MonkeyVaultObject.ps1 already normalises the value (line 75):
protection = [PSCustomObject]@{
enablePurgeProtection = If($null -ne $InputObject.Properties.PsObject.Properties.Item('enablePurgeProtection')){$InputObject.Properties.enablePurgeProtection}Else{$false};
How to reproduce it
- Use a Key Vault created without purge protection.
az keyvault show -n <vault> --query "{purge:properties.enablePurgeProtection, softDelete:properties.enableSoftDelete}"returns"purge": null, "softDelete": true. - Run
Invoke-Monkey365 -Instance Azurewith the default ruleset. azure_key_vault_purge_protection_disabledis reported as pass.
Expected behavior
The rule fails for vaults without purge protection.
Suggested fix
Query the normalised value, as the "recoverable" rule already does:
["protection.enablePurgeProtection", "eq", "false"]
From where are you running Monkey365?
- Resource: Docker container
- OS: Linux (Ubuntu 24.04)
- PowerShell Version: 7.6.9
- Monkey365 Version: 1.0.5 (also 1.0.0, PowerShell Gallery)
- Others: app-only authentication with access tokens
Additional context
Same pattern as the Key Vault RBAC issue (value read or queried at the wrong level), reported separately.
- 主要语言
- PowerShell
- 星标
- 1.4k
- 派生
- 144
- 平均合并
- 1 天 21 小时
- 30 天内合并 PR
- 1
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
silverhack/monkey365 的其他 Issue
-
bug status/needs-triage
难度 2/5 1-3 小时 新手友好度 86/100
silverhack/monkey365#200 ·
-
bug status/needs-triage
难度 4/5 3-5 天 新手友好度 56/100
silverhack/monkey365#198 ·
-
documentation enhancement help wanted impact-low priority-medium question
难度 4/5 3-5 天 新手友好度 68/100
silverhack/monkey365#187 · 1 条评论 ·
-
documentation enhancement epic priority-medium
难度 5/5 一周以上 新手友好度 30/100
silverhack/monkey365#184 ·
-
Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online可能重新可做 @silverhack 于 112 天前认领，目前没有进行中的 PR。 未关闭enhancement
silverhack/monkey365#167 · 3 条评论 · 已指派 1 人 ·
查看 silverhack/monkey365 的全部 Issue
相似的 Issue
-
CRT transfer manager mutates the caller's ExtraArgs, so reusing the dict fails on the next upload未关闭
难度 2/5 1-3 小时 新手友好度 82/100
boto/s3transfer#433 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
-
platform rust
难度 2/5 1-3 小时 新手友好度 76/100
laithalsaadoon/microvms-agentd#758 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 73/100
MicrosoftLearning/eShopOnWeb#466 ·
-
Updating an `OidcIssuer` without `thumbprints` fails with "You must provide at least one thumbprint"未关闭Bug kind/bug pulumi/pulumi-pulumiservice R1 S1
难度 2/5 1-3 小时 新手友好度 83/100
pulumi/pulumi-pulumiservice#1370 ·
维护者通常 1 天内回复