[Bug]: Key Vault: enableRbacAuthorization is always reported as false (New-MonkeyVaultObject reads the property at the wrong level)
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 86/100
调研方向
从 core/api/azure/resourcemanagement/helpers/keyvault/New-MonkeyVaultObject.ps1 第 60 行开始，检查如何读取 ARM 响应中的 properties.enableRbacAuthorization。将该属性分别设为 true、false 和缺失，运行相关的 Key Vault 规则或测试；当启用 RBAC 的 vault 通过规则，且值为 false 或缺失时仍保持禁用，即为完成。
由索引模型根据 Issue 内容生成。
描述
What happened?
For every Key Vault, Monkey365 reports "RBAC Enabled: false", including vaults that use the Azure RBAC permission model. The rule "Ensure that RBAC is enabled for Azure Key Vault" (azure_key_vault_rbac_disabled) therefore fails for all vaults.
Cause: core/api/azure/resourcemanagement/helpers/keyvault/New-MonkeyVaultObject.ps1, line 60:
enableRbacAuthorization = if($null -ne $InputObject.Psobject.Properties.Item('enableRbacAuthorization')){$InputObject.properties.enableRbacAuthorization}else{$false};
The check looks for enableRbacAuthorization on the top level of the ARM object, but ARM returns it under properties. The condition is never true, so the value is always $false.
How to reproduce it
- Create a Key Vault with the RBAC permission model (
properties.enableRbacAuthorization = true, checked with an ARM GET). - Run
Invoke-Monkey365 -Instance Azurewith the default ruleset. - The vault is reported with RBAC disabled.
Expected behavior
Vaults with properties.enableRbacAuthorization = true pass the rule.
Suggested fix
enableRbacAuthorization = if($null -ne $InputObject.properties -and $null -ne $InputObject.properties.PsObject.Properties.Item('enableRbacAuthorization')){$InputObject.properties.enableRbacAuthorization}else{$false};
We apply this change locally and tested it against 1.0.5 with true, false and a missing property.
From where are you running Monkey365?
- Resource: Docker container
- OS: Linux (Ubuntu 24.04)
- PowerShell Version: 7.6.9
- Monkey365 Version: 1.0.5 (also seen in 1.0.0, PowerShell Gallery)
- Others: app-only authentication with access tokens
Additional context
The purge protection rule has a similar path problem; reported separately.
- 主要语言
- PowerShell
- 星标
- 1.4k
- 派生
- 144
- 平均合并
- 1 天 21 小时
- 30 天内合并 PR
- 1
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
silverhack/monkey365 的其他 Issue
-
bug status/needs-triage
难度 2/5 1-3 小时 新手友好度 78/100
silverhack/monkey365#199 ·
-
bug status/needs-triage
难度 4/5 3-5 天 新手友好度 56/100
silverhack/monkey365#198 ·
-
documentation enhancement help wanted impact-low priority-medium question
难度 4/5 3-5 天 新手友好度 68/100
silverhack/monkey365#187 · 1 条评论 ·
-
documentation enhancement epic priority-medium
难度 5/5 一周以上 新手友好度 30/100
silverhack/monkey365#184 ·
-
Expose domain-level context for SPF / DKIM / DMARC findings in Exchange Online可能重新可做 @silverhack 于 112 天前认领，目前没有进行中的 PR。 未关闭enhancement
silverhack/monkey365#167 · 3 条评论 · 已指派 1 人 ·
查看 silverhack/monkey365 的全部 Issue
相似的 Issue
-
CRT transfer manager mutates the caller's ExtraArgs, so reusing the dict fails on the next upload未关闭
难度 2/5 1-3 小时 新手友好度 82/100
boto/s3transfer#433 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
-
platform rust
难度 2/5 1-3 小时 新手友好度 76/100
laithalsaadoon/microvms-agentd#758 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 73/100
MicrosoftLearning/eShopOnWeb#466 ·
-
Updating an `OidcIssuer` without `thumbprints` fails with "You must provide at least one thumbprint"未关闭Bug kind/bug pulumi/pulumi-pulumiservice R1 S1
难度 2/5 1-3 小时 新手友好度 83/100
pulumi/pulumi-pulumiservice#1370 ·
维护者通常 1 天内回复