🧠 Azure VM Scale Set Instance allows public access to Oracle DBMS ports - prod.logic.yaml 🟢
- Contextual name: 🧠 prod.logic.yaml 🟢
- ID:
/ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml - Located in: 📝 Azure VM Scale Set Instance allows public access to Oracle DBMS ports 🟢
Flags
Input Type
| Type | API Name | Extracts | Extract Files | Logic Files | |
|---|---|---|---|---|---|
| 🔒 | 📕 Azure VM Scale Set Instance | CA10__CaAzureVmScaleSetInstance__c | 1 | 1 | 17 |
Uses
Test Results 🟢
Generated at: 2025-05-03T12:05:27.619819100Z Open
| Result | Id | Condition Index | Condition Text | Runtime Error |
|---|---|---|---|---|
| 🟢 | test-0 | ✔️ 99 | ✔️ isDisappeared(CA10__disappearanceTime__c) | ✔️ null |
| 🟢 | test-1 | ✔️ 200 | ✔️ otherwise | ✔️ null |
| 🟢 | test-2 | ✔️ 200 | ✔️ otherwise | ✔️ null |
| 🟢 | test-3 | ✔️ 200 | ✔️ otherwise | ✔️ null |
| 🟢 | test-4 | ✔️ 200 | ✔️ otherwise | ✔️ null |
| 🟢 | test-5 | ✔️ 199 | ✔️ CA10Z1__Azure_VM_Scale_Set_Instance_Network_Ints__r.has(INCOMPLIANT) | ✔️ null |
| 🟢 | test-6 | ✔️ 199 | ✔️ CA10Z1__Azure_VM_Scale_Set_Instance_Network_Ints__r.has(INCOMPLIANT) | ✔️ null |
| 🟢 | test-7 | ✔️ 200 | ✔️ otherwise | ✔️ null |
Generation
| File | MD5 | |
|---|---|---|
| Open | /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/policy.yaml | E5AFE0464C34B88F5B2B444C3F0E0DF4 |
| Open | /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml | 4A62FA14084E1B6B85C725F9748F099B |
| Open | /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/test-data.json | 42C26C4B55E2E667F01CD0265EABE733 |
| Open | /types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml | A60C817EFBC8F066D6D082898E8597BC |
Generate FULL script
java -jar repo-manager.jar policies generate FULL /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml
Generate DEBUG script
java -jar repo-manager.jar policies generate DEBUG /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml
Generate CAPTURE_TEST_DATA script
java -jar repo-manager.jar policies generate CAPTURE_TEST_DATA /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml
Generate TESTS script
java -jar repo-manager.jar policies generate TESTS /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml
Execute tests
java -jar repo-manager.jar policies test /ce/ca/azure/vm-scale-set/instance-allows-unrestricted-traffic-to-oracle-dbms/prod.logic.yaml
Content
---
inputType: "CA10__CaAzureVmScaleSetInstance__c"
testData:
- file: test-data.json
conditions:
- status: "INCOMPLIANT"
currentStateMessage: "The Instance has a Network Interface with a NSG with a rule that allows Oracle DBMS access from the Internet."
remediationMessage: "Restrict inbound Oracle DBMS access from the Internet."
check:
RELATED_LIST_HAS:
status: "INCOMPLIANT"
relationshipName: "CA10Z1__Azure_VM_Scale_Set_Instance_Network_Ints__r"
otherwise:
status: "COMPLIANT"
currentStateMessage: "The Instance doesn't allow Oracle DBMS access from the Internet."
relatedLists:
- relationshipName: "CA10Z1__Azure_VM_Scale_Set_Instance_Network_Ints__r"
importExtracts:
- file: "/types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml"
conditions:
- status: "INCOMPLIANT"
currentStateMessage: "Interface with publicly accessible Network Security Group"
check:
RELATED_LIST_HAS:
status: "INCOMPLIANT"
relationshipName: "CA10Z1__networkSecurityGroup__r.CA10__Azure_Network_Security_Group_Rules__r"
otherwise:
status: "COMPLIANT"
currentStateMessage: "Interface is not publicly accessible"
relatedLists:
- relationshipName: "CA10Z1__networkSecurityGroup__r.CA10__Azure_Network_Security_Group_Rules__r"
importExtracts:
- file: "/types/CA10__CaAzureNetworkSecurityGroupRule__c/object.extracts.yaml"
conditions:
# sort public group rules
- status: "INAPPLICABLE"
currentStateMessage: "NSG Outbound Rule."
check:
NOT_EQUAL:
left:
EXTRACT: "CA10__direction__c"
right:
TEXT: "Inbound"
- status: "INAPPLICABLE"
currentStateMessage: "NSG Deny Rule."
check:
NOT_EQUAL:
left:
EXTRACT: "CA10__access__c"
right:
TEXT: "Allow"
- status: "INAPPLICABLE"
currentStateMessage: "NSG Rule with the port other than TCP or Any."
check:
NOT:
arg:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__protocol__c"
right:
TEXT: "Tcp"
- IS_EQUAL:
left:
EXTRACT: "CA10__protocol__c"
right:
TEXT: "*"
- IS_EQUAL:
left:
EXTRACT: "CA10__protocol__c"
right:
TEXT: "null"
- status: "INAPPLICABLE"
currentStateMessage: "NSG Rule source is not any address."
check:
NOT:
arg:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__sourceAddressPrefix__c"
right:
TEXT: "Internet"
- IS_EQUAL:
left:
EXTRACT: "CA10__sourceAddressPrefix__c"
right:
TEXT: "*"
- IS_EQUAL:
left:
EXTRACT: "CA10__sourceAddressPrefix__c"
right:
TEXT: "0.0.0.0"
- IS_EQUAL:
left:
EXTRACT: "CA10__sourceAddressPrefix__c"
right:
TEXT: "Any"
- CONTAINS:
arg:
EXTRACT: "CA10__sourceAddressPrefix__c"
substring:
TEXT: "/0"
# ports 1521, 1830, 2483 and 2484
- status: "INCOMPLIANT"
currentStateMessage: "NSG Rule with Oracle DBMS port 1521 with public access from the Internet."
remediationMessage: "Restrict access to the Oracle DBMS port"
check:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__destinationPortRange__c"
right:
TEXT: "1521"
- AND:
args:
- LESS_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortFrom__c"
right:
NUMBER: 1521.0
- GREATER_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortTo__c"
right:
NUMBER: 1521.0
- status: "INCOMPLIANT"
currentStateMessage: "NSG Rule with Oracle DBMS port 1830 with public access from the Internet."
remediationMessage: "Restrict access to the Oracle DBMS port"
check:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__destinationPortRange__c"
right:
TEXT: "1830"
- AND:
args:
- LESS_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortFrom__c"
right:
NUMBER: 1830.0
- GREATER_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortTo__c"
right:
NUMBER: 1830.0
- status: "INCOMPLIANT"
currentStateMessage: "NSG Rule with Oracle DBMS port 2483 with public access from the Internet."
remediationMessage: "Restrict access to the Oracle DBMS port"
check:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__destinationPortRange__c"
right:
TEXT: "2483"
- AND:
args:
- LESS_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortFrom__c"
right:
NUMBER: 2483.0
- GREATER_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortTo__c"
right:
NUMBER: 2483.0
- status: "INCOMPLIANT"
currentStateMessage: "NSG Rule with Oracle DBMS port 2484 with public access from the Internet."
remediationMessage: "Restrict access to the Oracle DBMS port"
check:
OR:
args:
- IS_EQUAL:
left:
EXTRACT: "CA10__destinationPortRange__c"
right:
TEXT: "2484"
- AND:
args:
- LESS_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortFrom__c"
right:
NUMBER: 2484.0
- GREATER_THAN_EQUAL:
left:
EXTRACT: "CA10__destinationPortTo__c"
right:
NUMBER: 2484.0
otherwise:
status: "COMPLIANT"
currentStateMessage: "NSG rule without public access on Oracle DBMS port"