azure-auditor

Azure Auditor

Auditor for Azure resources and settings with Prometheus metrics (violations) for alerting

Audit reports:

• ResourceGroups
• RoleAssignments
• ResourceProviders
• ResourceProviderFeatures
• Keyvault AccessPolicies
• ResourceGraph queries

Usage

Usage:
  azure-auditor [OPTIONS]

Application Options:
      --log.debug                     debug mode [$LOG_DEBUG]
      --log.trace                     trace mode [$LOG_TRACE]
      --log.json                      Switch log output to json format [$LOG_JSON]
      --azure.environment=            Azure environment name (default: AZUREPUBLICCLOUD)
                                      [$AZURE_ENVIRONMENT]
      --azure.subscription=           Azure subscription ID [$AZURE_SUBSCRIPTION_ID]
      --report.title=                 Report title [$REPORT_TITLE]
      --cron.keytvaultaccesspolicies= Cronjob for KeyVault AccessPolicies report (default: 0 * * * *)
                                      [$CRON_KEYTVAULTACCESSPOLICIES]
      --cron.resourcegroups=          Cronjob for ResourceGroups report (default: */30 * * * *)
                                      [$CRON_RESOURCEGROUPS]
      --cron.resourceproviders=       Cronjob for ResourceProviders report (default: 0 * * * *)
                                      [$CRON_RESOURCEPROVIDERS]
      --cron.roleassignments=         Cronjob for RoleAssignments report (default: */5 * * * *)
                                      [$CRON_ROLEASSIGNMENTS]
      --cron.resourcegraph=           Cronjob for ResourceGraph report (default: 15 * * * *)
                                      [$CRON_RESOURCEGRAPH]
      --config=                       Config file path [$CONFIG]
      --dry-run                       Dry Run (report only) [$DRYRUN]
      --bind=                         Server address (default: :8080) [$SERVER_BIND]
      --server.path.report=           Server path for report (default: /report) [$SERVER_PATH_REPORT]

Help Options:
  -h, --help                          Show this help message

crons can be disabled by setting them to empty string or false

for Azure API authentication (using ENV vars) see https://docs.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication

For AzureCLI authentication set AZURE_AUTH=az

Configuration file

see (example.yaml)[/example.yaml] as for example audit rules

Metrics

AzureTracing metrics

(with 22.2.0 and later)

Azuretracing metrics collects latency and latency from azure-sdk-for-go and creates metrics and is controllable using environment variables (eg. setting buckets, disabling metrics or disable autoreset).

Settings

Endpoints