[Asset Inventory][Azure] Add storage assets #2576
Conversation
|
This pull request does not have a backport label. Could you fix it @kubasobon? 🙏
|
| SubTypeAzureStorageQueue AssetSubType = "azure-storage-queue" | ||
| SubTypeAzureStorageQueueService AssetSubType = "azure-storage-queue-service" |
There was a problem hiding this comment.
What is the difference between azure-storage-queue and azure-storage-queue-service?
There was a problem hiding this comment.
Queue Service (and other Services in this context) are properties tied to Storage Account, e.g. Storage Account > Blob Service > Blob anonymous access: enabled.
Relationship chart looks like this:
graph LR;
SA[Storage Account];
B[Blob Service];
F[File Service];
Q[Queue Service];
T[Table Service];
BB[Blobs...];
FF[Files...];
QQ[Queues...];
TT[Tables...];
SA --> B;
SA --> F;
SA --> Q;
SA --> T;
SA --> BB;
SA --> FF;
SA --> QQ;
SA --> TT;
| } | ||
|
|
||
| func (f *storageFetcher) fetch(ctx context.Context, storageAccounts []azurelib.AzureAsset, resourceName string, function storageProviderFunc, classification inventory.AssetClassification, assetChan chan<- inventory.AssetEvent) { | ||
| f.logger.Infof("Fetching %s", resourceName) |
There was a problem hiding this comment.
Do we have this for every fetcher? I wonder if we are not over-logging
There was a problem hiding this comment.
Yes we do. Assuming we'll have ~200 assets, even if we're scanning every minute, that's 400 lines/minute. I'd say that is a very tame amount of logs. If we want to change the approach, then let's do it in a separate PR for all of the fetchers.
internal/resources/providers/azurelib/inventory/storage_provider.go
Outdated
Show resolved
Hide resolved
Summary of your changes
Add 3 storage assets: Queues, Queue Services, and Blob Services.
Related Issues
Closes https://github.com/elastic/security-team/issues/10162
Closes https://github.com/elastic/security-team/issues/10163
Checklist