jodyford added graph query for G02.08

[jodyford-msft]

Description

addedAzure Resource Graph query that checks for key vaults with firewalls and virtual network service endpoints or private endpoints enabled, you can use the following query:

Related Issue

N/A

Checklist

• I've tested my changes to ensure they are ready for review.
• I've read the CONTRIBUTING.md guide.
• I've updated the documentation (if applicable).
• Resource Graph queries have been included (and tested) for recommendations where ever possible¹.
• Resource Graph queries have NOT been included (please explain below).

Additional Information

Is there any additional context, screenshots, or considerations that might help in the review process? Please include them here.

Reviewer Notes

Is there a specific area you’d like feedback on? Please highlight it here. We're here to help and learn together! 💡

Footnotes

1. Details on how to add Azure Resource Graph queries to recommendations can be found here. ↩

[jodyford-msft]

[brsteph]

@jodyford-msft - So this query is only going to show the ones that are compliant, but not the non-compliant ones, from my understanding. I think we want to take out the "where compliant" to show all.

I was liking the output of:

Resources | where type =~ 'microsoft.keyvault/vaults' | extend properties = parse_json(properties) | project id, name, location, firewallEnabled = properties.networkAcls.defaultAction, privateEndpointConnections = properties.privateEndpointConnections | extend compliant = iff(firewallEnabled == 'Deny' or array_length(privateEndpointConnections) > 0, 1, 0) | project id, compliant, name, location