azure-tls-probe

KO | EN

gitlite — search

#hacktoberfest #typescript #llm #go #android #nodejs #macos #java #windows #awesome #kubernetes #pytorch #openai #open-source

azure-tls-probe

(★ 3)

CLI/KQL probe to detect Azure Storage Accounts using TLS < 1.2 (brownfield sweep).

azure-tls-probe 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Azure TLS Probe (Storage Accounts)

Small CLI + KQL helper to support TLS 1.0/1.1 retirement for Azure Storage.

v1 gives a fast **inventory of risky Storage Accounts** (based on `minimumTlsVersion`).

v2 builds on top of that inventory to provide a **dependency / blast radius probe** for
controlled TLS 1.2 enforcement (instead of pure scream tests).

---

## Requirements

- Azure CLI (`az`)
- Resource Graph (`az extension add --name resource-graph`)
- Bash (Linux/macOS/WSL)
- (Optional for v2) Python + KQL + App Insights / Storage diagnostics

---

## What v1 does (Inventory)

- Uses **Azure Resource Graph + KQL** to list all Storage Accounts.
- Flags accounts with:
  - `TLS1_0`
  - `TLS1_1`
  - missing `minimumTlsVersion` (treated as potentially risky)
- Outputs:
  - readable CLI table
  - `tls_report_storage.csv` for follow-up work (used by v2 / ops / auditors)

---

## Usage (v1)

```bash
az login

# current subscription context
./tls.sh

# or scan across all subscriptions
./tls.sh --all-subs
```

### CLI table snippet

```bash
SubscriptionId                        ResourceGroup       Name           Location    MinimumTlsVersion    TlsFlag
------------------------------------  ------------------  -------------  ----------  -------------------  ---------
<subscriptionId>                      neb-weu-rg-tfstate  nebstateweu01  westeurope  TLS1_0               TLS1_0
```

### CSV snippet (1 line)

```bash
subscriptionId,resourceGroup,name,location,minimumTlsVersion,tlsFlag
<subscriptionId>,neb-weu-rg-tfstate,nebstateweu01,westeurope,TLS1_0,TLS1_0
```

---

## KQL (Azure Resource Graph)

The same inventory can be pulled via ARG (useful for dashboards / fleet sweeps):

```bash
az graph query -q @"queries/storage_tls_inventory_v1.kql" -o json
```

Sample JSON:

```json
{
  "data": [
    {
      "resourceGroup": "neb-weu-rg-tfstate",
      "name": "nebstateweu01",
      "location": "westeurope",
      "minimumTlsVersion": "TLS1_0",
      "tlsFlag": "TLS1_0"
    }
  ],
  "count": 1
}
```

---

## TLS Retirement – v2 (Dependency / Blast Radius Probe)

v2 builds on top of the v1 CSV:

> v1 answers:  
> “Which Storage Accounts are potentially risky for TLS retirement?”

> v2 answers:  
> “Which applications and hosts are likely impacted if we enforce TLS 1.2 on those accounts?”

Instead of a “magic TLS version scanner”, v2 creates a **dependency + blast radius map**:

- **Input:** `tls_report_storage.csv` from v1  
- **Signals:**
  - Application Insights / OTEL (dependencies on `*.blob.core.windows.net`, etc.)
  - Storage logs (caller IP, operation type, usage intensity)

- **Output:** `tls_dependencies.csv` with candidates (apps, hosts, subnets, owners)  
  → used for TLS 1.2 validation, coordination and tests.

**Important:** v2 does **not** detect which client still negotiates TLS < 1.2.  
Azure telemetry does not expose negotiated TLS version for Storage today.  
The probe reduces the unknown blast radius and avoids pure scream tests.

---

## Structure

- `tls.sh` – main entrypoint (currently v1 only)
- `queries/` – shared KQL queries (inventory + future probes)
- `v1_tls-inventory/` – docs & examples for the Storage TLS inventory
- `v2_tls-dep-probe/` – dependency / blast radius probe built on top of the v1 CSV

---

## v1 – Storage TLS Inventory

- Question: “Which Storage Accounts are potentially risky for TLS retirement?”
- Tech: Azure Resource Graph + KQL, CSV export.
- Output: `tls_report_storage.csv`
- Details: see [`v1_tls-inventory/`](./v1_tls-inventory)

---

## v2 – TLS Dependency / Blast Radius Probe

- Question: “Which apps/hosts are likely impacted if we enforce TLS 1.2?”
- Tech: uses v1 CSV + App Insights / Storage logs / OTEL (if available)
- Output: `tls_dependencies.csv`
- Details: see [`v2_tls-dep-probe/`](./v2_tls-dep-probe)

---

## Quick Start (minimal)

### Option A — Local dry-run (no Azure, sample data)

This uses only example data from the repo and does **not query Azure**.

```bash
cd v2_tls-dep-probe

python3 scripts/tls_dep_probe.py \
  --inventory ../v1_tls-inventory/examples/sample_tls_report_storage.csv \
  --out examples/sample_tls_dependencies.csv
```

Produces a dependency skeleton CSV you can inspect in Excel / VS Code.

### Option B — Real run (uses your Azure tenant)

Run v1 (inventory):
```bash
./tls.sh              # current subscription
# or
./tls.sh --all-subs   # all accessible subscriptions
```

This writes:
```bash
v1_tls-inventory/tls_report_storage.csv
```

Then run v2 (dependency probe):
```bash
cd v2_tls-dep-probe

python3 scripts/tls_dep_probe.py \
  --inventory ../v1_tls-inventory/tls_report_storage.csv \
  --out tls_dependencies.csv
  ```

This produces a dependency worksheet for TLS 1.2 planning.

azure-tls-probe

azure-tls-probe 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

azure-tls-probe

azure-tls-probe 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README