azureenergylabelerlib package¶

Submodules¶

azureenergylabelerlib.azureenergylabelerlib module¶

Main code for azureenergylabelerlib.

class azureenergylabelerlib.azureenergylabelerlib.AzureEnergyLabeler(tenant_id, frameworks={'Azure CIS 1.1.0', 'Microsoft cloud security benchmark'}, tenant_thresholds=[{'label': 'A', 'percentage': 90}, {'label': 'B', 'percentage': 70}, {'label': 'C', 'percentage': 50}, {'label': 'D', 'percentage': 30}, {'label': 'E', 'percentage': 20}], resource_group_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], subscription_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], credentials=None, allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶

Bases: object

Labeling subscriptions based on findings and label configurations.

Parameters:

tenant_id (str) – Azure Tenant ID to collect energy label, for example: 18d9dec0-d762-11ec-9cb5-00155da09878.
frameworks (set[str]) – Frameworks taken into account when generating the energy label. Defaults to DEFAULT_DEFENDER_FOR_CLOUD_FRAMEWORKS
tenant_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for the tenant. Defaults to TENANT_THRESHOLDS
resource_group_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for resource groups. Defaults to RESOURCE_GROUP_THRESHOLDS
subscription_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for resource groups. Defaults to SUBSCRIPTION_THRESHOLDS
credentials (Any) –
One of identity Credential object containing the credentials used to access the Azure API. If not supplied, the library will create a DefaultAzureCredential and attempt to authenticate in the following order: 1. A service principal configured by environment variables. See EnvironmentCredential

for more details.
1. An Azure managed identity. See ManagedIdentityCredential for more details.
2. On Windows only: a user who has signed in with a Microsoft application, such as Visual Studio. If multiple
  identities are in the cache, then the value of the environment variable AZURE_USERNAME is used to select which identity to use. See SharedTokenCacheCredential for more details.
3. The user currently signed in to Visual Studio Code.
4. The identity currently logged in to the Azure CLI.
5. The identity currently logged in to Azure PowerShell.
allowed_subscription_ids (Any) – Inclusion list of subscripitions to be evaluated
denied_subscription_ids (Any) – Exclude list of subscriptions to be evaluated

property defender_for_cloud¶: Defender for cloud.

property defender_for_cloud_findings¶: Defender for cloud findings.

property filtered_defender_for_cloud_findings¶: Filtered defender for cloud findings.

property labeled_subscriptions_energy_label¶: Energy label of the labeled subscriptions.

property matching_frameworks¶: The frameworks provided to match the findings of.

property tenant¶: Tenant.

property tenant_energy_label¶: Energy label of the Azure Tenant.

property tenant_labeled_subscriptions¶: The tenant labeled subscription objects.

azureenergylabelerlib.azureenergylabelerlibexceptions module¶

Custom exception code for azureenergylabelerlib.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidCredentials[source]¶

Bases: Exception

Credentials provided are not valid.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidFrameworks[source]¶

Bases: Exception

The frameworks provided are not valid.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidPath[source]¶

Bases: Exception

The path provided is not valid.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidSubscriptionListProvided[source]¶

Bases: Exception

The list of subscriptions provided are not valid Azure subscriptions.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.MutuallyExclusiveArguments[source]¶

Bases: Exception

The arguments provided are mutually exclusive and only one of the should be provided.

exception azureenergylabelerlib.azureenergylabelerlibexceptions.SubscriptionNotPartOfTenant[source]¶

Bases: Exception

If subscription ids are provided but are not part of the tenant.

azureenergylabelerlib.configuration module¶

configuration package.

Import all parts from configuration here .. _Google Python Style Guide:

https://google.github.io/styleguide/pyguide.html

azureenergylabelerlib.datamodels module¶

Main code for datamodels.

class azureenergylabelerlib.datamodels.DefenderForCloudFindingsData(filename, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.LabeledResourceGroupData(filename, labeled_resource_group_data, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property data¶: Data of an subscription to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.LabeledResourceGroupsData(filename, labeled_subscriptions, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.LabeledSubscriptionData(filename, labeled_subscription, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property data¶: Data of an subscription to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.LabeledSubscriptionsData(filename, labeled_subscriptions, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.SubscriptionExemptedPolicies(filename, labeled_subscriptions)[source]¶

Bases: object

Models the data for exempted policies to export.

property data¶: Data of an subscription exempted policies to export.

property json¶: Data to json.

class azureenergylabelerlib.datamodels.TenantEnergyLabelingData(filename, id, energy_label, labeled_subscriptions, defender_for_cloud_findings)[source]¶

Bases: object

Models the data for energy labeling to export.

property json¶: Data to json.

azureenergylabelerlib.entities module¶

Main code for entities.

class azureenergylabelerlib.entities.DataExporter(export_types, id, energy_label, defender_for_cloud_findings, labeled_subscriptions, credentials=None)[source]¶

Bases: object

Export Azure security data.

export(path)[source]¶: Exports the data to the provided path.

class azureenergylabelerlib.entities.DataFileFactory(export_type, id, energy_label, defender_for_cloud_findings, labeled_subscriptions)[source]¶

Bases: object

Data export factory to handle the different data types returned.

class azureenergylabelerlib.entities.DefenderForCloud(credential, subscription_list)[source]¶

Bases: object

Models the Defender for Cloud and retrieves findings.

frameworks = {'Azure CIS 1.1.0', 'Microsoft cloud security benchmark'}¶

get_findings(frameworks)[source]¶

Filters provided findings by the provided frameworks.

Parameters:: frameworks – The frameworks to filter for
Returns:: A list of findings matching the provided frameworks
Return type:: findings (list(Findings))

static validate_frameworks(frameworks)[source]¶

Validates provided frameworks.

Parameters:: frameworks – One or more of the frameworks to validate according to an accepted list.
Returns:: True if frameworks are valid False otherwise.

class azureenergylabelerlib.entities.EnergyLabeler(object_type, name, findings, threshold)[source]¶

Bases: object

Generic EnergyLabel factory to return energy label for resource groups and subscriptions.

property energy_label¶: Energy Label for the subscription or resource group.

class azureenergylabelerlib.entities.Finding(data)[source]¶

Bases: object

Models a finding.

property azure_portal_recommendation_link¶: Azure portal recommendation link Steps.

property compliance_control_id¶: Compliance control id.

property compliance_standard_id¶: Compliance standard id.

property compliance_state¶: Compliance state.

property control_name¶: Control Name.

property days_open¶: Days open.

property description¶: Finding Description.

property first_evaluation_date¶: First Evaluation Date.

property is_skipped¶: The finding is skipped or not.

property not_applicable_reason¶: Control Name.

property recommendation_display_name¶: Recommendation Display Name.

property recommendation_id¶: Recommendation Id.

property recommendation_name¶: Recommendation Name.

property remediation_steps¶: Remediation Steps.

property resource_group¶: Resource group name.

property resource_id¶: Resource name.

property resource_name¶: Resource name.

property resource_type¶: Resource type.

property severity¶: Severity.

property state¶: Title.

property status_change_date¶: Status Change Date.

property subscription_id¶: Subscription id.

class azureenergylabelerlib.entities.FindingParserLabeler[source]¶

Bases: object

static exclude_findings_by_state(findings, states)[source]¶: Returns findings excluding those with specific states.

static get_not_skipped_findings(findings)[source]¶: Not skipped findings for the subscription.

class azureenergylabelerlib.entities.ResourceGroup(data)[source]¶

Bases: FindingParserLabeler

Models the Azure subscription’s resource group that can label itself.

get_energy_label(findings, states=('notapplicable', 'healthy'))[source]¶

Calculates the energy label for the resource group.

Parameters:

findings – Either a list of defender for cloud findings.
states – The states to filter findings out for.

Returns:

The energy label of the resource group based on the provided configuration.

get_open_findings(findings)[source]¶: Findings for the resource group.

property location¶: location.

property name¶: name.

class azureenergylabelerlib.entities.Subscription(credential, data)[source]¶

Bases: FindingParserLabeler

Models the Azure subscription that can label itself.

property display_name¶: display_name.

property exempted_policies¶: Policies exempted for this subscription.

get_energy_label(findings, states=('notapplicable', 'healthy'))[source]¶

Calculates the energy label for the Subscription.

Parameters:

findings – Either a list of defender for cloud findings.
states – The states to filter findings out for.

Returns:

The energy label of the resource group based on the provided configuration.

get_open_findings(findings)[source]¶: Findings for the resource group.

property resource_groups¶: Resource groups of this subscription.

property state¶: State of the subscription.

property subscription_id¶: Subscription id.

property tenant_id¶: Tenant id.

class azureenergylabelerlib.entities.Tenant(credential, tenant_id, thresholds=[{'label': 'A', 'percentage': 90}, {'label': 'B', 'percentage': 70}, {'label': 'C', 'percentage': 50}, {'label': 'D', 'percentage': 30}, {'label': 'E', 'percentage': 20}], subscription_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], resource_group_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶

Bases: object

Models the Azure tenant and retrieves subscrptions from it.

get_allowed_subscriptions()[source]¶

Retrieves allowed subscriptions based on an allow list.

Returns:: The list of subscriptions based on the allowed list.

get_energy_label(defender_for_cloud_findings)[source]¶

Calculates and returns the energy label of the Tenant.

Parameters:: defender_for_cloud_findings – The measurement data of all the findings for a tenant.
Returns:: The labeling object of the Tenant.
Return type:: energy_label (TenantEnergyLabel)

get_energy_label_of_targeted_subscriptions(defender_for_cloud_findings)[source]¶

Get the energy label of the targeted subscriptions.

Parameters:: defender_for_cloud_findings – The findings from defender for cloud.
Returns:: The energy label of the targeted subscriptions.
Return type:: energy_label (str)

get_labeled_targeted_subscriptions(defender_for_cloud_findings)[source]¶

Labels the subscriptions based on the allow and deny list provided.

Parameters:: defender_for_cloud_findings – The findings for a Tenant.
Returns:: A list of Azure Subscriptions objects that have their labels calculated.
Return type:: labeled_subscriptions (list)

get_not_denied_subscriptions()[source]¶

Retrieves denied subscriptions based on an denied list.

Returns:: The list of subscriptions based on the denied list.

property subscriptions¶

Subscriptions of the Tenant.

Returns:: List of subscriptions retrieved

property subscriptions_to_be_labeled¶

Subscriptions to be labeled according to the allow or deny list arguments.

Returns:: A list of subscriptions to be labeled.
Return type:: subscription (list)

azureenergylabelerlib.labels module¶

Main code for labels.

class azureenergylabelerlib.labels.AggregateEnergyLabel(label: str, best_label: str, worst_label: str)[source]¶

Bases: object

Models an energy label averaging multiple subscription labels.

best_label: str¶

label: str¶

worst_label: str¶

class azureenergylabelerlib.labels.AggregateSubscriptionEnergyLabel(label: str, best_label: str, worst_label: str, subscriptions_measured: str)[source]¶

Bases: AggregateEnergyLabel

Models the landing zone energy label.

subscriptions_measured: str¶

class azureenergylabelerlib.labels.ResourceGroupEnergyLabel(label: str = 'F', number_of_high_findings: int = 9999, number_of_medium_findings: int = 9999, number_of_low_findings: int = 9999, max_days_open: int = 9999)[source]¶

Bases: object

Models the resource group energy label.

label: str = 'F'¶

max_days_open: int = 9999¶

number_of_high_findings: int = 9999¶

number_of_low_findings: int = 9999¶

number_of_medium_findings: int = 9999¶

class azureenergylabelerlib.labels.SubscriptionEnergyLabel(label: str = 'F', number_of_high_findings: int = 9999, number_of_medium_findings: int = 9999, number_of_low_findings: int = 9999, max_days_open: int = 9999)[source]¶

Bases: object

Models the subscription energy label.

label: str = 'F'¶

max_days_open: int = 9999¶

number_of_high_findings: int = 9999¶

number_of_low_findings: int = 9999¶

number_of_medium_findings: int = 9999¶

class azureenergylabelerlib.labels.TenantEnergyLabel(label: str, best_label: str, worst_label: str, coverage: str)[source]¶

Bases: AggregateEnergyLabel

Models the landing zone energy label.

coverage: str¶

azureenergylabelerlib.schemas module¶

schemas package.

Import all parts from schemas here .. _Google Python Style Guide:

https://google.github.io/styleguide/pyguide.html

azureenergylabelerlib.validations module¶

Main code for validations.

class azureenergylabelerlib.validations.DestinationPath(location)[source]¶

Bases: object

Models a destination path and identifies if it is valid and it’s type.

is_valid()[source]¶: Is the path valid.

property type¶: The type of the path.

azureenergylabelerlib.validations.are_valid_subscription_ids(subscription_ids)[source]¶

Checks whether a provided list of subscription ids contains all valid Azure subscription ids.

Parameters:: subscription_ids (list) – A list of subscription id strings.
Returns:: True if the provided list contains all valid Azure subscription ids, false otherwise.

azureenergylabelerlib.validations.is_valid_subscription_id(subscription_id)[source]¶

Checks whether a provided subscription_id is a valid Azure subscription id.

Parameters:: subscription_id (str) – A subscription id string.
Returns:: True if the provided value is a valid Azure subscription id, false otherwise.

azureenergylabelerlib.validations.validate_allowed_denied_subscription_ids(allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶

Validates provided allow and deny subscription id lists.

Not both arguments can contain values as they are logically mutually exclusive. The validations process also validates that the arguments contain valid subscription id values if provided.

Parameters:

allowed_subscription_ids (str|iterable) – A single or multiple subscription id to validate, mutually exclusive with the deny list
denied_subscription_ids (str|iterable) – A single or multiple subscription id to validate, mutually exclusive with the allow list

Returns:

A tuple of list values with valid subscription ids

Return type:

allowed_subscription_ids, denied_subscription_ids

Raises:

MutuallyExclusiveArguments – If both arguments contain values.
InvalidSubscriptionListProvided – If any of the provided ids in the list is not a valid subscription id.

azureenergylabelerlib.validations.validate_subscription_ids(subscription_ids)[source]¶

Validates a provided string or iterable that it contains valid Azure subscription ids.

Parameters:: subscription_ids – A string or iterable of strings with Azure subscription ids.
Returns:: A list of valid Azure subscription ids.
Return type:: subscription_ids (list)
Raises:: InvalidSubscriptionIdProvided – If any of the provided Subscription ids is not a valid Azure subscription id.

Module contents¶

azureenergylabelerlib package.

Import all parts from azureenergylabelerlib here