azureenergylabelerlib package¶
Submodules¶
azureenergylabelerlib.azureenergylabelerlib module¶
Main code for azureenergylabelerlib.
- class azureenergylabelerlib.azureenergylabelerlib.AzureEnergyLabeler(tenant_id, frameworks={'Azure CIS 1.1.0', 'Microsoft cloud security benchmark'}, tenant_thresholds=[{'label': 'A', 'percentage': 90}, {'label': 'B', 'percentage': 70}, {'label': 'C', 'percentage': 50}, {'label': 'D', 'percentage': 30}, {'label': 'E', 'percentage': 20}], resource_group_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], subscription_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], credentials=None, allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶
Bases:
object
Labeling subscriptions based on findings and label configurations.
- Parameters:
tenant_id (str) – Azure Tenant ID to collect energy label, for example: 18d9dec0-d762-11ec-9cb5-00155da09878.
frameworks (set[str]) – Frameworks taken into account when generating the energy label. Defaults to
DEFAULT_DEFENDER_FOR_CLOUD_FRAMEWORKS
tenant_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for the tenant. Defaults to
TENANT_THRESHOLDS
resource_group_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for resource groups. Defaults to
RESOURCE_GROUP_THRESHOLDS
subscription_thresholds (list[dict[str, Any]]) – Defines percentage thresholds mapping to energy labels for resource groups. Defaults to
SUBSCRIPTION_THRESHOLDS
credentials (Any) –
One of
identity
Credential object containing the credentials used to access the Azure API. If not supplied, the library will create aDefaultAzureCredential
and attempt to authenticate in the following order: 1. A service principal configured by environment variables. SeeEnvironmentCredential
for more details.
An Azure managed identity. See
ManagedIdentityCredential
for more details.- On Windows only: a user who has signed in with a Microsoft application, such as Visual Studio. If multiple
identities are in the cache, then the value of the environment variable
AZURE_USERNAME
is used to select which identity to use. SeeSharedTokenCacheCredential
for more details.
The user currently signed in to Visual Studio Code.
The identity currently logged in to the Azure CLI.
The identity currently logged in to Azure PowerShell.
allowed_subscription_ids (Any) – Inclusion list of subscripitions to be evaluated
denied_subscription_ids (Any) – Exclude list of subscriptions to be evaluated
- property defender_for_cloud¶
Defender for cloud.
- property defender_for_cloud_findings¶
Defender for cloud findings.
- property filtered_defender_for_cloud_findings¶
Filtered defender for cloud findings.
- property labeled_subscriptions_energy_label¶
Energy label of the labeled subscriptions.
- property matching_frameworks¶
The frameworks provided to match the findings of.
- property tenant¶
Tenant.
- property tenant_energy_label¶
Energy label of the Azure Tenant.
- property tenant_labeled_subscriptions¶
The tenant labeled subscription objects.
azureenergylabelerlib.azureenergylabelerlibexceptions module¶
Custom exception code for azureenergylabelerlib.
- exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidCredentials[source]¶
Bases:
Exception
Credentials provided are not valid.
- exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidFrameworks[source]¶
Bases:
Exception
The frameworks provided are not valid.
- exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidPath[source]¶
Bases:
Exception
The path provided is not valid.
- exception azureenergylabelerlib.azureenergylabelerlibexceptions.InvalidSubscriptionListProvided[source]¶
Bases:
Exception
The list of subscriptions provided are not valid Azure subscriptions.
azureenergylabelerlib.configuration module¶
configuration package.
Import all parts from configuration here .. _Google Python Style Guide:
azureenergylabelerlib.datamodels module¶
Main code for datamodels.
- class azureenergylabelerlib.datamodels.DefenderForCloudFindingsData(filename, defender_for_cloud_findings)[source]¶
Bases:
object
Models the data for energy labeling to export.
- property json¶
Data to json.
- class azureenergylabelerlib.datamodels.LabeledResourceGroupData(filename, labeled_resource_group_data, defender_for_cloud_findings)[source]¶
Bases:
object
Models the data for energy labeling to export.
- property data¶
Data of an subscription to export.
- property json¶
Data to json.
- class azureenergylabelerlib.datamodels.LabeledResourceGroupsData(filename, labeled_subscriptions, defender_for_cloud_findings)[source]¶
Bases:
object
Models the data for energy labeling to export.
- property json¶
Data to json.
- class azureenergylabelerlib.datamodels.LabeledSubscriptionData(filename, labeled_subscription, defender_for_cloud_findings)[source]¶
Bases:
object
Models the data for energy labeling to export.
- property data¶
Data of an subscription to export.
- property json¶
Data to json.
- class azureenergylabelerlib.datamodels.LabeledSubscriptionsData(filename, labeled_subscriptions, defender_for_cloud_findings)[source]¶
Bases:
object
Models the data for energy labeling to export.
- property json¶
Data to json.
azureenergylabelerlib.entities module¶
Main code for entities.
- class azureenergylabelerlib.entities.DataExporter(export_types, id, energy_label, defender_for_cloud_findings, labeled_subscriptions, credentials=None)[source]¶
Bases:
object
Export Azure security data.
- class azureenergylabelerlib.entities.DataFileFactory(export_type, id, energy_label, defender_for_cloud_findings, labeled_subscriptions)[source]¶
Bases:
object
Data export factory to handle the different data types returned.
- class azureenergylabelerlib.entities.DefenderForCloud(credential, subscription_list)[source]¶
Bases:
object
Models the Defender for Cloud and retrieves findings.
- frameworks = {'Azure CIS 1.1.0', 'Microsoft cloud security benchmark'}¶
- class azureenergylabelerlib.entities.EnergyLabeler(object_type, name, findings, threshold)[source]¶
Bases:
object
Generic EnergyLabel factory to return energy label for resource groups and subscriptions.
- property energy_label¶
Energy Label for the subscription or resource group.
- class azureenergylabelerlib.entities.Finding(data)[source]¶
Bases:
object
Models a finding.
- property azure_portal_recommendation_link¶
Azure portal recommendation link Steps.
- property compliance_control_id¶
Compliance control id.
- property compliance_standard_id¶
Compliance standard id.
- property compliance_state¶
Compliance state.
- property control_name¶
Control Name.
- property days_open¶
Days open.
- property description¶
Finding Description.
- property first_evaluation_date¶
First Evaluation Date.
- property is_skipped¶
The finding is skipped or not.
- property not_applicable_reason¶
Control Name.
- property recommendation_display_name¶
Recommendation Display Name.
- property recommendation_id¶
Recommendation Id.
- property recommendation_name¶
Recommendation Name.
- property remediation_steps¶
Remediation Steps.
- property resource_group¶
Resource group name.
- property resource_id¶
Resource name.
- property resource_name¶
Resource name.
- property resource_type¶
Resource type.
- property severity¶
Severity.
- property state¶
Title.
- property status_change_date¶
Status Change Date.
- property subscription_id¶
Subscription id.
- class azureenergylabelerlib.entities.FindingParserLabeler[source]¶
Bases:
object
- class azureenergylabelerlib.entities.ResourceGroup(data)[source]¶
Bases:
FindingParserLabeler
Models the Azure subscription’s resource group that can label itself.
- get_energy_label(findings, states=('notapplicable', 'healthy'))[source]¶
Calculates the energy label for the resource group.
- Parameters:
findings – Either a list of defender for cloud findings.
states – The states to filter findings out for.
- Returns:
The energy label of the resource group based on the provided configuration.
- property location¶
location.
- property name¶
name.
- class azureenergylabelerlib.entities.Subscription(credential, data)[source]¶
Bases:
FindingParserLabeler
Models the Azure subscription that can label itself.
- property display_name¶
display_name.
- property exempted_policies¶
Policies exempted for this subscription.
- get_energy_label(findings, states=('notapplicable', 'healthy'))[source]¶
Calculates the energy label for the Subscription.
- Parameters:
findings – Either a list of defender for cloud findings.
states – The states to filter findings out for.
- Returns:
The energy label of the resource group based on the provided configuration.
- property resource_groups¶
Resource groups of this subscription.
- property state¶
State of the subscription.
- property subscription_id¶
Subscription id.
- property tenant_id¶
Tenant id.
- class azureenergylabelerlib.entities.Tenant(credential, tenant_id, thresholds=[{'label': 'A', 'percentage': 90}, {'label': 'B', 'percentage': 70}, {'label': 'C', 'percentage': 50}, {'label': 'D', 'percentage': 30}, {'label': 'E', 'percentage': 20}], subscription_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], resource_group_thresholds=[{'label': 'A', 'high': 0, 'medium': 10, 'low': 20, 'days_open_less_than': 999}, {'label': 'B', 'high': 10, 'medium': 20, 'low': 40, 'days_open_less_than': 999}, {'label': 'C', 'high': 15, 'medium': 30, 'low': 60, 'days_open_less_than': 999}, {'label': 'D', 'high': 20, 'medium': 40, 'low': 80, 'days_open_less_than': 999}, {'label': 'E', 'high': 25, 'medium': 50, 'low': 100, 'days_open_less_than': 999}], allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶
Bases:
object
Models the Azure tenant and retrieves subscrptions from it.
- get_allowed_subscriptions()[source]¶
Retrieves allowed subscriptions based on an allow list.
- Returns:
The list of subscriptions based on the allowed list.
- get_energy_label(defender_for_cloud_findings)[source]¶
Calculates and returns the energy label of the Tenant.
- Parameters:
defender_for_cloud_findings – The measurement data of all the findings for a tenant.
- Returns:
The labeling object of the Tenant.
- Return type:
energy_label (TenantEnergyLabel)
- get_energy_label_of_targeted_subscriptions(defender_for_cloud_findings)[source]¶
Get the energy label of the targeted subscriptions.
- Parameters:
defender_for_cloud_findings – The findings from defender for cloud.
- Returns:
The energy label of the targeted subscriptions.
- Return type:
energy_label (str)
- get_labeled_targeted_subscriptions(defender_for_cloud_findings)[source]¶
Labels the subscriptions based on the allow and deny list provided.
- Parameters:
defender_for_cloud_findings – The findings for a Tenant.
- Returns:
A list of Azure Subscriptions objects that have their labels calculated.
- Return type:
labeled_subscriptions (list)
- get_not_denied_subscriptions()[source]¶
Retrieves denied subscriptions based on an denied list.
- Returns:
The list of subscriptions based on the denied list.
- property subscriptions¶
Subscriptions of the Tenant.
- Returns:
List of subscriptions retrieved
- property subscriptions_to_be_labeled¶
Subscriptions to be labeled according to the allow or deny list arguments.
- Returns:
A list of subscriptions to be labeled.
- Return type:
subscription (list)
azureenergylabelerlib.labels module¶
Main code for labels.
- class azureenergylabelerlib.labels.AggregateEnergyLabel(label: str, best_label: str, worst_label: str)[source]¶
Bases:
object
Models an energy label averaging multiple subscription labels.
- best_label: str¶
- label: str¶
- worst_label: str¶
- class azureenergylabelerlib.labels.AggregateSubscriptionEnergyLabel(label: str, best_label: str, worst_label: str, subscriptions_measured: str)[source]¶
Bases:
AggregateEnergyLabel
Models the landing zone energy label.
- subscriptions_measured: str¶
- class azureenergylabelerlib.labels.ResourceGroupEnergyLabel(label: str = 'F', number_of_high_findings: int = 9999, number_of_medium_findings: int = 9999, number_of_low_findings: int = 9999, max_days_open: int = 9999)[source]¶
Bases:
object
Models the resource group energy label.
- label: str = 'F'¶
- max_days_open: int = 9999¶
- number_of_high_findings: int = 9999¶
- number_of_low_findings: int = 9999¶
- number_of_medium_findings: int = 9999¶
- class azureenergylabelerlib.labels.SubscriptionEnergyLabel(label: str = 'F', number_of_high_findings: int = 9999, number_of_medium_findings: int = 9999, number_of_low_findings: int = 9999, max_days_open: int = 9999)[source]¶
Bases:
object
Models the subscription energy label.
- label: str = 'F'¶
- max_days_open: int = 9999¶
- number_of_high_findings: int = 9999¶
- number_of_low_findings: int = 9999¶
- number_of_medium_findings: int = 9999¶
- class azureenergylabelerlib.labels.TenantEnergyLabel(label: str, best_label: str, worst_label: str, coverage: str)[source]¶
Bases:
AggregateEnergyLabel
Models the landing zone energy label.
- coverage: str¶
azureenergylabelerlib.schemas module¶
schemas package.
Import all parts from schemas here .. _Google Python Style Guide:
azureenergylabelerlib.validations module¶
Main code for validations.
- class azureenergylabelerlib.validations.DestinationPath(location)[source]¶
Bases:
object
Models a destination path and identifies if it is valid and it’s type.
- property type¶
The type of the path.
- azureenergylabelerlib.validations.are_valid_subscription_ids(subscription_ids)[source]¶
Checks whether a provided list of subscription ids contains all valid Azure subscription ids.
- Parameters:
subscription_ids (list) – A list of subscription id strings.
- Returns:
True if the provided list contains all valid Azure subscription ids, false otherwise.
- azureenergylabelerlib.validations.is_valid_subscription_id(subscription_id)[source]¶
Checks whether a provided subscription_id is a valid Azure subscription id.
- Parameters:
subscription_id (str) – A subscription id string.
- Returns:
True if the provided value is a valid Azure subscription id, false otherwise.
- azureenergylabelerlib.validations.validate_allowed_denied_subscription_ids(allowed_subscription_ids=None, denied_subscription_ids=None)[source]¶
Validates provided allow and deny subscription id lists.
Not both arguments can contain values as they are logically mutually exclusive. The validations process also validates that the arguments contain valid subscription id values if provided.
- Parameters:
allowed_subscription_ids (str|iterable) – A single or multiple subscription id to validate, mutually exclusive with the deny list
denied_subscription_ids (str|iterable) – A single or multiple subscription id to validate, mutually exclusive with the allow list
- Returns:
A tuple of list values with valid subscription ids
- Return type:
allowed_subscription_ids, denied_subscription_ids
- Raises:
MutuallyExclusiveArguments – If both arguments contain values.
InvalidSubscriptionListProvided – If any of the provided ids in the list is not a valid subscription id.
- azureenergylabelerlib.validations.validate_subscription_ids(subscription_ids)[source]¶
Validates a provided string or iterable that it contains valid Azure subscription ids.
- Parameters:
subscription_ids – A string or iterable of strings with Azure subscription ids.
- Returns:
A list of valid Azure subscription ids.
- Return type:
subscription_ids (list)
- Raises:
InvalidSubscriptionIdProvided – If any of the provided Subscription ids is not a valid Azure subscription id.
Module contents¶
azureenergylabelerlib package.
Import all parts from azureenergylabelerlib here