feat(query): implements "Beta - Containers Without Soft Delete"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there is no query to ensure that resources of type "azurerm_storage_account" configure a value of 1 to 365 on their "blob_properties.container_delete_retention_policy.days" field.

• Quoting CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0 page 489: "Containers can be deleted incorrectly. An attacker or malicious user may do this deliberately in order to cause disruption. Deleting a container results in immediate data loss. Enabling this configuration for Azure storage accounts ensures that even if containers are deleted from the storage account, the containers are recoverable for a specific period of time, which is defined in the "Retention policies," ranging from 7 to 365 days."

• Through the Terraform documentation for the resource we can see a "container_delete_retention_policy" block left empty will assume the default value of 7 for the missing "days" field. With this all we have to do is ensure the "container_delete_retention_policy" block is defined regardless of the value associated with the "days" field.

• Note that a check for whether the actual value of "days" field is sufficient was not included. The CIS benchmark states : "Ensure that the retention period is a sufficient length for your organization.", this value can vary and a query such as this has no way of having this context in any way. It could be argued if a minimum value should be enforced like 7 or 10 days.

Proposed Changes

• Implemented the missing query.
• The query will flag any "azurerm_storage_account" resource that does not set the "blob_properties" block, or does set it but does not set a "container_delete_retention_policy" block within.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0