Skip to content

Checking Azure alert is failing because 'global' location name is lowercase #1644

@chopeen

Description

@chopeen

Describe the bug

When azurerm_monitor_activity_log_alert is used to create a new alert, the following spelling is used:

{
    "id": "/subscriptions/[...]/resourceGroups/[...]/providers/Microsoft.Insights/activityLogAlerts/Alert for Create Policy Assignment",
    "name": "Alert for Create Policy Assignment",
    "type": "Microsoft.Insights/ActivityLogAlerts",
    "location": "global",
[...]

When such an alert is created, ScoutSuite does not find it, because it checks for region Global (see DisplayName and Name spelling of region names):

def ensure_alert_exist(self, log_alerts, equals_value: str):
for log_alert in log_alerts:
if log_alert.location == 'Global' and log_alert.enabled:
if '/subscriptions/' + self.subscription_id in log_alert.scopes:

Proposed fix

Make the string comparison case insensitive.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpotentialUnconfirmed issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions