Azure Security Scanner

01Overview

Azure Security Scanner is a pair of read-only Bash audit scripts that interrogate a live Microsoft Azure subscription and grade its security posture against the CIS Microsoft Azure Foundations Benchmark v4.0.0. Instead of shipping a heavyweight agent or requiring API keys, it rides the operator's existing `az login` session, runs entirely with Azure CLI + Python 3, and never mutates a single resource. Every check emits a color-coded PASS / FAIL / WARN / INFO verdict with the exact CIS control reference, so a security engineer can go from `az login` to a prioritized findings list in one command.

The project ships two tiers. The base script (`azure_security_audit_scripts.sh`) covers 8 sections and ~36 checks spanning IAM, Storage, Networking, Logging, Key Vault, VMs, App Service and Databases. The enhanced script (`azure_security_audit_enhanced.sh`) is broader: 16 sections and 70+ effective checks that add Microsoft Defender for Cloud plan coverage, Conditional Access / MFA policy inspection via Microsoft Graph, resource locks, NSG flow logs, Azure Bastion, Container Registry, AKS hardening and orphaned-resource hygiene. Both scripts implement the same Sections 1-8 core domains, but the two files are NOT byte-identical — the enhanced script is a more compact rewrite and the per-section check sets differ slightly (e.g. the enhanced script adds Database and Logging checks while the base script carries an extra VM check).

Under the hood it's a deliberately simple, dependency-free design: a Bash driver with `log/pass/fail/warn` helper functions and ANSI counters, hybrid Bash-plus-inline-Python (33 `python3` heredocs) for the multi-resource checks, and Entra ID coverage delivered through `az rest` calls to the Microsoft Graph API. Each run creates a timestamped evidence directory holding per-check JSON/CSV artifacts plus an `AUDIT_MANIFEST.txt` catalog — turning an audit into a reproducible, auditor-friendly evidence package.

It's built for cloud security engineers, Azure admins, compliance teams and consultants who need a fast, transparent, offline-inspectable posture check they can read line-by-line before running it against production. Because it's read-only by design, needs only Reader/Global Reader permissions, and hardcodes no secrets, it's safe to drop into a hardening review, a client engagement, or a pre-audit dry run.

02Key Capabilities

03Architecture

A single-file Bash driver per tier orchestrates the audit: it resolves Azure context from the active `az login` session, sets up a timestamped evidence directory, then runs sequential section blocks. Simple checks call Azure CLI directly and score via `pass/fail/warn` helpers; complex multi-resource and Entra ID checks execute inline Python heredocs that shell out through `subprocess`, parse JSON, print colored verdicts, and persist evidence files. A summary stage tallies results and writes an evidence manifest.

04Project Structure

05Security Controls

06Technology Stack

Language

Bash 5.0+ (driver) with inline Python 3.8+ heredocs

Cloud tooling

Azure CLI 2.50+ (`az`) and Microsoft Graph API via `az rest`

Python libraries

Standard library only — `subprocess`, `json`, `os` (no pip dependencies)

External dependencies

None beyond Azure CLI + Python 3 — zero vendored libs, no API keys

Auth model

Ambient `az login` session; requires Reader on subscription + Global Reader on tenant

Testing

No automated suite; validated via `bash -n` syntax check and live subscription runs

CI/CD

None — no pipelines, hooks or automated releases; `main` is the primary branch

License

MIT (LICENSE file; note the README badge/tree mislabel it GPL-3.0)

07Quick Start

$ az login   # authenticate the executing identity (Reader + Global Reader)
$ bash azure_security_audit_scripts.sh   # base audit, Sections 1-8
$ bash azure_security_audit_enhanced.sh   # enhanced audit, Sections 1-16
$ bash azure_security_audit_enhanced.sh --subscription <subscription-id>   # target a specific subscription
$ ls azure_audit_*/   # inspect the timestamped evidence directory and AUDIT_MANIFEST.txt
$ bash -n azure_security_audit_enhanced.sh   # syntax-check without executing

08Compliance & Frameworks

09Integrations & Outputs