Repository: aquasecurity/tfsec (go)

Issue:
Azure default_action_deny_rule missing important configuration issues
**Describe the bug**
The logic used in `internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go` is missing security checks for the default_action option. The logic assumes that there is always going to be a `azurerm_storage_account_network_rules` block and therefor does not have any enforcement to the `azurerm_storage_account` `network_rules.default_action`

**To Reproduce**
Run against an azure `storage_accounts.tf` file
```
resource "azurerm_storage_account" "test" {
  name                      = "test"
  resource_group_name       = azurerm_resource_group.test
  location                  = azurerm_resource_group.test
  account_tier              = "Standard"
  account_replication_type  = "LRS"
  enable_https_traffic_only = true
  min_tls_version           = "TLS1_2"
}
```

**Expected behavior**
A critical error when there is no `default_action` or `network_rules.default_action`

**Screenshots**

**Desktop (please complete the following information):**
 - OS: MacOS

**Additional context**


Pull request:
Check for corresponding network rules block
Resolves #1062


Patch:
diff --git a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
index 60a1cb477..2f9a2b732 100644
--- a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
+++ b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule.go
@@ -55,12 +55,15 @@ resource "azurerm_storage_account_network_rules" "good_example" {
 		RequiredTypes:   []string{"resource"},
 		RequiredLabels:  []string{"azurerm_storage_account", "azurerm_storage_account_network_rules"},
 		DefaultSeverity: severity.Critical,
-		CheckFunc: func(set result.Set, resourceBlock block.Block, _ block.Module) {
+		CheckFunc: func(set result.Set, resourceBlock block.Block, ctx block.Module) {
 
 			blockName := resourceBlock.FullName()
 
 			if resourceBlock.IsResourceType("azurerm_storage_account") {
-				if resourceBlock.MissingChild("network_rules") {
+				if resourceBlock.MissingChild("network_rules") &&
+					len(ctx.GetResourcesByType("azurerm_storage_account_network_rules")) == 0				{
+					set.AddResult().
+						WithDescription("Resource '%s' does not have network_rules and there isn't a configured `azurerm_storage_account_network_rules.", blockName)
 					return
 				}
 				resourceBlock = resourceBlock.GetBlock("network_rules")


Test patch:
diff --git a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule_test.go b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule_test.go
index c503c9106..b4c831721 100644
--- a/internal/app/tfsec/rules/azure/storage/default_action_deny_rule_test.go
+++ b/internal/app/tfsec/rules/azure/storage/default_action_deny_rule_test.go
@@ -26,6 +26,21 @@ resource "azurerm_storage_account_network_rules" "test" {
   virtual_network_subnet_ids = [azurerm_subnet.test.id]
   bypass                     = ["Metrics"]
 }
+`,
+			mustIncludeResultCode: expectedCode,
+		},
+		{
+			name: "check default action when not provided causes failure",
+			source: 		`
+resource "azurerm_storage_account" "test" {
+  name                      = "test"
+  resource_group_name       = azurerm_resource_group.test
+  location                  = azurerm_resource_group.test
+  account_tier              = "Standard"
+  account_replication_type  = "LRS"
+  enable_https_traffic_only = true
+  min_tls_version           = "TLS1_2"
+}
 `,
 			mustIncludeResultCode: expectedCode,
 		},
@@ -77,6 +92,29 @@ resource "azurerm_storage_account_network_rules" "test" {
   virtual_network_subnet_ids = [azurerm_subnet.test.id]
   bypass                     = ["Metrics"]
 }
+`,
+			mustExcludeResultCode: expectedCode,
+		},
+		{
+			name: "check no error when the default action is set to deny on a network_rules block, regardless of case",
+			source: `
+resource "azurerm_storage_account" "test" {
+  name                      = "test"
+  resource_group_name       = azurerm_resource_group.test
+  location                  = azurerm_resource_group.test
+  account_tier              = "Standard"
+  account_replication_type  = "LRS"
+  enable_https_traffic_only = true
+  min_tls_version           = "TLS1_2"
+}
+
+resource "azurerm_storage_account_network_rules" "test" {
+  
+  default_action             = "deny"
+  ip_rules                   = ["127.0.0.1"]
+  virtual_network_subnet_ids = [azurerm_subnet.test.id]
+  bypass                     = ["Metrics"]
+}
 `,
 			mustExcludeResultCode: expectedCode,
 		},