0

I am developing a simple audit script. The goal of this program is to audit the CIS foundations benchmark 3.6 Ensure default network access rule for storage accounts is set to Deny. The code is written like so

#!/bin/zsh
function() {
    local defaultAction=$(az storage account list --query '[*].networkRuleSet' | jq '.[].defaultAction')
    local storageAccountName=$(az storage account list | jq '.[].name')
    local resourceGroupName=$(az storage account list | jq '.[].resourceGroup')
    if [ $defaultAction != "Deny" ]; then
        echo "Ensure defaultAction is set to Allow."
        echo "az storage account update --default-action Deny --name $storageAccountName --resource-group $resourceGroupName" 
        az storage account update --default-action Deny --name $storageAccountName --resource-group $resourceGroupName
        echo "Ensure defaultAction has been set to Deny."
        else
        echo "defaultAction is set to $defaultAction"
        fi

}

Expected:

"Ensure defaultAction is set to Allow."
"Ensure defaultAction has been set to Deny."

Actual:

Ensure defaultAction is set to Allow.

The arguments comeback as blank, but they print as expected. I believe the problem is here:

az storage account update --default-action Deny --name $storageAccountName --resource-group $resourceGroupName
halfer
  • 19,824
  • 17
  • 99
  • 186
Evan Gertis
  • 1,796
  • 2
  • 25
  • 59
  • 3
    Did you mean `defaultAction=$(az storage account list --query '[*].networkRuleSet' | jq '.[]' | jq '.defaultAction')` instead and similarly for the following lines? – choroba Dec 14 '21 at 16:43
  • I fixed that and updated the question. – Evan Gertis Dec 14 '21 at 16:44
  • What @choroba said. Also `-eq` is for comparing numbers. Use `==` for strings. – John Kugelman Dec 14 '21 at 16:45
  • 2
    You can use [Shell Check](https://www.shellcheck.net/) to check your script for syntax errors. – John Kugelman Dec 14 '21 at 16:45
  • I updated the question to use the == sign. Expected isn't matching still. – Evan Gertis Dec 14 '21 at 16:46
  • 1
    @EvanGertis, ...it's _not_ fixed per choroba's suggestion in the updated question; the assignments are still wrong. `defaultAction= az storage account list` does not store output of `az storage account list` in the variable named `defaultAction`. Instead, it sets a transient environment variable `defaultAction` with the value as an empty string while it runs `az storage account list` with output directed to stdout. – Charles Duffy Dec 14 '21 at 16:47
  • BTW, `jq '.[]' | jq '.foo'` would be better written as `jq '.[].foo'`, or even `jq '.[] | .foo'` if you're more comfortable that way. – Charles Duffy Dec 14 '21 at 16:49
  • Also, even `==` is bad practice; the only POSIX-standardized string comparison operator is `=`. See https://pubs.opengroup.org/onlinepubs/9699919799/utilities/test.html – Charles Duffy Dec 14 '21 at 16:51
  • @CharlesDuffy Note this is `[[` which is already non-POSIX, so `==` is okay. – John Kugelman Dec 14 '21 at 16:53
  • @JohnKugelman, ...I still tend to object insofar as it's building finger memory that makes it easier to use `==` even when the command is `[`. – Charles Duffy Dec 14 '21 at 16:55
  • 1
    BTW, your question says "bash" in the title, but you have a `#!/bin/zsh` shebang. bash and zsh are two very different shells, and not at all mutually compatible; you should tag only for `zsh` (and reflect that in title and text) if that's the shell your code is intended to run with. (They _look_ pretty close to compatible with each other, but that's surface-level; trying to run zsh code in bash or bash code in zsh when that code wasn't written with mutual compatibility at front-of-mind is an express route to bug city). – Charles Duffy Dec 14 '21 at 16:56
  • I would ask that you refrain from editing your question and fixing the problems we point out. It keeps moving the goalposts, and at a certain point you're going to have fixed all of the problems and there won't even be a question left. Instead, I suggest you leave the question in its original state and wait for somebody to post an answer; [post an answer yourself](https://stackoverflow.com/help/self-answer) summarizing the comments that helped you and [self-accept](http://blog.stackoverflow.com/2009/01/accept-your-own-answers/); or delete the question if you no longer need help. – John Kugelman Dec 14 '21 at 17:01
  • @JohnKugelman, ...to be fair, it's only properly "against the rules" to move the goalposts after an answer has been posted, and all we've done so far is comment. If the OP managed to get to a place where they genuinely did have a new, on-topic technical question that isn't duplicative of the existing linked duplicate, the process of getting there would be legit. – Charles Duffy Dec 14 '21 at 17:02
  • @EvanGertis, btw, one other thing -- you probably want to add the `-r` argument to your `jq` calls so you no longer have literal (as opposed to syntactic) quotes in your strings. Even if you did fix the linked duplicate bug, your comparison would still fail because the string `Allow` and the string `"Allow"` (with the quotes as part of the literal content) are two different strings. (`[[ Allow = "Allow" ]]` is true because there the double quotes are syntactic, but what your code would be checking is more like `[[ '"$Allow"' = Allow ]]`, which is false because the double quotes are literal). – Charles Duffy Dec 14 '21 at 17:04

0 Answers0