feat(terraform): add CKV2_AZURE_47, ensure storage account is configu…

…red without blob anonymous access (#5888)

Add CKV2_AZURE_47, ensure storage account is configured without blob anonymous access.

checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml

@@ -0,0 +1,17 @@
+metadata:
+  id: "CKV2_AZURE_47"
+  name: "Ensure storage account is configured without blob anonymous access"
+  category: "IAM"
+
+definition:
+  and:
+    - cond_type: "attribute"
+      resource_types: "azurerm_storage_account"
+      attribute: "allow_nested_items_to_be_public"
+      operator: "exists"
+
+    - cond_type: "attribute"
+      resource_types: "azurerm_storage_account"
+      attribute: "allow_nested_items_to_be_public"
+      operator: "equals_ignore_case"
+      value: "false"

tests/terraform/graph/checks/resources/AzureStorageAccConfigWithoutBlobAnonymousAccess/expected.yaml

@@ -0,0 +1,5 @@
+pass:
+  - "azurerm_storage_account.pass"
+fail:
+  - "azurerm_storage_account.fail_1"
+  - "azurerm_storage_account.fail_2"

tests/terraform/graph/checks/resources/AzureStorageAccConfigWithoutBlobAnonymousAccess/main.tf

@@ -0,0 +1,52 @@
+variable "rg-name" {
+  default = "pud-bc-rg"
+}
+
+variable "location" {
+  default = "northeurope"
+}
+
+# Case 1: Pass: allow_nested_items_to_be_public = False
+
+resource "azurerm_storage_account" "pass" {
+  name                     = "pud-storage2023abc1"
+  resource_group_name      = var.rg-name
+  location                 = var.location
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+  allow_nested_items_to_be_public = false
+
+  tags = {
+    bc_status = "pass"
+  }
+}
+
+# Case 2: Fail: allow_nested_items_to_be_public does NOT exist
+
+resource "azurerm_storage_account" "fail_1" {
+  name                     = "pud-storage2023abc2"
+  resource_group_name      = var.rg-name
+  location                 = var.location
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+
+  tags = {
+    bc_status = "fail_1"
+  }
+}
+
+# Case 3: Fail: allow_nested_items_to_be_public = True
+
+resource "azurerm_storage_account" "fail_2" {
+  name                     = "pud-storage2023abc3"
+  resource_group_name      = var.rg-name
+  location                 = var.location
+  account_tier             = "Standard"
+  account_replication_type = "GRS"
+  allow_nested_items_to_be_public = true
+
+
+  tags = {
+    bc_status = "fail_2"
+  }
+}