[New Control] GR9 | Validation 3 | Tools In Use For Limiting Access To Authorized Source IP Addresses (M)

[singhgss]

Overview/Summary

This Pull Request introduces a new control to check for tools that limit access to authorized source IP addresses, focusing on firewalls and application gateways.

This PR fixes/adds/changes/removes

closes #218

1. Added a check for the existence of a firewall (Fortigate or Azure Native Firewall) or application gateway per subscription.
2. Ensured compliance validation based on the presence of a Web Application Firewall (WAF) configuration on the application gateway.
3. Enhanced reporting to include detailed comments on firewall type or application gateway status per subscription.

Breaking Changes

None anticipated.

Testing Evidence

Please provide any testing evidence to show that this Pull Request works/fixes as described (include screenshots, if appropriate).

As part of this Pull Request I have

• [x] Checked for duplicate Pull Requests
• [x] Associated it with relevant GitHub Issues
• [x] Ensured my code/branch is up-to-date with the latest changes in the main branch
• [x] Performed testing and provided evidence.
• [x] Updated relevant and associated documentation.
• [x] Ensured PowerShell module versions have been updated (manually or with the ./tools/Update-ModuleVersions.ps1 script).

Compliance Status Example (for documentation)

Subscription	Comments	Compliance Status
CTO-CPMS	There is an Azure firewall associated with this subscription.	Compliant
GGG-154	There is an application gateway with the appropriate configurations.	Compliant
6hy-tra	There is a Fortigate Firewall associated with this subscription.	Compliant
XYZ-123	This subscription does not have either a firewall or an application gateway.	Non-Compliant
ABC-789	The application gateway assigned does not have a Web Application Firewall configured.	Non-Compliant

Comments for Compliance Check:

• Non-Compliant (no firewall and no app gateway): No firewall or application gateway in use for this subscription.
• Non-Compliant (App Gateway but no WAF): Application gateway lacks WAF configuration. Enable WAF on the Application Gateway.
• Compliant (Firewall Found): The subscription has a firewall (e.g., Fortigate, Azure Native) in use.
• Compliant (App Gateway): Application gateway with appropriate configurations is in use.