add rule ckv_azure_115

policy/checkov/AKSLocalAdminDisabled.azapi.mock.json

@@ -0,0 +1,68 @@
+{
+  "mock": {
+    "default": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+              "body": {
+                "properties": {
+                  "disableLocalAccounts": true
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "invalid_false": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+              "body": {
+                "properties": {
+                  "disableLocalAccounts": false
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "invalid_omitted": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azapi_resource",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "type": "Microsoft.ContainerService/managedClusters@2024-05-01",
+              "body": {
+                "properties": {}
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

policy/checkov/AKSLocalAdminDisabled.azapi.rego

@@ -0,0 +1,15 @@
+package checkov
+
+import rego.v1
+
+valid_azapi_kubernetes_cluster_local_admin_disabled(resource) if {
+    resource.values.body.properties.disableLocalAccounts == true
+}
+
+deny_CKV_AZURE_141 contains reason if {
+    resource := data.utils.resource(input, "azapi_resource")[_]
+    data.utils.is_azure_type(resource.values, "Microsoft.ContainerService/managedClusters")
+    not valid_azapi_kubernetes_cluster_local_admin_disabled(resource)
+
+    reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py", [resource.address])
+}

policy/checkov/AKSLocalAdminDisabled.mock.json

@@ -0,0 +1,53 @@
+{
+  "mock": {
+    "default": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "local_account_disabled": true
+            }
+          }
+        }
+      ]
+    },
+    "invalid_false": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {
+              "local_account_disabled": false
+            }
+          }
+        }
+      ]
+    },
+    "invalid_omitted": {
+      "resource_changes": [
+        {
+          "address": "azurerm_kubernetes_cluster.example",
+          "mode": "managed",
+          "type": "azurerm_kubernetes_cluster",
+          "change": {
+            "actions": [
+              "create"
+            ],
+            "after": {}
+          }
+        }
+      ]
+    }
+  }
+}

policy/checkov/azurerm/AKSLocalAdminDisabled.rego.bak → policy/checkov/AKSLocalAdminDisabled.rego

@@ -10,5 +10,5 @@ deny_CKV_AZURE_141 contains reason if {
     resource := data.utils.resource(input, "azurerm_kubernetes_cluster")[_]
     not valid_azurerm_kubernetes_cluster_local_admin_disabled(resource)
 
-    reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s", ["https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py"])
+    reason := sprintf("checkov/CKV_AZURE_141: Ensure AKS local admin account is disabled %s: https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py", [resource.address])
 }