# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows use: venv\Scripts\activate

# Install official Azure SDKs and security monitoring libs
pip install azure-identity azure-mgmt-resource azure-mgmt-monitor azure-mgmt-resource-graph python-dotenv

# Initialize project
npm init -y

# Install Azure Identity and Management SDKs
npm install @azure/identity @azure/arm-monitor @azure/arm-resourcegraph dotenv
npm install --save-dev typescript @types/node ts-node

import os
import logging
from dotenv import load_dotenv
from azure.identity import DefaultAzureCredential
from azure.mgmt.resourcegraph import ResourceGraphClient
from azure.mgmt.resourcegraph.models import QueryRequest

# Configure logging for production audit trails
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

load_dotenv()

class AzureSecurityAuditor:
    def __init__(self):
        # DefaultAzureCredential handles Managed Identity in Azure 
        # and Environment Variables locally
        self.credential = DefaultAzureCredential()
        self.subscription_id = os.getenv("AZURE_SUBSCRIPTION_ID")
        self.client = ResourceGraphClient(self.credential)

    def detect_overprivileged_identities(self):
        """
        Queries Azure Resource Graph for Service Principals 
        that have 'Contributor' or 'Owner' roles at the subscription level,
        which is a primary target for data theft campaigns.
        """
        logger.info("Starting security audit: Checking for high-privilege identities...")

        # Kusto Query Language (KQL) to find high-risk identities
        query = """
        authorizationresources 
        | where type == 'icrosoft.authorization/roleassignments'
        | extend roleDefinitionId = properties.roleDefinitionId
        | extend principalId = properties.principalId
        | where roleDefinitionId in ('8e3af650-58d8-482c-aea1-ab585e7a2332', '74e329fc-2d74-4653-b11d-270000000000') 
        | project principalId, roleDefinitionId
        """

        try:
            request = QueryRequest(subscriptions=[self.subscription_id], query=query)
            response = self.client.query(request)

            if response.status == 'Succeeded':
                results = response.data
                if not results:
                    logger.info("Audit complete: No high-risk identities found.")
                    return []
                
                logger.warning(f"ALERT: Found {len(results)} high-risk identities!")
                return results
            else:
                logger.error(f"Query failed: {response.status}")
                return []

        except Exception as e:
            logger.error(f"Critical error during audit: {str(e)}")
            raise

if __name__ == "__main__":
    auditor = AzureSecurityAuditor()
    risky_identities = auditor.detect_overprivileged_identities()
    for identity in risky_identities:
        print(f"⚠️ HIGH RISK: Principal ID {identity['principalId']} has administrative access.")

import * as dotenv from 'dotenv';
import { DefaultAzureCredential } from '@azure/identity';
import { ResourceGraphClient } from '@azure/arm-resourcegraph';

dotenv.config();

/**
 * Interface for our Security Audit Results
 */
interface SecurityAlert {
    principalId: string;
    roleName: string;
}

class AzureSecurityEngine {
    private client: ResourceGraphClient;
    private subscriptionId: string;

    constructor() {
        this.subscriptionId = process.env.AZURE_SUBSCRIPTION_ID || '';
        const credential = new DefaultAzureCredential();
        this.client = new ResourceGraphClient(credential);
    }

    /**
     * Detects identities that could be used for data exfiltration
     */
    async auditDataAccessPermissions(): Promise<void> {
        console.log('🚀 Initiating Azure Security Scan...');

        const query = `
            authorizationresources 
            | where type == 'icrosoft.authorization/roleassignments'
            | project principalId = properties.principalId, roleId = properties.roleDefinitionId
        `;

        try {
            // Note: In a real production environment, you would use the 
            // specific SDK methods to execute the query
            const response = await this.client.query({
                subscriptions: [this.subscriptionId],
                query: query
            });

            if (response.data && response.data.length > 0) {
                this.processAlerts(response.data);
            } else {
                console.log('✅ No immediate threats detected.');
            }
        } catch (error) {
            console.error('❌ Audit failed:', error instanceof Error? error.message : error);
        }
    }

    private processAlerts(data: any[]): void {
        console.warn(`🚨 SECURITY ALERT: ${data.length} potential attack vectors detected!`);
        data.forEach(item => {
            console.warn(`[!] Suspect Principal: ${item.principalId}`);
        });
    }
}

// Execution
const engine = new AzureSecurityEngine();
engine.auditDataAccessPermissions();

# Azure Configuration
AZURE_SUBSCRIPTION_ID="your-uuid-here"
AZURE_TENANT_ID="your-tenant-id-here"
AZURE_CLIENT_ID="your-app-reg-id-here"
AZURE_CLIENT_SECRET="your-app-secret-here"

# Logging Level
LOG_LEVEL=INFO