Add azure-storage-account-investigation CodeBundle

[rw-codebundle-agent]

Summary

• Adds azure-storage-account-investigation CodeBundle for issue automatic-index-update #127 (parent automatic-index-update #126)
• Four read-only investigation tasks: RBAC assignments, Resource Graph dependencies, transaction metrics by authentication type, and StorageBlobLogs access analysis
• Includes composite SLI scoring investigation completeness (account access, RBAC, metrics, diagnostic logs)
• Terraform test infrastructure provisions storage account with public blob access, Log Analytics diagnostic settings, and sample RBAC

Design spec alignment

• Resource-scoped SLX per azure_storage_accounts with AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, and AZURE_STORAGE_ACCOUNT_NAME qualifiers
• Each task emits JSON with issues array and risk_assessment (safe_to_disable_public_access, safe_to_disable_shared_key)
• Task 4 short-circuits with severity 1 when StorageBlobLogs diagnostic settings are not enabled
• Network-rule / authorization failures reported as findings (exit 0)

Scorer

python -m scorer.score codebundles/azure-storage-account-investigation
Score: 104/104 (passed)

Test plan

• Deploy .test/terraform and run runbook against test storage account
• Verify RBAC task lists role assignments and flags Owner/Contributor at resource scope
• Verify dependency task returns Resource Graph results with blind-spot notes
• Verify metrics task breaks down Transactions by Authentication dimension
• Verify access logs task short-circuits when diagnostics disabled; queries StorageBlobLogs when enabled
• Verify SLI produces 0-1 investigation completeness score

Made with Cursor