elastic / cloudbeat / 29791327186

76%

main: 76%

Pull #7373

github

fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated

ResourceGraphProvider.runPaginatedQuery stopped fetching as soon as a
response reported ResultTruncated == false. On real Azure Resource Graph
responses that field is false on every ordinary paginated page (it only
flags cases where paging itself is unavailable, e.g. a `limit`/`take`
clause), so the loop exited after the very first page for any multi-page
result set and silently dropped every subsequent page of resources -
matching reports of ~250/309 Azure subscriptions surfacing only
subscription-level (governance) findings with zero resource-level
findings for storage accounts, VMs, key vaults, etc.

Per Microsoft's documented pagination contract, the presence of SkipToken
is the sole authoritative continuation signal. Update the loop to break
only when SkipToken is empty, and add a regression test that mocks a
3-page response where every page reports ResultTruncated == false (as
Azure genuinely does) but carries a SkipToken until the last page,
asserting all pages' assets are aggregated instead of just the first.

Investigation: https://github.com/elastic/seceng/issues/14395

3 of 3 new or added lines in 1 file covered. (100.0%)

10205 of 13409 relevant lines covered (76.11%)

15.91 hits per line