Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify rule S6380: Add language AzureResourceManager (Bicep) #2298

Merged
merged 1 commit into from
Sep 13, 2023
Merged

Modify rule S6380: Add language AzureResourceManager (Bicep) #2298

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
178 changes: 178 additions & 0 deletions rules/S6380/azureresourcemanager/rule.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,13 @@ For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
]
}
----
[source,bicep,diff-id=101,diff-type=noncompliant]
----
resource appService 'Microsoft.Web/sites@2022-09-01' = {
name: 'example'
// Sensitive: no authentication defined
}
----

For https://azure.microsoft.com/en-us/services/api-management/[API Management]:

Expand All @@ -39,6 +46,21 @@ For https://azure.microsoft.com/en-us/services/api-management/[API Management]:
]
}
----
[source,bicep,diff-id=102,diff-type=noncompliant]
----
resource apiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
name: 'example'
// Sensitive: no portal authentication defined

resource apis 'apis@2022-09-01-preview' = {
name: 'exampleApi'
properties: {
path: '/test'
// Sensitive: no API authentication defined
}
}
}
----

For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linked Services:

Expand All @@ -62,6 +84,18 @@ For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linke
]
}
----
[source,bicep,diff-id=103,diff-type=noncompliant]
----
resource linkedService 'Microsoft.DataFactory/factories/linkedservices@2018-06-01' = {
name: 'example'
properties: {
type: 'Web'
typeProperties: {
authenticationType: 'Anonymous' // Sensitive
}
}
}
----

For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accounts and Storage Containers]:

Expand All @@ -82,6 +116,16 @@ For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accoun
]
}
----
[source,bicep,diff-id=104,diff-type=noncompliant]
----
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: 'example'
properties: {
allowBlobPublicAccess: true // Sensitive
}
}
----

[source,json,diff-id=5,diff-type=noncompliant]
----
{
Expand All @@ -106,6 +150,23 @@ For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accoun
]
}
----
[source,bicep,diff-id=105,diff-type=noncompliant]
----
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: 'example'

resource blobService 'blobServices@2022-09-01' = {
name: 'default'

resource containers 'containers@2022-09-01' = {
name: 'exampleContainer'
properties: {
publicAccess: 'Blob' // Sensitive
}
}
}
}
----

For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:

Expand All @@ -128,6 +189,18 @@ For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:
]
}
----
[source,bicep,diff-id=106,diff-type=noncompliant]
----
resource redisCache 'Microsoft.Cache/redis@2023-04-01' = {
name: 'example'
location: location
properties: {
redisConfiguration: {
authnotrequired: 'true' // Sensitive
}
}
}
----

== Compliant Solution

Expand Down Expand Up @@ -160,6 +233,25 @@ For https://azure.microsoft.com/en-us/services/app-service/[App Services and equ
]
}
----
[source,bicep,diff-id=101,diff-type=compliant]
----
resource appService 'Microsoft.Web/sites@2022-09-01' = {
name: 'example'

resource authSettings 'config@2022-09-01' = { // Compliant
name: 'authsettingsV2'
properties: {
globalValidation: {
requireAuthentication: true
unauthenticatedClientAction: 'AllowAnonymous'
}
platform: {
enabled: true
}
}
}
}
----

For https://azure.microsoft.com/en-us/services/api-management/[API Management]:

Expand Down Expand Up @@ -200,6 +292,32 @@ For https://azure.microsoft.com/en-us/services/api-management/[API Management]:
]
}
----
[source,bicep,diff-id=102,diff-type=compliant]
----
resource apiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
name: 'example'

resource portalSettings 'portalsettings@2022-09-01-preview' = {
name: 'signin'
properties: {
enabled: true // Compliant: Sign-in is enabled for portal access
}
}

resource apis 'apis@2022-09-01-preview' = {
name: 'exampleApi'
properties: {
path: '/test'
authenticationSettings: { // Compliant: API has authentication enabled
openid: {
bearerTokenSendingMethods: ['authorizationHeader']
openidProviderId: '<an OpenID provider ID>'
}
}
}
}
}
----

For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linked Services:

Expand All @@ -223,6 +341,27 @@ For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linke
]
}
----
[source,bicep,diff-id=103,diff-type=compliant]
----
@secure()
@description('The password for authentication')
param password string

resource linkedService 'Microsoft.DataFactory/factories/linkedservices@2018-06-01' = {
name: 'example'
properties: {
type: 'Web'
typeProperties: {
authenticationType: 'Basic' // Compliant
username: 'test'
password: {
type: 'SecureString'
value: password
}
}
}
}
----

For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accounts]:

Expand All @@ -243,6 +382,16 @@ For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accoun
]
}
----
[source,bicep,diff-id=104,diff-type=compliant]
----
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: 'example'
properties: {
allowBlobPublicAccess: false // Compliant
}
}
----

[source,json,diff-id=5,diff-type=compliant]
----
{
Expand All @@ -267,6 +416,23 @@ For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accoun
]
}
----
[source,bicep,diff-id=105,diff-type=compliant]
----
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
name: 'example'

resource blobService 'blobServices@2022-09-01' = {
name: 'default'

resource containers 'containers@2022-09-01' = {
name: 'exampleContainer'
properties: {
publicAccess: 'None' // Compliant
}
}
}
}
----

For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:

Expand All @@ -287,6 +453,18 @@ For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:
]
}
----
[source,bicep,diff-id=106,diff-type=compliant]
----
resource redisCache 'Microsoft.Cache/redis@2023-04-01' = {
name: 'example'
location: location
properties: {
redisConfiguration: {
// Compliant: authentication is enabled by default
}
}
}
----

include::../see.adoc[]

Expand Down