516 lines
15 KiB
Plaintext
516 lines
15 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
For https://azure.microsoft.com/en-us/services/app-service/[App Service]:
|
|
|
|
[source,json,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Web/sites",
|
|
"apiVersion": "2022-03-01",
|
|
"name": "example"
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=101,diff-type=noncompliant]
|
|
----
|
|
resource appService 'Microsoft.Web/sites@2022-09-01' = {
|
|
name: 'example'
|
|
// Sensitive: no authentication defined
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/api-management/[API Management]:
|
|
|
|
[source,json,diff-id=2,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.ApiManagement/service",
|
|
"apiVersion": "2022-09-01-preview",
|
|
"name": "example"
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=102,diff-type=noncompliant]
|
|
----
|
|
resource apiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
|
|
name: 'example'
|
|
// Sensitive: no portal authentication defined
|
|
|
|
resource apis 'apis@2022-09-01-preview' = {
|
|
name: 'exampleApi'
|
|
properties: {
|
|
path: '/test'
|
|
// Sensitive: no API authentication defined
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linked Services:
|
|
|
|
[source,json,diff-id=3,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.DataFactory/factories/linkedservices",
|
|
"apiVersion": "2018-06-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"type": "Web",
|
|
"typeProperties": {
|
|
"authenticationType": "Anonymous"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=103,diff-type=noncompliant]
|
|
----
|
|
resource linkedService 'Microsoft.DataFactory/factories/linkedservices@2018-06-01' = {
|
|
name: 'example'
|
|
properties: {
|
|
type: 'Web'
|
|
typeProperties: {
|
|
authenticationType: 'Anonymous' // Sensitive
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accounts and Storage Containers]:
|
|
|
|
[source,json,diff-id=4,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Storage/storageAccounts",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"allowBlobPublicAccess": true
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=104,diff-type=noncompliant]
|
|
----
|
|
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
|
|
name: 'example'
|
|
properties: {
|
|
allowBlobPublicAccess: true // Sensitive
|
|
}
|
|
}
|
|
----
|
|
|
|
[source,json,diff-id=5,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Storage/storageAccounts",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "example",
|
|
"resources": [
|
|
{
|
|
"type": "blobServices/containers",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "blobContainerExample",
|
|
"properties": {
|
|
"publicAccess": "Blob"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=105,diff-type=noncompliant]
|
|
----
|
|
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
|
|
name: 'example'
|
|
|
|
resource blobService 'blobServices@2022-09-01' = {
|
|
name: 'default'
|
|
|
|
resource containers 'containers@2022-09-01' = {
|
|
name: 'exampleContainer'
|
|
properties: {
|
|
publicAccess: 'Blob' // Sensitive
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:
|
|
|
|
[source,json,diff-id=6,diff-type=noncompliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Cache/redis",
|
|
"apiVersion": "2022-06-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"redisConfiguration": {
|
|
"authnotrequired": "true"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=106,diff-type=noncompliant]
|
|
----
|
|
resource redisCache 'Microsoft.Cache/redis@2023-04-01' = {
|
|
name: 'example'
|
|
location: location
|
|
properties: {
|
|
redisConfiguration: {
|
|
authnotrequired: 'true' // Sensitive
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
For https://azure.microsoft.com/en-us/services/app-service/[App Services and equivalent]:
|
|
|
|
[source,json,diff-id=1,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Web/sites",
|
|
"apiVersion": "2022-03-01",
|
|
"name": "example",
|
|
"resources": [
|
|
{
|
|
"type": "config",
|
|
"apiVersion": "2022-03-01",
|
|
"name": "authsettingsV2",
|
|
"properties": {
|
|
"globalValidation": {
|
|
"requireAuthentication": true,
|
|
"unauthenticatedClientAction": "RedirectToLoginPage"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=101,diff-type=compliant]
|
|
----
|
|
resource appService 'Microsoft.Web/sites@2022-09-01' = {
|
|
name: 'example'
|
|
|
|
resource authSettings 'config@2022-09-01' = { // Compliant
|
|
name: 'authsettingsV2'
|
|
properties: {
|
|
globalValidation: {
|
|
requireAuthentication: true
|
|
unauthenticatedClientAction: 'AllowAnonymous'
|
|
}
|
|
platform: {
|
|
enabled: true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/api-management/[API Management]:
|
|
|
|
[source,json,diff-id=2,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.ApiManagement/service",
|
|
"apiVersion": "2022-09-01-preview",
|
|
"name": "example",
|
|
"resources": [
|
|
{
|
|
"type": "portalsettings",
|
|
"apiVersion": "2022-09-01-preview",
|
|
"name": "signin",
|
|
"properties": {
|
|
"enabled": true
|
|
}
|
|
},
|
|
{
|
|
"type": "apis",
|
|
"apiVersion": "2022-09-01-preview",
|
|
"name": "exampleApi",
|
|
"properties": {
|
|
"authenticationSettings": {
|
|
"openid": {
|
|
"bearerTokenSendingMethods": ["authorizationHeader"],
|
|
"openidProviderId": "<an OpenID provider ID>"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=102,diff-type=compliant]
|
|
----
|
|
resource apiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
|
|
name: 'example'
|
|
|
|
resource portalSettings 'portalsettings@2022-09-01-preview' = {
|
|
name: 'signin'
|
|
properties: {
|
|
enabled: true // Compliant: Sign-in is enabled for portal access
|
|
}
|
|
}
|
|
|
|
resource apis 'apis@2022-09-01-preview' = {
|
|
name: 'exampleApi'
|
|
properties: {
|
|
path: '/test'
|
|
authenticationSettings: { // Compliant: API has authentication enabled
|
|
openid: {
|
|
bearerTokenSendingMethods: ['authorizationHeader']
|
|
openidProviderId: '<an OpenID provider ID>'
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/data-factory/[Data Factory] Linked Services:
|
|
|
|
[source,json,diff-id=3,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.DataFactory/factories/linkedservices",
|
|
"apiVersion": "2018-06-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"type": "Web",
|
|
"typeProperties": {
|
|
"authenticationType": "Basic"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=103,diff-type=compliant]
|
|
----
|
|
@secure()
|
|
@description('The password for authentication')
|
|
param password string
|
|
|
|
resource linkedService 'Microsoft.DataFactory/factories/linkedservices@2018-06-01' = {
|
|
name: 'example'
|
|
properties: {
|
|
type: 'Web'
|
|
typeProperties: {
|
|
authenticationType: 'Basic' // Compliant
|
|
username: 'test'
|
|
password: {
|
|
type: 'SecureString'
|
|
value: password
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/product-categories/storage/[Storage Accounts]:
|
|
|
|
[source,json,diff-id=4,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Storage/storageAccounts",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"allowBlobPublicAccess": false
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=104,diff-type=compliant]
|
|
----
|
|
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
|
|
name: 'example'
|
|
properties: {
|
|
allowBlobPublicAccess: false // Compliant
|
|
}
|
|
}
|
|
----
|
|
|
|
[source,json,diff-id=5,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Storage/storageAccounts",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "example",
|
|
"resources": [
|
|
{
|
|
"type": "blobServices/containers",
|
|
"apiVersion": "2022-09-01",
|
|
"name": "blobContainerExample",
|
|
"properties": {
|
|
"publicAccess": "None"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=105,diff-type=compliant]
|
|
----
|
|
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
|
|
name: 'example'
|
|
|
|
resource blobService 'blobServices@2022-09-01' = {
|
|
name: 'default'
|
|
|
|
resource containers 'containers@2022-09-01' = {
|
|
name: 'exampleContainer'
|
|
properties: {
|
|
publicAccess: 'None' // Compliant
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
For https://azure.microsoft.com/en-us/services/cache/[Redis Caches]:
|
|
|
|
[source,json,diff-id=6,diff-type=compliant]
|
|
----
|
|
{
|
|
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
"contentVersion": "1.0.0.0",
|
|
"resources": [
|
|
{
|
|
"type": "Microsoft.Cache/redis",
|
|
"apiVersion": "2022-06-01",
|
|
"name": "example",
|
|
"properties": {
|
|
"redisConfiguration": {}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
----
|
|
[source,bicep,diff-id=106,diff-type=compliant]
|
|
----
|
|
resource redisCache 'Microsoft.Cache/redis@2023-04-01' = {
|
|
name: 'example'
|
|
location: location
|
|
properties: {
|
|
redisConfiguration: {
|
|
// Compliant: authentication is enabled by default
|
|
}
|
|
}
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* For ``Microsoft.Web/sites``:
|
|
** If the resource is not found: Omitting ``authsettingsV2`` disables authentication. Make sure it is safe here.
|
|
** If a property of ``authsettingsV2`` is set to an insecure value: Make sure that disabling authentication is safe here.
|
|
|
|
* For ``Microsoft.ApiManagement/service/portalsettings``:
|
|
** If ``properties.enabled == false``: Make sure that giving anonymous access without enforcing sign-in is safe here.
|
|
** If the resource is not found: Omitting ``sign_in`` authorizes anonymous access. Make sure it is safe here.
|
|
* For ``Microsoft.ApiManagement/service/apis`` (if ``authenticationSettings`` is not set): Omitting ``authenticationSettings`` disables authentication. Make sure it is safe here.
|
|
|
|
* For ``Microsoft.DataFactory/factories/linkedservices``: Make sure that authorizing anonymous access is safe here.
|
|
|
|
* For ``Microsoft.Storage/storageAccounts``: Make sure that authorizing potential anonymous access is safe here.
|
|
|
|
* For ``Microsoft.Storage/storageAccounts/blobServices/containers``: Make sure that authorizing potential anonymous access is safe here.
|
|
|
|
* For ``Microsoft.Cache/redis``: Make sure that disabling authentication is safe here.
|
|
|
|
=== Highlighting
|
|
|
|
* For ``Microsoft.Web/sites``:
|
|
** If ``authsettingsV2`` is not found: Highlight the ``Web/sites`` resource.
|
|
** If a property of ``authsettingsV2`` is set to an insecure value: Highlight that property.
|
|
|
|
* For ``Microsoft.ApiManagement/service/portalsettings``:
|
|
** If ``properties.enabled == false``: Highlight the property.
|
|
** If the resource is not found: Highlight the ``ApiManagement/service`` resource.
|
|
* For ``Microsoft.ApiManagement/service/apis`` (if ``authenticationSettings`` is not set): Highlight the ``ApiManagement/service/apis`` resource.
|
|
|
|
* For ``Microsoft.DataFactory/factories/linkedservices``: Highlight the ``authenticationType`` property.
|
|
|
|
* For ``Microsoft.Storage/storageAccounts``: Highlight the ``properties.allowBlobPublicAccess`` property.
|
|
|
|
* For ``Microsoft.Storage/storageAccounts/blobServices/containers``: Highlight the ``properties.publicAccess`` property.
|
|
|
|
* For ``Microsoft.Cache/redis``: Highlight the ``properties.redisConfiguration.authnotrequired`` property.
|
|
|
|
endif::env-github,rspecator-view[]
|