rspec/rules/S6379/azureresourcemanager/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

For https://docs.microsoft.com/en-us/azure/batch/nodes-and-pools#pools[Azure Batch Pools]:

[source,json,diff-id=1,diff-type=noncompliant]
----
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "name": "example",
      "type": "Microsoft.Batch/batchAccounts/pools",
      "apiVersion": "2022-10-01",
      "properties": {
        "startTask": {
          "userIdentity": {
            "autoUser": {
              "elevationLevel": "Admin"
            }
          }
        }
      }
    }
  ]
}
----

[source,bicep,diff-id=3,diff-type=noncompliant]
----
resource AdminBatchPool 'Microsoft.Batch/batchAccounts/pools@2022-10-01' = {
  properties: {
    startTask: {
      userIdentity: {
        autoUser: {
          elevationLevel: 'Admin' // Sensitive
        }
      }
    }
  }
}
----

For https://azure.microsoft.com/en-us/services/container-registry/[Azure Container Registries]:

[source,json,diff-id=2,diff-type=noncompliant]
----
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "name": "example",
      "type": "Microsoft.ContainerRegistry/registries",
      "apiVersion": "2023-01-01-preview",
      "properties": {
        "adminUserEnabled": true
      }
    }
  ]
}
----

[source,bicep,diff-id=4,diff-type=noncompliant]
----
resource acrAdminUserDisabled 'Microsoft.ContainerRegistry/registries@2021-09-01' = {
  properties: {
    adminUserEnabled: true // Sensitive
  }
}
----

== Compliant Solution

For https://docs.microsoft.com/en-us/azure/batch/nodes-and-pools#pools[Azure Batch Pools]:

[source,json,diff-id=1,diff-type=compliant]
----
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "name": "example",
      "type": "Microsoft.Batch/batchAccounts/pools",
      "apiVersion": "2022-10-01",
      "properties": {
        "startTask": {
          "userIdentity": {
            "autoUser": {
              "elevationLevel": "NonAdmin"
            }
          }
        }
      }
    }
  ]
}
----

[source,bicep,diff-id=3,diff-type=compliant]
----
resource AdminBatchPool 'Microsoft.Batch/batchAccounts/pools@2022-10-01' = {
  properties: {
    startTask: {
      userIdentity: {
        autoUser: {
          elevationLevel: 'NonAdmin'
        }
      }
    }
  }
}
----

For https://azure.microsoft.com/en-us/services/container-registry/[Azure Container Registries]:

[source,json,diff-id=2,diff-type=compliant]
----
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "name": "example",
      "type": "Microsoft.ContainerRegistry/registries",
      "apiVersion": "2023-01-01-preview",
      "properties": {
        "adminUserEnabled": false
      }
    }
  ]
}
----


[source,bicep,diff-id=4,diff-type=compliant]
----
resource acrAdminUserDisabled 'Microsoft.ContainerRegistry/registries@2021-09-01' = {
  properties: {
    adminUserEnabled: false
  }
}
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

=== Highlighting

* For ``Microsoft.Batch/batchAccounts/pools``, highlight ``"elevationLevel": "Admin"``.
* For ``Microsoft.ContainerRegistry/registries``, highlight ``"adminUserEnabled": true``.

endif::env-github,rspecator-view[]