Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Built-in rule] Add SystemAssigned, UserAssigned as an allowed identity on TA-000007, TA-000013, TA-000019 #370

Merged
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/built-in-rules.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ Cross-Origin Resource Sharing (CORS) should not allow all domains to access your
### TA-000013: Managed identity should be used in your function app
For enhanced authentication security, use a managed identity. On Azure, managed identities eliminate the need for developers to have to manage credentials by providing an identity for the Azure resource in Azure AD and using it to obtain Azure Active Directory (Azure AD) tokens.

**Recommendation**: To [use Managed Identity](https://docs.microsoft.com/azure/app-service/overview-managed-identity?tabs=dotnet), in the [Microsoft.Web/sites resource managed identity property](https://docs.microsoft.com/azure/templates/microsoft.web/sites?tabs=json#ManagedServiceIdentity), add (or update) the *type* property, setting its value to `"SystemAssigned"` or `"UserAssigned"` and providing any necessary identifiers for the identity if required.
richardsondev marked this conversation as resolved.
Show resolved Hide resolved
**Recommendation**: To [use Managed Identity](https://docs.microsoft.com/azure/app-service/overview-managed-identity?tabs=dotnet), in the [Microsoft.Web/sites resource managed identity property](https://docs.microsoft.com/azure/templates/microsoft.web/sites?tabs=json#ManagedServiceIdentity), add (or update) the *type* property, setting its value to `"SystemAssigned"`, `"UserAssigned"`, or `"SystemAssigned, UserAssigned"` and providing any necessary identifiers for the identity if required.
#### Severity: 2

### TA-000014: Remote debugging should be turned off for web apps
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
@description('Location for all resources.')
param location string = resourceGroup().location

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
name: 'managedIdentity'
location: location
}
resource missingIdentity 'Microsoft.Web/sites@2019-08-01' = {
kind: 'functionapp'
name: 'missingIdentity'
location: location
properties: {
siteConfig: {
detailedErrorLoggingEnabled: false
httpLoggingEnabled: false
requestTracingEnabled: false
}
}
}

resource systemManagedIdentity 'Microsoft.Web/sites@2019-08-01' = {
kind: 'functionapp'
name: 'systemManagedIdentity'
location: location
properties: {
siteConfig: {
detailedErrorLoggingEnabled: false
httpLoggingEnabled: false
requestTracingEnabled: false
}
}
identity: {
type: 'SystemAssigned'
}
}

resource userManagedIdentity 'Microsoft.Web/sites@2019-08-01' = {
kind: 'functionapp'
name: 'userManagedIdentity'
location: location
properties: {
siteConfig: {
detailedErrorLoggingEnabled: false
httpLoggingEnabled: false
requestTracingEnabled: false
}
}
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${managedIdentity.id}': {}
}
}
}

resource systemAndUserManagedIdentity 'Microsoft.Web/sites@2019-08-01' = {
kind: 'functionapp'
name: 'systemAndUserManagedIdentity'
location: location
properties: {
siteConfig: {
detailedErrorLoggingEnabled: false
httpLoggingEnabled: false
requestTracingEnabled: false
}
}
identity: {
type: 'SystemAssigned,UserAssigned'
userAssignedIdentities: {
'${managedIdentity.id}': {}
}
}
}

resource systemAndUserManagedWithSpaceIdentity 'Microsoft.Web/sites@2019-08-01' = {
kind: 'functionapp'
name: 'systemAndUserManagedWithSpaceIdentity'
location: location
properties: {
siteConfig: {
detailedErrorLoggingEnabled: false
httpLoggingEnabled: false
requestTracingEnabled: false
}
}
identity: {
type: 'SystemAssigned, UserAssigned'
userAssignedIdentities: {
'${managedIdentity.id}': {}
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,128 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.29.47.4906",
"templateHash": "11204652936116461480"
}
},
"parameters": {
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "Location for all resources."
}
}
},
"resources": [
{
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
"apiVersion": "2018-11-30",
"name": "managedIdentity",
"location": "[parameters('location')]"
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "missingIdentity",
"kind": "functionapp",
"location": "[parameters('location')]",
"properties": {
"siteConfig": {
"detailedErrorLoggingEnabled": false,
"httpLoggingEnabled": false,
"requestTracingEnabled": false
}
}
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "systemManagedIdentity",
"kind": "functionapp",
"location": "[parameters('location')]",
"properties": {
"siteConfig": {
"detailedErrorLoggingEnabled": false,
"httpLoggingEnabled": false,
"requestTracingEnabled": false
}
},
"identity": {
"type": "SystemAssigned"
}
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "userManagedIdentity",
"kind": "functionapp",
"location": "[parameters('location')]",
"properties": {
"siteConfig": {
"detailedErrorLoggingEnabled": false,
"httpLoggingEnabled": false,
"requestTracingEnabled": false
}
},
"identity": {
"type": "UserAssigned",
"userAssignedIdentities": {
"[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity'))]": {}
}
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity')]"
]
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "systemAndUserManagedIdentity",
"kind": "functionapp",
"location": "[parameters('location')]",
"properties": {
"siteConfig": {
"detailedErrorLoggingEnabled": false,
"httpLoggingEnabled": false,
"requestTracingEnabled": false
}
},
"identity": {
"type": "SystemAssigned,UserAssigned",
"userAssignedIdentities": {
"[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity'))]": {}
}
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity')]"
]
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2019-08-01",
"name": "systemAndUserManagedWithSpaceIdentity",
"kind": "functionapp",
"location": "[parameters('location')]",
"properties": {
"siteConfig": {
"detailedErrorLoggingEnabled": false,
"httpLoggingEnabled": false,
"requestTracingEnabled": false
}
},
"identity": {
"type": "SystemAssigned, UserAssigned",
"userAssignedIdentities": {
"[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity'))]": {}
}
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'managedIdentity')]"
]
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
[
{
"Template": "FunctionAppServices.json",
"ReportedFailures": [
{
"LineNumber": 27,
"Description": "Function app is missing an identity declaration"
}
]
}
]
5 changes: 1 addition & 4 deletions src/Analyzer.Core/Rules/BuiltInRules.json
Original file line number Diff line number Diff line change
Expand Up @@ -392,10 +392,7 @@
"allOf": [
richardsondev marked this conversation as resolved.
Show resolved Hide resolved
{
"path": "identity.type",
"in": [
"UserAssigned",
"SystemAssigned"
]
"regex": "^(UserAssigned|SystemAssigned|SystemAssigned, *UserAssigned)$"
richardsondev marked this conversation as resolved.
Show resolved Hide resolved
}
]
}
Expand Down
Loading