Skip to content

Commit ff021f8

Browse files
BernieWhiteBernieWhite
authored
Updated Azure.Deployment.SecureValue Azure#2650 Azure#2651 (Azure#3139)
1 parent 8528e66 commit ff021f8

17 files changed

+635
-428
lines changed

‎data/secret-property.json

+204
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
{
2+
"Microsoft.AAD/DomainServices": [
3+
"properties.ldapsSettings.pfxCertificatePassword"
4+
],
5+
"Microsoft.ApiManagement/Service": [
6+
"properties.hostnameConfigurations.certificatePassword",
7+
"properties.certificates.certificatePassword"
8+
],
9+
"Microsoft.ApiManagement/Service/AuthorizationServers": [
10+
"properties.clientSecret",
11+
"properties.resourceOwnerPassword"
12+
],
13+
"Microsoft.ApiManagement/Service/Backends": [
14+
"properties.proxy.password"
15+
],
16+
"Microsoft.ApiManagement/Service/Certificates": [
17+
"properties.password"
18+
],
19+
"Microsoft.ApiManagement/Service/IdentityProviders": [
20+
"properties.clientSecret"
21+
],
22+
"Microsoft.ApiManagement/Service/OpenidConnectProviders": [
23+
"properties.clientSecret"
24+
],
25+
"Microsoft.ApiManagement/Service/Users": [
26+
"properties.password"
27+
],
28+
"Microsoft.App/containerApps": [
29+
"properties.configuration.secrets[*].value"
30+
],
31+
"Microsoft.App/jobs": [
32+
"properties.configuration.secrets[*].value"
33+
],
34+
"Microsoft.App/managedEnvironments": [
35+
"properties.customDomainConfiguration.certificatePassword",
36+
"properties.customDomainConfiguration.certificateValue"
37+
],
38+
"Microsoft.App/managedEnvironments/certificates": [
39+
"properties.password",
40+
"properties.value"
41+
],
42+
"Microsoft.Automation/AutomationAccounts/Credentials": [
43+
"properties.password"
44+
],
45+
"Microsoft.Batch/BatchAccounts/Pools": [
46+
"properties.userAccounts.linuxUserConfiguration.sshPrivateKey"
47+
],
48+
"Microsoft.Blockchain/BlockchainMembers": [
49+
"properties.password",
50+
"properties.consortiumManagementAccountPassword"
51+
],
52+
"Microsoft.Blockchain/BlockchainMembers/TransactionNodes": [
53+
"properties.password"
54+
],
55+
"Microsoft.BotService/BotServices/Connections": [
56+
"properties.clientSecret"
57+
],
58+
"Microsoft.Compute/virtualMachineScaleSets": [
59+
"properties.virtualMachineProfile.osProfile.adminPassword"
60+
],
61+
"Microsoft.Compute/VirtualMachineScaleSets/Virtualmachines": [
62+
"properties.osProfile.adminPassword"
63+
],
64+
"Microsoft.Compute/VirtualMachines": [
65+
"properties.osProfile.adminPassword"
66+
],
67+
"Microsoft.ContainerInstance/ContainerGroups": [
68+
"properties.imageRegistryCredentials.password"
69+
],
70+
"Microsoft.ContainerService/ContainerServices": [
71+
"properties.servicePrincipalProfile.secret",
72+
"properties.windowsProfile.adminPassword"
73+
],
74+
"Microsoft.ContainerService/ManagedClusters": [
75+
"properties.windowsProfile.adminPassword",
76+
"properties.servicePrincipalProfile.secret",
77+
"properties.aadProfile.serverAppSecret"
78+
],
79+
"Microsoft.ContainerService/OpenShiftManagedClusters": [
80+
"properties.authProfile.identityProviders.provider.secret"
81+
],
82+
"Microsoft.Resources/deploymentScripts": [
83+
"properties.storageAccountSettings.storageAccountKey",
84+
"properties.environmentVariables[*].secureValue"
85+
],
86+
"Microsoft.DBforMariaDB/Servers": [
87+
"properties.administratorLoginPassword"
88+
],
89+
"Microsoft.DBforMySQL/Servers": [
90+
"properties.administratorLoginPassword"
91+
],
92+
"Microsoft.DBforPostgreSQL/Servers": [
93+
"properties.administratorLoginPassword"
94+
],
95+
"Microsoft.DataMigration/Services/Projects": [
96+
"properties.sourceConnectionInfo.password",
97+
"properties.targetConnectionInfo.password"
98+
],
99+
"Microsoft.DevTestLab/Labs/Formulas": [
100+
"properties.formulaContent.properties.password"
101+
],
102+
"Microsoft.DevTestLab/Labs/Users/Secrets": [
103+
"properties.value"
104+
],
105+
"Microsoft.DevTestLab/Labs/Virtualmachines": [
106+
"properties.password"
107+
],
108+
"Microsoft.HDInsight/Clusters": [
109+
"properties.securityProfile.domainUserPassword",
110+
"properties.computeProfile.roles.osProfile.linuxOperatingSystemProfile.password"
111+
],
112+
"Microsoft.HDInsight/Clusters/Applications": [
113+
"properties.computeProfile.roles.osProfile.linuxOperatingSystemProfile.password"
114+
],
115+
"Microsoft.KeyVault/Vaults/Secrets": [
116+
"properties.value"
117+
],
118+
"Microsoft.Logic/IntegrationAccounts/Agreements": [
119+
"properties.content.x12.receiveAgreement.protocolSettings.securitySettings.passwordValue",
120+
"properties.content.x12.sendAgreement.protocolSettings.securitySettings.passwordValue",
121+
"properties.content.edifact.receiveAgreement.protocolSettings.envelopeSettings.recipientReferencePasswordValue",
122+
"properties.content.edifact.sendAgreement.protocolSettings.envelopeSettings.recipientReferencePasswordValue",
123+
"properties.content.edifact.receiveAgreement.protocolSettings.envelopeSettings.groupApplicationPassword",
124+
"properties.content.edifact.sendAgreement.protocolSettings.envelopeSettings.groupApplicationPassword",
125+
"properties.content.edifact.receiveAgreement.protocolSettings.envelopeOverrides.applicationPassword",
126+
"properties.content.edifact.sendAgreement.protocolSettings.envelopeOverrides.applicationPassword"
127+
],
128+
"Microsoft.NetApp/NetAppAccounts": [
129+
"properties.activeDirectories.password"
130+
],
131+
"Microsoft.Network/ApplicationGateways": [
132+
"properties.sslCertificates.properties.password"
133+
],
134+
"Microsoft.Network/Connections": [
135+
"properties.virtualNetworkGateway1.properties.vpnClientConfiguration.radiusServerSecret",
136+
"properties.virtualNetworkGateway2.properties.vpnClientConfiguration.radiusServerSecret",
137+
"properties.sharedKey"
138+
],
139+
"Microsoft.Network/VirtualNetworkGateways": [
140+
"properties.vpnClientConfiguration.radiusServerSecret"
141+
],
142+
"Microsoft.Network/VirtualWans/P2sVpnServerConfigurations": [
143+
"properties.radiusServerSecret"
144+
],
145+
"Microsoft.Network/VpnServerConfigurations": [
146+
"properties.radiusServerSecret"
147+
],
148+
"Microsoft.NotificationHubs/Namespaces/NotificationHubs": [
149+
"properties.wnsCredential.properties.secretKey",
150+
"properties.admCredential.properties.clientSecret",
151+
"properties.baiduCredential.properties.baiduSecretKey"
152+
],
153+
"Microsoft.ServiceFabricMesh/Applications": [
154+
"properties.services.properties.codePackages.imageRegistryCredential.password"
155+
],
156+
"Microsoft.ServiceFabricMesh/Secrets/Values": [
157+
"properties.value"
158+
],
159+
"Microsoft.Sql/ManagedInstances": [
160+
"properties.administratorLoginPassword"
161+
],
162+
"Microsoft.Sql/Servers": [
163+
"properties.administratorLoginPassword"
164+
],
165+
"Microsoft.Sql/Servers/Databases/Extensions": [
166+
"properties.administratorLoginPassword"
167+
],
168+
"Microsoft.Sql/Servers/Databases/SyncGroups": [
169+
"properties.hubDatabasePassword"
170+
],
171+
"Microsoft.Sql/Servers/Databases/SyncGroups/SyncMembers": [
172+
"properties.password"
173+
],
174+
"Microsoft.Sql/Servers/JobAgents/Credentials": [
175+
"properties.password"
176+
],
177+
"Microsoft.SqlVirtualMachine/SqlVirtualMachines": [
178+
"properties.wsfcDomainCredentials.clusterBootstrapAccountPassword",
179+
"properties.wsfcDomainCredentials.clusterOperatorAccountPassword",
180+
"properties.wsfcDomainCredentials.sqlServiceAccountPassword",
181+
"properties.autoBackupSettings.password",
182+
"properties.keyVaultCredentialSettings.servicePrincipalSecret",
183+
"properties.serverConfigurationsManagementSettings.sqlConnectivityUpdateSettings.sqlAuthUpdatePassword"
184+
],
185+
"Microsoft.StorSimple/Managers/Devices/VolumeContainers": [
186+
"properties.encryptionKey.value"
187+
],
188+
"Microsoft.StorSimple/Managers/StorageAccountCredentials": [
189+
"properties.accessKey.value"
190+
],
191+
"Microsoft.StreamAnalytics/Streamingjobs": [
192+
"properties.inputs[*].properties.datasource.properties.password",
193+
"properties.outputs[*].properties.datasource.properties.password"
194+
],
195+
"Microsoft.StreamAnalytics/Streamingjobs/Outputs": [
196+
"properties.datasource.properties.password"
197+
],
198+
"Microsoft.Web/Certificates": [
199+
"properties.password"
200+
],
201+
"Microsoft.Web/Sourcecontrols": [
202+
"properties.tokenSecret"
203+
]
204+
}

‎docs/CHANGELOG-v1.md

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,14 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3131

3232
What's changed since v1.39.3:
3333

34+
- Updated rules:
35+
- Deployment:
36+
- Updated `Azure.Deployment.SecureValue` to check additional resource types by @BernieWhite.
37+
[#2650](https://github.com/Azure/PSRule.Rules.Azure/issues/2650)
38+
[#2651](https://github.com/Azure/PSRule.Rules.Azure/issues/2651)
39+
- Added support for container apps secret properties.
40+
- Added support for deployment script secret properties.
41+
- Bumped rule set to `2024_12`.
3442
- Engineering:
3543
- Migrated Azure samples into PSRule for Azure by @BernieWhite.
3644
[#3085](https://github.com/Azure/PSRule.Rules.Azure/issues/3085)

‎docs/en/rules/Azure.Deployment.SecureValue.md

+6-9
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
reviewed: 2022-10-10
33
severity: Critical
44
pillar: Security
5-
category: Infrastructure provisioning
5+
category: SE:02 Secured development lifecycle
66
resource: Deployment
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Deployment.SecureValue/
88
---
99

10-
# Use secure resource values
10+
# Deployment sets a secret property with a non-secure value
1111

1212
## SYNOPSIS
1313

14-
Use secure parameters for setting properties of resources that contain sensitive information.
14+
A secret property set from a non-secure value may leak the secret into deployment history or logs.
1515

1616
## DESCRIPTION
1717

@@ -80,15 +80,12 @@ resource goodSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
8080

8181
## NOTES
8282

83-
This rule checks the following resource type properties:
83+
For a list of resource types and properties that are checked by this rule see:
8484

85-
- `Microsoft.KeyVault/vaults/secrets`:
86-
- `properties.value`
87-
- `Microsoft.Compute/virtualMachineScaleSets`:
88-
- `properties.virtualMachineProfile.osProfile.adminPassword`
85+
- https://github.com/Azure/PSRule.Rules.Azure/blob/main/data/secret-property.json
8986

9087
## LINKS
9188

92-
- [Infrastructure provisioning considerations in Azure](https://learn.microsoft.com/azure/architecture/framework/security/deploy-infrastructure)
89+
- [SE:02 Secured development lifecycle](https://learn.microsoft.com/azure/well-architected/security/secure-development-lifecycle)
9390
- [Use Azure Key Vault to pass secure parameter value during Bicep deployment](https://learn.microsoft.com/azure/azure-resource-manager/bicep/key-vault-parameter)
9491
- [Integrate Azure Key Vault in your ARM template deployment](https://learn.microsoft.com/azure/azure-resource-manager/templates/template-tutorial-use-key-vault#edit-the-parameters-file)

‎src/PSRule.Rules.Azure.BuildTool/ClientBuilder.cs

+18-19
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,26 @@
66
using System.CommandLine.Invocation;
77
using PSRule.Rules.Azure.BuildTool.Resources;
88

9-
namespace PSRule.Rules.Azure.BuildTool
9+
namespace PSRule.Rules.Azure.BuildTool;
10+
11+
internal sealed class ClientBuilder : CommandBuilder
1012
{
11-
internal sealed class ClientBuilder : CommandBuilder
12-
{
13-
private ClientBuilder(RootCommand cmd) : base(cmd) { }
13+
private ClientBuilder(RootCommand cmd) : base(cmd) { }
1414

15-
public static ClientBuilder New()
16-
{
17-
var cmd = new RootCommand();
18-
return new ClientBuilder(cmd);
19-
}
15+
public static ClientBuilder New()
16+
{
17+
var cmd = new RootCommand();
18+
return new ClientBuilder(cmd);
19+
}
2020

21-
public ClientBuilder AddProviderResource()
22-
{
23-
var cmd = new Command("provider", CmdStrings.Provider_Description);
24-
cmd.AddOption(new Option<string>(
25-
new string[] { "--output-path" }
26-
));
27-
cmd.Handler = CommandHandler.Create<ProviderResourceOption, InvocationContext>(ProviderResource.Build);
28-
Command.AddCommand(cmd);
29-
return this;
30-
}
21+
public ClientBuilder AddProviderResource()
22+
{
23+
var cmd = new Command("provider", CmdStrings.Provider_Description);
24+
cmd.AddOption(new Option<string>(
25+
["--output-path"]
26+
));
27+
cmd.Handler = CommandHandler.Create<ProviderResourceOption, InvocationContext>(ProviderResource.Build);
28+
Command.AddCommand(cmd);
29+
return this;
3130
}
3231
}

0 commit comments

Comments
 (0)