rules-azure

RISK: AKS local (static) kubeconfig accounts survive user offboarding and bypass Entra Conditional Access. FIX: set local_account_disabled=true, enable azure_active_directory_role_based_access_control, and restrict api_server_authorized_ip_ranges.

RISK: ftps_state='AllAllowed' permits plaintext FTP for deployment credentials, trivially sniffed. FIX: set ftps_state='FtpsOnly' or 'Disabled' and deploy via managed identity / Run-From-Package.

RISK: App Service / Function App with TLS <1.2 allows downgrade attacks on session cookies and API keys. FIX: set minimum_tls_version='1.2'.

RISK: Basic SKU Public IP and Basic Load Balancer were retired on 30 Sept 2025 and lack DDoS/zone-redundancy defaults. FIX: set sku='Standard' and review dependent resources.

RISK: Cosmos DB key-based auth bypasses Entra RBAC and cannot be revoked per-user — a recurring theme in 2024 ChaosDB-class audits. FIX: set local_authentication_disabled=true and use aad_authentication / managed identity.

RISK: Allowing personal Microsoft accounts on an enterprise app was the pivot vector in the Jan 2024 Midnight Blizzard intrusion. FIX: set sign_in_audience='AzureADMyOrg' or validate the tenant_id claim before issuing tokens.

RISK: Hardcoded Azure Storage connection strings / account keys are the #1 Azure breach vector per the 2024 Microsoft DART report; once in git history they are assumed compromised. FIX: store in Key Vault and reference via managed identity, or use environment variables fed by a secret manager.

RISK: Hardcoded service-principal client_secret in Terraform source is recoverable from state files and VCS history. FIX: source from env (ARM_CLIENT_SECRET), a Key Vault data source, or migrate to OIDC / workload identity federation.

RISK: @azure/identity <4.2.1 is affected by the CVE-2024-35255 cross-SDK managed-identity EoP. FIX: bump @azure/identity to >=4.2.1 and re-run npm install.

RISK: azure-identity Python <1.16.1 is affected by CVE-2024-35255 (elevation of privilege via managed identity token validation). FIX: pin azure-identity>=1.16.1.

RISK: Key Vault network_acls with default_action='Allow' exposes secrets to any network caller, amplifying Storm-0558-class token-theft blast radius. FIX: set default_action='Deny' and add a private endpoint or specific ip_rules/virtual_network_subnet_ids.

RISK: Without purge protection, a compromised identity can irreversibly destroy secrets/keys/certs (ransom or sabotage). Microsoft mandates soft-delete on all new vaults since Feb 2025. FIX: enable purge_protection_enabled=true and soft-delete with >=90 day retention.

RISK: Disabling HTTPS-only allows cleartext HTTP to Storage accounts, exposing data and SAS tokens in transit. FIX: remove the setting (default true) or set enable_https_traffic_only=true.

RISK: NSGs allowing RDP (3389) or SSH (22) from the internet ('*'/'0.0.0.0/0') are brute-forced within hours. FIX: front with Azure Bastion or restrict source_address_prefix to a corporate CIDR.

RISK: Assigning 'Owner' or 'Contributor' at broad scope violates least privilege and enables lateral movement. FIX: use a narrowly-scoped built-in role (e.g. 'Reader', 'Storage Blob Data Reader') or a custom role.

RISK: Exposing SQL/Cosmos/Key Vault/Storage to the public internet widens the attack surface and bypasses VNet controls. FIX: set public_network_access_enabled=false and use a private endpoint or service endpoint.

RISK: A SQL/Postgres/MySQL firewall rule 0.0.0.0-255.255.255.255 exposes the database to the entire internet and invites credential-stuffing. FIX: narrow to specific CIDRs or delete the rule and use a private endpoint.

RISK: TLS 1.0/1.1 or disabled SSL enforcement on Azure SQL/MySQL/Postgres allows cleartext or downgraded connections leaking credentials. FIX: set minimal_tls_version='1.2' and ssl_enforcement_enabled=true.

RISK: Public blob/container access was the root cause of multiple 2024 Azure data-exfil incidents. FIX: set allow_nested_items_to_be_public=false and container_access_type='private'; front with SAS tokens or Entra RBAC.

RISK: Shared Key auth bypasses Entra RBAC and conditional access; MSRC 2024 guidance sets the API default to false after it was abused in ransomware-via-blob incidents. FIX: set shared_access_key_enabled=false and use managed identity / Entra RBAC.

RISK: TLS 1.0/1.1 was retired across Azure in Nov 2024 and is trivially downgraded. FIX: set min_tls_version='TLS1_2' (prefer 'TLS1_3' where supported).

RISK: hashicorp/azurerm <3.110 / any v2.x is unsupported and missed fixes for state-file secret exposure advisories. FIX: pin azurerm to '>= 4.0' (or latest 3.x LTS) in required_providers and run 'terraform init -upgrade'.