Best practices for Azure
org.openrewrite.terraform.azure.AzureBestPractices
Securely operate on Microsoft Azure.
Tags
- Azure
- terraform
Recipe source
GitHub, Issue Tracker, Maven Central
- groupId: org.openrewrite.recipe
- artifactId: rewrite-terraform
- version: 2.4.2
This recipe is composed of more than one recipe. If you want to customize the set of recipes this is composed of, you can find and copy the GitHub source for the recipe from the link above.
Definition
- Recipe List
- Yaml Recipe List
- Encrypt Azure VM data disk with ADE/CMK
- Enable Azure Storage secure transfer required
- Disable Kubernetes dashboard
- Ensure the storage container storing activity logs is not publicly accessible
- Ensure Azure Network Watcher NSG flow logs retention is greater than 90 days
- Ensure Azure App Service Web app redirects HTTP to HTTPS
- Ensure Web App uses the latest version of TLS encryption
- Ensure Web App uses the latest version of HTTP
- Ensure standard pricing tier is selected
- Ensure a security contact phone number is present
- Ensure Send email notification for high severity alerts is enabled
- Ensure Send email notification for high severity alerts to admins is enabled
- Ensure Azure SQL server audit log retention is greater than 90 days
- Ensure Azure SQL Server threat detection alerts are enabled for all threat types
- Ensure Azure SQL server send alerts to field value is set
- Ensure MSSQL servers have email service and co-administrators enabled
- Ensure MySQL server databases have Enforce SSL connection enabled
- Ensure Azure PostgreSQL database server with SSL connection is enabled
- Set Azure Storage Account default network access to deny
- Enable Azure Storage Account Trusted Microsoft Services access
- Ensure activity log retention is set to 365 days or greater
- Ensure log profile is configured to capture all activities
- Ensure all keys have an expiration date
- Ensure AKV secrets have an expiration date set
- Ensure Azure key vault is recoverable
- Ensure storage account uses latest TLS version
- Ensure public network access enabled is set to False for mySQL servers
- Ensure MySQL is using the latest version of TLS encryption
- Ensure app service enables HTTP logging
- Ensure app service enables detailed error messages
- Ensure app service enables failed request tracing
- Ensure PostgreSQL server disables public network access
- Ensure managed identity provider is enabled for app services
- Ensure FTP Deployments are disabled
- Ensure MySQL server disables public network access
- Ensure MySQL server enables geo-redundant backups
- Enable geo-redundant backups on PostgreSQL server
- Ensure key vault allows firewall rules settings
- Ensure key vault enables purge protection
- Ensure key vault secrets have
content_type
set - Ensure AKS policies add-on
- Ensure Azure application gateway has WAF enabled
- Ensure MySQL server enables Threat Detection policy
- Ensure PostgreSQL server enables Threat Detection policy
- Ensure PostgreSQL server enables infrastructure encryption
---
type: specs.openrewrite.org/v1beta/recipe
name: org.openrewrite.terraform.azure.AzureBestPractices
displayName: Best practices for Azure
description: Securely operate on Microsoft Azure.
tags:
- Azure
- terraform
recipeList:
- org.openrewrite.terraform.azure.EncryptAzureVMDataDiskWithADECMK
- org.openrewrite.terraform.azure.EnableAzureStorageSecureTransferRequired
- org.openrewrite.terraform.azure.DisableKubernetesDashboard
- org.openrewrite.terraform.azure.EnsureTheStorageContainerStoringActivityLogsIsNotPubliclyAccessible
- org.openrewrite.terraform.azure.EnsureAzureNetworkWatcherNSGFlowLogsRetentionIsGreaterThan90Days
- org.openrewrite.terraform.azure.EnsureAzureAppServiceWebAppRedirectsHTTPToHTTPS
- org.openrewrite.terraform.azure.EnsureWebAppUsesTheLatestVersionOfTLSEncryption
- org.openrewrite.terraform.azure.EnsureWebAppUsesTheLatestVersionOfHTTP
- org.openrewrite.terraform.azure.EnsureStandardPricingTierIsSelected
- org.openrewrite.terraform.azure.EnsureASecurityContactPhoneNumberIsPresent
- org.openrewrite.terraform.azure.EnsureSendEmailNotificationForHighSeverityAlertsIsEnabled
- org.openrewrite.terraform.azure.EnsureSendEmailNotificationForHighSeverityAlertsToAdminsIsEnabled
- org.openrewrite.terraform.azure.EnsureAzureSQLServerAuditLogRetentionIsGreaterThan90Days
- org.openrewrite.terraform.azure.EnsureAzureSQLServerThreatDetectionAlertsAreEnabledForAllThreatTypes
- org.openrewrite.terraform.azure.EnsureAzureSQLServerSendAlertsToFieldValueIsSet
- org.openrewrite.terraform.azure.EnsureMSSQLServersHaveEmailServiceAndCoAdministratorsEnabled
- org.openrewrite.terraform.azure.EnsureMySQLServerDatabasesHaveEnforceSSLConnectionEnabled
- org.openrewrite.terraform.azure.EnsureAzurePostgreSQLDatabaseServerWithSSLConnectionIsEnabled
- org.openrewrite.terraform.azure.SetAzureStorageAccountDefaultNetworkAccessToDeny
- org.openrewrite.terraform.azure.EnableAzureStorageAccountTrustedMicrosoftServicesAccess
- org.openrewrite.terraform.azure.EnsureActivityLogRetentionIsSetTo365DaysOrGreater
- org.openrewrite.terraform.azure.EnsureLogProfileIsConfiguredToCaptureAllActivities
- org.openrewrite.terraform.azure.EnsureAllKeysHaveAnExpirationDate
- org.openrewrite.terraform.azure.EnsureAKVSecretsHaveAnExpirationDateSet
- org.openrewrite.terraform.azure.EnsureAzureKeyVaultIsRecoverable
- org.openrewrite.terraform.azure.EnsureStorageAccountUsesLatestTLSVersion
- org.openrewrite.terraform.azure.EnsurePublicNetworkAccessEnabledIsSetToFalseForMySQLServers
- org.openrewrite.terraform.azure.EnsureMySQLIsUsingTheLatestVersionOfTLSEncryption
- org.openrewrite.terraform.azure.EnsureAppServiceEnablesHTTPLogging
- org.openrewrite.terraform.azure.EnsureAppServiceEnablesDetailedErrorMessages
- org.openrewrite.terraform.azure.EnsureAppServiceEnablesFailedRequestTracing
- org.openrewrite.terraform.azure.EnsurePostgreSQLServerDisablesPublicNetworkAccess
- org.openrewrite.terraform.azure.EnsureManagedIdentityProviderIsEnabledForAppServices
- org.openrewrite.terraform.azure.EnsureFTPDeploymentsAreDisabled
- org.openrewrite.terraform.azure.EnsureMySQLServerDisablesPublicNetworkAccess
- org.openrewrite.terraform.azure.EnsureMySQLServerEnablesGeoRedundantBackups
- org.openrewrite.terraform.azure.EnableGeoRedundantBackupsOnPostgreSQLServer
- org.openrewrite.terraform.azure.EnsureKeyVaultAllowsFirewallRulesSettings
- org.openrewrite.terraform.azure.EnsureKeyVaultEnablesPurgeProtection
- org.openrewrite.terraform.azure.EnsureKeyVaultSecretsHaveContentTypeSet
- org.openrewrite.terraform.azure.EnsureAKSPoliciesAddOn
- org.openrewrite.terraform.azure.EnsureAzureApplicationGatewayHasWAFEnabled
- org.openrewrite.terraform.azure.EnsureMySQLServerEnablesThreatDetectionPolicy
- org.openrewrite.terraform.azure.EnsurePostgreSQLServerEnablesThreatDetectionPolicy
- org.openrewrite.terraform.azure.EnsurePostgreSQLServerEnablesInfrastructureEncryption
Usage
This recipe has no required configuration options. It can be activated by adding a dependency on org.openrewrite.recipe:rewrite-terraform:2.4.2
in your build file or by running a shell command (in which case no build changes are needed):
- Gradle
- Gradle init script
- Maven POM
- Maven Command Line
- Moderne CLI
- Add the following to your
build.gradle
file:
plugins {
id("org.openrewrite.rewrite") version("6.26.0")
}
rewrite {
activeRecipe("org.openrewrite.terraform.azure.AzureBestPractices")
exportDatatables = true
}
repositories {
mavenCentral()
}
dependencies {
rewrite("org.openrewrite.recipe:rewrite-terraform:2.4.2")
}
- Run
gradle rewriteRun
to run the recipe.
- Create a file named
init.gradle
in the root of your project.
initscript {
repositories {
maven { url "https://plugins.gradle.org/m2" }
}
dependencies { classpath("org.openrewrite:plugin:6.26.0") }
}
rootProject {
plugins.apply(org.openrewrite.gradle.RewritePlugin)
dependencies {
rewrite("org.openrewrite.recipe:rewrite-terraform:2.4.2")
}
rewrite {
activeRecipe("org.openrewrite.terraform.azure.AzureBestPractices")
exportDatatables = true
}
afterEvaluate {
if (repositories.isEmpty()) {
repositories {
mavenCentral()
}
}
}
}
- Run the recipe.
gradle --init-script init.gradle rewriteRun
- Add the following to your
pom.xml
file:
<project>
<build>
<plugins>
<plugin>
<groupId>org.openrewrite.maven</groupId>
<artifactId>rewrite-maven-plugin</artifactId>
<version>5.43.0</version>
<configuration>
<exportDatatables>true</exportDatatables>
<activeRecipes>
<recipe>org.openrewrite.terraform.azure.AzureBestPractices</recipe>
</activeRecipes>
</configuration>
<dependencies>
<dependency>
<groupId>org.openrewrite.recipe</groupId>
<artifactId>rewrite-terraform</artifactId>
<version>2.4.2</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>
</project>
- Run
mvn rewrite:run
to run the recipe.
You will need to have Maven installed on your machine before you can run the following command.
mvn -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-terraform:RELEASE -Drewrite.activeRecipes=org.openrewrite.terraform.azure.AzureBestPractices -Drewrite.exportDatatables=true
You will need to have configured the Moderne CLI on your machine before you can run the following command.
mod run . --recipe AzureBestPractices
See how this recipe works across multiple open-source repositories
The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.
Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.
Data Tables
Source files that had results
org.openrewrite.table.SourcesFileResults
Source files that were modified by the recipe run.
Column Name | Description |
---|---|
Source path before the run | The source path of the file before the run. null when a source file was created during the run. |
Source path after the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
Parent of the recipe that made changes | In a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all. |
Recipe that made changes | The specific recipe that made a change. |
Estimated time saving | An estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds. |
Cycle | The recipe cycle in which the change was made. |
Source files that errored on a recipe
org.openrewrite.table.SourcesFileErrors
The details of all errors produced by a recipe run.
Column Name | Description |
---|---|
Source path | The file that failed to parse. |
Recipe that made changes | The specific recipe that made a change. |
Stack trace | The stack trace of the failure. |
Recipe performance
org.openrewrite.table.RecipeRunStats
Statistics used in analyzing the performance of recipes.
Column Name | Description |
---|---|
The recipe | The recipe whose stats are being measured both individually and cumulatively. |
Source file count | The number of source files the recipe ran over. |
Source file changed count | The number of source files which were changed in the recipe run. Includes files created, deleted, and edited. |
Cumulative scanning time | The total time spent across the scanning phase of this recipe. |
99th percentile scanning time | 99 out of 100 scans completed in this amount of time. |
Max scanning time | The max time scanning any one source file. |
Cumulative edit time | The total time spent across the editing phase of this recipe. |
99th percentile edit time | 99 out of 100 edits completed in this amount of time. |
Max edit time | The max time editing any one source file. |
Contributors
Jonathan Schneider, Aaron Gershman, pocan101, Kun Li, Knut Wannheden, Sam Snyder