Skip to content

Docs: Update built-in rule help links #398

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Eitan-Shteinberg wants to merge 5 commits into from
Closed

Docs: Update built-in rule help links #398

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8e6141b
Docs: Update built-in rule help links
Eitan-Shteinberg Aug 1, 2025
53f89bd
Docs: Update rule descriptions and recommendations
Eitan-Shteinberg Aug 1, 2025
56cd97d
Fix: Correct typo in TA-000020
Eitan-Shteinberg Aug 1, 2025
0f83cff
Feat: Update TA-000025 with specific AKS versions
Eitan-Shteinberg Aug 1, 2025
ec9755b
Refactor: Revert TA-000034 to specific API version
Eitan-Shteinberg Aug 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 25 additions & 35 deletions src/Analyzer.Core/Rules/BuiltInRules.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,8 +626,8 @@
"id": "TA-000020",
"name": "Authorization.UseBuiltInRBAC",
"shortDescription": "Audit usage of custom RBAC roles",
"fullDescription": "Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling.",
"recommendation": "Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling",
"fullDescription": "Audit built-in roles such as 'Owner, Contributor, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling.",
"recommendation": "Audit built-in roles such as 'Owner, Contributor, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000020-audit-usage-of-custom-rbac-roles",
"severity": 3,
"evaluation": {
Expand Down Expand Up @@ -712,26 +712,16 @@
"id": "TA-000025",
"name": "AKS.UpgradeToNonVulnerableVersion",
"shortDescription": "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version",
"fullDescription": "Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+. Running on older versions could mean you are not using latest security classes. Usage of such old classes and types can make your application vulnerable.",
"recommendation": "Upgrade to a non-vulnerable Kubernetes version (1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+)",
"fullDescription": "Upgrade your Kubernetes service cluster to a supported version to protect against known vulnerabilities. Older versions of Kubernetes are not supported and do not receive security patches.",
"recommendation": "Upgrade to a supported Kubernetes version. According to the AKS release calendar, supported versions are 1.31, 1.32, 1.33, and newer.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000025-kubernetes-services-should-be-upgraded-to-a-non-vulnerable-kubernetes-version",
"severity": 1,
"evaluation": {
"resourceType": "Microsoft.ContainerService/managedClusters",
"allOf": [
{
"not": {
"path": "properties.kubernetesVersion",
"regex": "^1\\.((11\\.[0-8])|(12\\.[0-6])|(13\\.[0-4]))"
}
},
{
"not": {
"path": "properties.kubernetesVersion",
"regex": "^1\\.(([0-9]|10)\\.\\d+)"
}
}
]
"not": {
"path": "properties.kubernetesVersion",
"regex": "^1\\.(3[1-9]|[4-9][0-9])\\.\\d+"
}
}
},
{
Expand Down Expand Up @@ -807,7 +797,7 @@
},
{
"path": "properties.retentionDays",
"equals": 0 // 0 == unlimited retention
Copy link
Contributor

@JohnathonMohr JohnathonMohr Aug 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the comment here was helpful. Can you keep it?

"equals": 0
},
{
"path": "properties.retentionDays",
Expand Down Expand Up @@ -851,9 +841,9 @@
{
"id": "TA-000030",
"name": "ClassicCompute.MigrateToARM",
"shortDescription": "Migrate your Classic Compute VM to ARM",
"fullDescription": "Azure supports two deployment models: Classic and Azure Resource Manager (ARM). ARM provides several security enhancements to the Classic model.",
"recommendation": "Use ARM for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, ARM-based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management",
"shortDescription": "Migrate Classic Compute VMs to ARM",
"fullDescription": "Azure Resource Manager (ARM) provides several security enhancements over the Classic deployment model.",
"recommendation": "Use Azure Resource Manager for your virtual machines for improved security and access to features like RBAC, better auditing, managed identities, and Key Vault integration.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000030-migrate-your-classic-compute-vm-to-arm",
"severity": 1,
"evaluation": {
Expand All @@ -865,9 +855,9 @@
{
"id": "TA-000031",
"name": "ClassicStorage.MigrateToARM",
"shortDescription": "Migrate your Classic Storage Account to ARM",
"fullDescription": "Azure supports two deployment models: Classic and Azure Resource Manager (ARM). ARM provides several security enhancements to the Classic model.",
"recommendation": "Use ARM for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, ARM-based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management",
"shortDescription": "Migrate Classic Storage Accounts to ARM",
"fullDescription": "Azure Resource Manager (ARM) provides several security enhancements over the Classic deployment model.",
"recommendation": "Use Azure Resource Manager for your storage accounts for improved security and access to features like RBAC, better auditing, managed identities, and Key Vault integration.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000031-migrate-your-classic-storage-account-to-arm",
"severity": 1,
"evaluation": {
Expand All @@ -882,7 +872,7 @@
"shortDescription": "API Management calls to API backends should not bypass certificate thumbprint or name validation",
"fullDescription": "API Management calls to API backends should not bypass certificate thumbprint or name validation",
"recommendation": "To improve security, API Management should validate the backend server certificate for all API calls. Enable SSL certificate thumbprint and name validation by setting the tls.validateCertificateName and tls.validateCertificateChain properties to true.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000032-api-management-calls-to-api-backends-should-not-bypass-certificate-thumbprint-or-name-validation",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000032-api-management-calls-to-api-backends-should-not-bypass-certificate-thumbprint-or-name-validation",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service/backends",
Expand All @@ -904,7 +894,7 @@
"shortDescription": "API Management direct management endpoint should not be enabled",
"fullDescription": "The direct management REST API in Azure API Management bypasses Azure Resource Manager (ARM) Role-Based Access Control (RBAC), authorization, and throttling mechanisms, thus increasing the vulnerability of your service.",
"recommendation": "Set the properties.enabled field to false to ensure that direct access to the management REST API is disabled.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000033-api-management-direct-management-endpoint-should-not-be-enabled",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000033-api-management-direct-management-endpoint-should-not-be-enabled",
"severity": 3,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service/tenant",
Expand All @@ -925,9 +915,9 @@
"id": "TA-000034",
"name": "APIM.DisabletServiceSecretsSharingWithReadOnlyUsers",
"shortDescription": "API Management minimum API version should be set to 2019-12-01 or higher",
"fullDescription": "To prevent service secrets from being shared with read-only users, the minimum API version should be set to 2019-12-01 or higher.",
"recommendation": "Set the apiVersionContstraint.minAPIversion property to 2019-12-01 or higher to prevent service secrets from being shared with read-only users.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000034-api-management-minimum-api-version-should-be-set-to-2019-12-01-or-higher",
"fullDescription": "To prevent service secrets from being shared with read-only users, the minimum API version should be set to 2019-12-01 or higher. This opts in to a breaking change that enhances security by not returning secrets for users with read-only permissions.",
"recommendation": "Set the properties.apiVersionConstraint.minApiVersion property to '2019-12-01' or a later date to prevent service secrets from being shared with read-only users.",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000034-api-management-minimum-api-version-should-be-set-to-2019-12-01-or-higher",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service",
Expand Down Expand Up @@ -961,7 +951,7 @@
"shortDescription": "API Management Named Values secrets should be stored in Azure Key Vault",
"fullDescription": "Named Values are a collection of name and value pairs in each API Management service. Secret values can be stored either as encrypted text in API Management (custom secrets) or by referencing secrets in Azure Key Vault. To improve security of API Management and secrets, reference secret Named Values from Azure Key Vault. Azure Key Vault supports granular access management and secret rotation policies.",
"recommendation": "To utilize secrets stored in Key Vault for Azure API Management, learn more here: https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal#key-vault-secrets",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000035-api-management-named-value-secrets-should-be-stored-in-azure-key-vault",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000035-api-management-named-value-secrets-should-be-stored-in-azure-key-vault",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service/namedValues",
Expand Down Expand Up @@ -991,7 +981,7 @@
"shortDescription": "API Management services should use a virtual network",
"fullDescription": "Azure Virtual Network deployment provides enhanced security, isolation and allows you to place your API Management service in a non-internet routable network that you control access to. These networks can then be connected to your on-premises networks using various VPN technologies, which enables access to your backend services within the network and/or on-premises. The developer portal and API gateway, can be configured to be accessible either from the Internet or only within the virtual network.",
"recommendation": "To learn more about virtual networks for Azure API Management, please visit here: https://aka.ms/apim-vnet. To see an example of how to configure a VNet via Azure Policy, please visit here: https://learn.microsoft.com/samples/azure/azure-quickstart-templates/api-management-create-with-internal-vnet-application-gateway/",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000036-api-management-services-should-use-a-virtual-network",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000036-api-management-services-should-use-a-virtual-network",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service",
Expand Down Expand Up @@ -1025,7 +1015,7 @@
"shortDescription": "API Management subscriptions should not be scoped at the all API scope",
"fullDescription": "API Management subscriptions should be scoped to a product or an individual API instead of all APIs, which could result in an excessive data exposure.",
"recommendation": "To ensure the API Management service is not configured at the all API scope, please set the properties.scope property to a value other than /apis. For example, /product/{productId}, or /apis/{apiId}",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000037-api-management-subscriptions-should-not-be-scoped-at-the-all-api-scope",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000037-api-management-subscriptions-should-not-be-scoped-at-the-all-api-scope",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service/subscriptions",
Expand All @@ -1049,7 +1039,7 @@
"shortDescription": "API Management calls to API backends should be authenticated",
"fullDescription": "Calls from API Management to backends should use some form of authentication, whether via certificates or credentials. Does not apply to Service Fabric backends.",
"recommendation": "To enable API backend authentication, configure authentication credentials in the query parameters, client certificate, or authorization header. To learn more about configuring Authentication in Azure API Management, please visit here: https://learn.microsoft.com/azure/api-management/authentication-authorization-overview",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000038-api-management-calls-to-api-backends-should-be-authenticated",
"helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md/#ta-000038-api-management-calls-to-api-backends-should-be-authenticated",
"severity": 2,
"evaluation": {
"resourceType": "Microsoft.ApiManagement/service/backends",
Expand Down Expand Up @@ -1097,4 +1087,4 @@
]
}
}
]
]