terraform.azure.best-practice.azure-ad-used-auth-service-fabric.azure-ad-used-auth-service-fabric

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensures that Active Directory is used for authentication for Service Fabric

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: azure-ad-used-auth-service-fabric
    message: "Ensures that Active Directory is used for authentication for Service
      Fabric\t"
    patterns:
      - pattern: resource
      - pattern-not-inside: |
          resource "azurerm_service_fabric_cluster" "..." {
          ...
          azure_active_directory {
            tenant_id = "..."
          }
          ...
          }
      - pattern-inside: |
          resource "azurerm_service_fabric_cluster" "..." {
          ...
          }
    metadata:
      category: best-practice
      technology:
        - terraform
        - azure
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - hcl
    severity: WARNING

Examples

azure-ad-used-auth-service-fabric.tf

# fail
# ruleid: azure-ad-used-auth-service-fabric
resource "azurerm_service_fabric_cluster" "example" {
    name                 = "example-servicefabric"
    resource_group_name  = azurerm_resource_group.example.name
    location             = azurerm_resource_group.example.location
    reliability_level    = "Bronze"
    upgrade_mode         = "Manual"
    cluster_code_version = "7.1.456.959"
    vm_image             = "Windows"
    management_endpoint  = "https://example:80"            
    node_type {
        name                 = "first"
        instance_count       = 3
        is_primary           = true
        client_endpoint_port = 2020
        http_endpoint_port   = 80
    }
}

# pass
resource "azurerm_service_fabric_cluster" "example" {
    name                 = "example-servicefabric"
    resource_group_name  = azurerm_resource_group.example.name
    location             = azurerm_resource_group.example.location
    reliability_level    = "Bronze"
    upgrade_mode         = "Manual"
    cluster_code_version = "7.1.456.959"
    vm_image             = "Windows"
    management_endpoint  = "https://example:80"
    azure_active_directory {
      tenant_id = "tenant"
    }
    node_type {
      name                 = "first"
      instance_count       = 3
      is_primary           = true
      client_endpoint_port = 2020
      http_endpoint_port   = 80
    }
}