terraform.azure.best-practice.azure-securitcenter-email-alert.azure-securitcenter-email-alert

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensure that Send email notification for high severity alerts is set to On

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: azure-securitcenter-email-alert
    message: Ensure that Send email notification for high severity alerts is set to On
    patterns:
      - pattern: resource
      - pattern-inside: |
          resource "azurerm_security_center_contact" "..." {
          ...
          }
      - pattern-not-inside: |
          resource "azurerm_security_center_contact" "..." {
          ...
          alert_notifications = true
          ...
          }
    metadata:
      category: best-practice
      technology:
        - terraform
        - azure
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - hcl
    severity: WARNING

Examples

azure-securitcenter-email-alert.tf

# fail
# ruleid: azure-securitcenter-email-alert
resource "azurerm_security_center_contact" "example" {
    email = "contact@example.com"
}

# pass
resource "azurerm_security_center_contact" "example" {
    email = "contact@example.com"
    phone = "+1-555-555-5555"
    alert_notifications = true
    alerts_to_admins    = true
}