terraform.azure.security.azure-storage-account-minimum-tlsversion.azure-storage-account-minimum-tlsversion

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensure Storage Account is using the latest version of TLS encryption

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: azure-storage-account-minimum-tlsversion
    message: Ensure Storage Account is using the latest version of TLS encryption
    patterns:
      - pattern: resource
      - pattern-inside: |
          resource "azurerm_storage_account" "..." {
          ...
          }
      - pattern-not-inside: |
          resource "azurerm_storage_account" "..." {
          ...
          min_tls_version = "TLS1_2"
          ...
          }
      - pattern-not-inside: |
          resource "azurerm_storage_account" "..." {
          ...
          min_tls_version = "TLS1_3"
          ...
          }
    metadata:
      owasp:
        - A03:2017 - Sensitive Data Exposure
        - A02:2021 - Cryptographic Failures
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      category: security
      technology:
        - terraform
        - azure
      references:
        - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
      subcategory:
        - audit
      likelihood: LOW
      impact: LOW
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Cryptographic Issues
    languages:
      - hcl
    severity: WARNING

Examples

azure-storage-account-minimum-tlsversion.tf

# fail
# ruleid: azure-storage-account-minimum-tlsversion
resource "azurerm_storage_account" "example" {
    name                     = "example"
    resource_group_name      = data.azurerm_resource_group.example.name
    location                 = data.azurerm_resource_group.example.location
    account_tier             = "Standard"
    account_replication_type = "GRS"
    network_rules {
    default_action             = "Allow"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
    }
}

# fail
# ruleid: azure-storage-account-minimum-tlsversion
resource "azurerm_storage_account" "example" {
    name                     = "example"
    resource_group_name      = data.azurerm_resource_group.example.name
    location                 = data.azurerm_resource_group.example.location
    account_tier             = "Standard"
    account_replication_type = "GRS"
    min_tls_version          = "TLS1_0"
    network_rules {
    default_action             = "Allow"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
    }
}

# fail
# ruleid: azure-storage-account-minimum-tlsversion
resource "azurerm_storage_account" "example" {
    name                     = "example"
    resource_group_name      = data.azurerm_resource_group.example.name
    location                 = data.azurerm_resource_group.example.location
    account_tier             = "Standard"
    account_replication_type = "GRS"
    min_tls_version          = "TLS1_1"
    network_rules {
    default_action             = "Allow"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
    }
}

# pass
resource "azurerm_storage_account" "example" {
    name                     = "example"
    resource_group_name      = data.azurerm_resource_group.example.name
    location                 = data.azurerm_resource_group.example.location
    account_tier             = "Standard"
    account_replication_type = "GRS"
    min_tls_version          = "TLS1_2"
    network_rules {
    default_action             = "Allow"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]
    }
}