Best practices for Azure

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.terraform.azure.AzureBestPractices

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-terraform:3.14.6

Definition

This recipe runs the following recipes in order.

• Encrypt Azure VM data disk with ADE/CMKorg.openrewrite.terraform.azure.EncryptAzureVMDataDiskWithADECMK
• Enable Azure Storage secure transfer requiredorg.openrewrite.terraform.azure.EnableAzureStorageSecureTransferRequired
• Disable Kubernetes dashboardorg.openrewrite.terraform.azure.DisableKubernetesDashboard
• Ensure the storage container storing activity logs is not publicly accessibleorg.openrewrite.terraform.azure.EnsureTheStorageContainerStoringActivityLogsIsNotPubliclyAccessible
• Ensure Azure Network Watcher NSG flow logs retention is greater than 90 daysorg.openrewrite.terraform.azure.EnsureAzureNetworkWatcherNSGFlowLogsRetentionIsGreaterThan90Days
• Ensure Azure App Service Web app redirects HTTP to HTTPSorg.openrewrite.terraform.azure.EnsureAzureAppServiceWebAppRedirectsHTTPToHTTPS
• Ensure Web App uses the latest version of TLS encryptionorg.openrewrite.terraform.azure.EnsureWebAppUsesTheLatestVersionOfTLSEncryption
• Ensure Web App uses the latest version of HTTPorg.openrewrite.terraform.azure.EnsureWebAppUsesTheLatestVersionOfHTTP
• Ensure standard pricing tier is selectedorg.openrewrite.terraform.azure.EnsureStandardPricingTierIsSelected
• Ensure a security contact phone number is presentorg.openrewrite.terraform.azure.EnsureASecurityContactPhoneNumberIsPresent
• Ensure Send email notification for high severity alerts is enabledorg.openrewrite.terraform.azure.EnsureSendEmailNotificationForHighSeverityAlertsIsEnabled
• Ensure Send email notification for high severity alerts to admins is enabledorg.openrewrite.terraform.azure.EnsureSendEmailNotificationForHighSeverityAlertsToAdminsIsEnabled
• Ensure Azure SQL server audit log retention is greater than 90 daysorg.openrewrite.terraform.azure.EnsureAzureSQLServerAuditLogRetentionIsGreaterThan90Days
• Ensure Azure SQL Server threat detection alerts are enabled for all threat typesorg.openrewrite.terraform.azure.EnsureAzureSQLServerThreatDetectionAlertsAreEnabledForAllThreatTypes
• Ensure Azure SQL server send alerts to field value is setorg.openrewrite.terraform.azure.EnsureAzureSQLServerSendAlertsToFieldValueIsSet
• Ensure MSSQL servers have email service and co-administrators enabledorg.openrewrite.terraform.azure.EnsureMSSQLServersHaveEmailServiceAndCoAdministratorsEnabled
• Ensure MySQL server databases have Enforce SSL connection enabledorg.openrewrite.terraform.azure.EnsureMySQLServerDatabasesHaveEnforceSSLConnectionEnabled
• Ensure Azure PostgreSQL database server with SSL connection is enabledorg.openrewrite.terraform.azure.EnsureAzurePostgreSQLDatabaseServerWithSSLConnectionIsEnabled
• Set Azure Storage Account default network access to denyorg.openrewrite.terraform.azure.SetAzureStorageAccountDefaultNetworkAccessToDeny
• Enable Azure Storage Account Trusted Microsoft Services accessorg.openrewrite.terraform.azure.EnableAzureStorageAccountTrustedMicrosoftServicesAccess
• Ensure activity log retention is set to 365 days or greaterorg.openrewrite.terraform.azure.EnsureActivityLogRetentionIsSetTo365DaysOrGreater
• Ensure log profile is configured to capture all activitiesorg.openrewrite.terraform.azure.EnsureLogProfileIsConfiguredToCaptureAllActivities
• Ensure all keys have an expiration dateorg.openrewrite.terraform.azure.EnsureAllKeysHaveAnExpirationDate
• Ensure AKV secrets have an expiration date setorg.openrewrite.terraform.azure.EnsureAKVSecretsHaveAnExpirationDateSet
• Ensure Azure key vault is recoverableorg.openrewrite.terraform.azure.EnsureAzureKeyVaultIsRecoverable
• Ensure storage account uses latest TLS versionorg.openrewrite.terraform.azure.EnsureStorageAccountUsesLatestTLSVersion
• Ensure public network access enabled is set to False for mySQL serversorg.openrewrite.terraform.azure.EnsurePublicNetworkAccessEnabledIsSetToFalseForMySQLServers
• Ensure MySQL is using the latest version of TLS encryptionorg.openrewrite.terraform.azure.EnsureMySQLIsUsingTheLatestVersionOfTLSEncryption
• Ensure app service enables HTTP loggingorg.openrewrite.terraform.azure.EnsureAppServiceEnablesHTTPLogging
• Ensure app service enables detailed error messagesorg.openrewrite.terraform.azure.EnsureAppServiceEnablesDetailedErrorMessages
• Ensure app service enables failed request tracingorg.openrewrite.terraform.azure.EnsureAppServiceEnablesFailedRequestTracing
• Ensure PostgreSQL server disables public network accessorg.openrewrite.terraform.azure.EnsurePostgreSQLServerDisablesPublicNetworkAccess
• Ensure managed identity provider is enabled for app servicesorg.openrewrite.terraform.azure.EnsureManagedIdentityProviderIsEnabledForAppServices
• Ensure FTP Deployments are disabledorg.openrewrite.terraform.azure.EnsureFTPDeploymentsAreDisabled
• Ensure MySQL server disables public network accessorg.openrewrite.terraform.azure.EnsureMySQLServerDisablesPublicNetworkAccess
• Ensure MySQL server enables geo-redundant backupsorg.openrewrite.terraform.azure.EnsureMySQLServerEnablesGeoRedundantBackups
• Enable geo-redundant backups on PostgreSQL serverorg.openrewrite.terraform.azure.EnableGeoRedundantBackupsOnPostgreSQLServer
• Ensure key vault allows firewall rules settingsorg.openrewrite.terraform.azure.EnsureKeyVaultAllowsFirewallRulesSettings
• Ensure key vault enables purge protectionorg.openrewrite.terraform.azure.EnsureKeyVaultEnablesPurgeProtection
• Ensure key vault secrets have content_type setorg.openrewrite.terraform.azure.EnsureKeyVaultSecretsHaveContentTypeSet
• Ensure AKS policies add-onorg.openrewrite.terraform.azure.EnsureAKSPoliciesAddOn
• Ensure Azure application gateway has WAF enabledorg.openrewrite.terraform.azure.EnsureAzureApplicationGatewayHasWAFEnabled
• Ensure MySQL server enables Threat Detection policyorg.openrewrite.terraform.azure.EnsureMySQLServerEnablesThreatDetectionPolicy
• Ensure PostgreSQL server enables Threat Detection policyorg.openrewrite.terraform.azure.EnsurePostgreSQLServerEnablesThreatDetectionPolicy
• Ensure PostgreSQL server enables infrastructure encryptionorg.openrewrite.terraform.azure.EnsurePostgreSQLServerEnablesInfrastructureEncryption

Data tables

Structured output this recipe can produce.

• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats