Azure Synapse workspace administrator login password exposed misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_239
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule detects whether the administrator login password for an Azure Synapse workspace is exposed, checking for any instances where the password might be publicly accessible or improperly stored. Keeping administrator credentials secure is essential for maintaining the overall security and integrity of the Azure environment. Exposing such sensitive information can lead to unauthorized access, data breaches, and potential misuse of resources.

How to Fix

Resource: Microsoft.Synapse/workspaces

• Arguments: sqlAdministratorLoginPassword

This example shows the ARM template configuration for an Azure Synapse workspace with the sqlAdministratorLogin and sqlAdministratorLoginPassword properties removed to prevent hardcoding sensitive information. [source,go]

{ ... "resources": [ { "type": "Microsoft.Synapse/workspaces", ... "properties": {

•    "sqlAdministratorLogin": "sqladminuser",

•    "sqlAdministratorLoginPassword": "H@Sh1CoR3!",

---