Secrets are exposed in Azure VM customData misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_45
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Ensure that no sensitive credentials are exposed in VM custom_data

How to Fix

Remove the following attribute from the Terraform resource. [source,go]

resource "azurerm_virtual_machine" "main" { name = "${var.prefix}-vm" ... os_profile { ...

• custom_data = "MY_SECRET_VALUE" } ... }

---