Web PubSub Without Managed Identities misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_176
Category - Subcategory	IAM - Authentication Policies
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Azure Managed Identities provides an identity for applications, allowing them to access other Azure resources. It is a secure alternative to using secrets or keys. With Managed Identities, credentials are outside of your code, reducing the risk of them being compromised.

Azure Web PubSub is a real-time web messaging service. For enhanced security, it's recommended to use Azure Managed Identities when Web PubSub accesses other Azure services.

This rule checks to ensure that Azure Web PubSub is configured to use Managed Identities.

How to Fix

Resource: azurerm_web_pubsub

• Arguments: identity

Note: The provided example sets the identity to "SystemAssigned". Depending on organizational requirements, "UserAssigned" can be chosen. Ensure that the chosen identity type aligns with security and operational needs. [source,go]

resource "azurerm_web_pubsub" "example" { name = "example-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

• identity {
• type = "SystemAssigned" # or "UserAssigned" based on the requirement
• }

tags = { Environment = "production" } }