Azure Recovery Services vault is not configured with managed identity misconfiguration detected in c

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_35
Category - Subcategory	IAM - Authentication Policies
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c48b08f5-9e1d-4af4-abad-6255aa7d0b56

Impact

This rule checks to verify if the Azure Recovery Services Vault is configured with a managed identity. A managed identity in Azure is a secure and scalable solution for app authentication, and can be auto-managed by Azure, helping developers avoid the process of managing authentication by themselves. Therefore, if the Azure Recovery Services Vault is not configured with a managed identity, it could lead to improper access control and poorly managed authentication credentials, which may expose your app to security risks.

How to Fix

Resource: azurerm_recovery_services_vault

• Arguments: identity.type

To fix this issue, you need to configure the Azure Recovery Services vault with a managed identity. This is done by setting the property "identity" and "type" in the terraform configuration.

The code is secure because it assigns the Azure Recovery Services vault a managed identity. Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. They eliminate the need for developers to manage credentials, making the connection more secure. [source,go]

resource "azurerm_recovery_services_vault" "example" { name = "example-recovery-vault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name soft_delete_enabled = false identity { type = "SystemAssigned" } }