Azure Automation account is not configured with managed identity misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_36
Category - Subcategory	IAM - Authentication Policies
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	932d9a66-dd82-47ce-a7a7-be5a725f8d0a

Impact

This rule is checking if an Azure automation account is configured with managed identity. Azure automation account enables managing Azure resources. If not handled with managed identities, it can pose a significant security risk as it reduces the control and security boundary around the resources. Not using managed identity can lead to human errors, non-compliance to security standards, or exposure of sensitive data or resources. Therefore, it's bad to run an Azure automation account without configuring a managed identity. An identity should be assigned to limit the exposure and increase the security of Azure resources.

How to Fix

Resource: azurerm_automation_account

• Arguments: identity.type

To fix the issue, you need to enable the managed identity feature for the Azure Automation Account in your Terraform code. Specify 'identity' block with type 'SystemAssigned' in your 'azurerm_automation_account' resource as below:

The above code is secure because it enables a Managed Identity for the Azure Automation Account. A Managed Identity provides an Azure service with an automatically managed identity which is used to authenticate, grant and manage permissions to services supporting Azure Active Directory authentication. This reduces the need for storing credentials in code and hence decreases the risk of credentials being compromised. [source,go]

resource "azurerm_automation_account" "example" { name = "example-automation-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

sku_name = "Basic"

identity { type = "SystemAssigned" }

}