Azure Spring Cloud service is not configured with virtual network misconfiguration detected in code

Azure Spring Cloud service is not configured with virtual network misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_23
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	05128e74-61e1-4e3c-a4e9-83d840efddb1

Impact

This rule detects whether Azure Spring Cloud is configured with a Virtual Network. By leveraging a Virtual Network, you can isolate and secure Azure Spring Cloud within your own virtual network environment. This helps protect your resources and enables you to have more control over network traffic.

How to Fix

Resource: azurerm_spring_cloud_service

• Arguments: sku_name, network.service_runtime_subnet_id

This configuration includes a virtual network and a subnet. Then it creates an Azure Spring Cloud service that references the subnet ID under the network block with service_runtime_subnet_id, ensuring the Spring Cloud service is configured with a Virtual Network. The sku_name is set to S0, which is different from B0. As a result, this satisfies both conditions of the Cortex Cloud AppSec rule: it ensures the SKU is not B0 and the Spring Cloud service is associated with a subnet in a Virtual Network. [source,go]

provider "azurerm" { features {} }

resource "azurerm_virtual_network" "example" { name = "example-vnet" address_space = ["10.0.0.0/16"] location = "East US" resource_group_name = "example-resources" }

resource "azurerm_subnet" "example" { name = "example-subnet" resource_group_name = "example-resources" virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.0.1.0/24"] }

resource "azurerm_spring_cloud_service" "example" { name = "example-spring-cloud-service" resource_group_name = "example-resources" location = "East US" sku_name = "S0" # SKU is not B0

network { service_runtime_subnet_id = azurerm_subnet.example.id

app_subnet_id can also be included if needed

}

Include other necessary configurations

}