@codemod/arm-detect-missing-managed-identity

Mine Azure Resource Manager (ARM) templates and Bicep-transpiled ARM JSON for Azure resources that are configured to access other Azure services but do not enable a Managed Identity, reporting resource types, suspected authentication patterns, and remediation guidance.

Installation

bash
Copy
# Install from registry
codemod run @codemod/arm-detect-missing-managed-identity

# Or run locally
codemod run -w workflow.yaml

Usage

This package is a read-only mining codemod.

• It scans *.json files that parse as ARM deployment templates, including nested inline deployment templates and Bicep-transpiled ARM JSON.
• It detects candidate Azure resources whose configuration suggests outbound authentication to Azure dependencies such as Storage, Key Vault, Service Bus, Event Hubs, registries, linked services, and generic secret-based runtime credentials.
• It never rewrites source files. Instead, it emits structured findings and codemod:metrics counters such as:
  • arm_missing_managed_identity_resources
  • arm_missing_managed_identity_findings
  • arm_identity_coverage_resources
  • arm_secret_auth_indicator_occurrences
  • arm_files_scanned

Default behavior

• Reports high-confidence findings only.
• Suppresses resources whose managed identity is already enabled.
• Suppresses expression-based identity.type values unless explicitly enabled.
• Treats malformed JSON and non-ARM JSON as safely skipped inputs.

Workflow parameters

• includeMediumConfidence=false: also emit medium-confidence findings for generic Azure auth indicators outside the curated candidate catalog.
• includeIdentityUnknown=false: emit findings when identity.type is expression-based and unresolved.
• includeUnsupportedInformational=false: count informational findings for candidate resource types that do not support managed identity.
• maxFileBytes=1000000: skip oversized JSON inputs.

Examples

• Microsoft.Web/sites with siteConfig.appSettings containing AzureWebJobsStorage or ServiceBusConnectionString and no managed identity -> finding.
• Microsoft.App/containerApps with registry credentials or secrets and no managed identity -> finding.
• Microsoft.ContainerInstance/containerGroups with Azure Files storageAccountKey and no managed identity -> finding.
• Microsoft.Resources/deployments containing an inline nested template with an offending resource -> finding attributed to the nested resource path.
• Candidate resources that already use SystemAssigned or UserAssigned identity -> no violation finding; coverage metrics only.

Development

bash
Copy
# Test the mining codemod
pnpm test

# Validate the workflow
codemod workflow validate -w workflow.yaml

# Publish to registry
codemod login
codemod publish

License

MIT