@codemod/arm-detect-missing-managed-identity
Mine Azure Resource Manager (ARM) templates and Bicep-transpiled ARM JSON for Azure resources that are configured to access other Azure services but do not enable a Managed Identity, reporting resource types, suspected authentication patterns, and remediation guidance.
Installation
Usage
This package is a read-only mining codemod.
- It scans
*.jsonfiles that parse as ARM deployment templates, including nested inline deployment templates and Bicep-transpiled ARM JSON. - It detects candidate Azure resources whose configuration suggests outbound authentication to Azure dependencies such as Storage, Key Vault, Service Bus, Event Hubs, registries, linked services, and generic secret-based runtime credentials.
- It never rewrites source files. Instead, it emits structured findings and
codemod:metricscounters such as:arm_missing_managed_identity_resourcesarm_missing_managed_identity_findingsarm_identity_coverage_resourcesarm_secret_auth_indicator_occurrencesarm_files_scanned
Default behavior
- Reports high-confidence findings only.
- Suppresses resources whose managed identity is already enabled.
- Suppresses expression-based
identity.typevalues unless explicitly enabled. - Treats malformed JSON and non-ARM JSON as safely skipped inputs.
Workflow parameters
includeMediumConfidence=false: also emit medium-confidence findings for generic Azure auth indicators outside the curated candidate catalog.includeIdentityUnknown=false: emit findings whenidentity.typeis expression-based and unresolved.includeUnsupportedInformational=false: count informational findings for candidate resource types that do not support managed identity.maxFileBytes=1000000: skip oversized JSON inputs.
Examples
Microsoft.Web/siteswithsiteConfig.appSettingscontainingAzureWebJobsStorageorServiceBusConnectionStringand no managed identity -> finding.Microsoft.App/containerAppswith registry credentials or secrets and no managed identity -> finding.Microsoft.ContainerInstance/containerGroupswith Azure FilesstorageAccountKeyand no managed identity -> finding.Microsoft.Resources/deploymentscontaining an inline nested template with an offending resource -> finding attributed to the nested resource path.- Candidate resources that already use
SystemAssignedorUserAssignedidentity -> no violation finding; coverage metrics only.
Development
License
MIT