Scan Azure Resource Manager (ARM) JSON templates to detect resources and properties that explicitly enable obsolete or weak SSL/TLS protocol versions such as SSLv2, SSLv3, TLS 1.0, or TLS 1.1, then report findings with per-resource metrics and remediation guidance toward TLS 1.2+ or service-specific secure defaults.
Scan Azure Resource Manager (ARM) JSON templates to detect resources and properties that explicitly enable obsolete or weak SSL/TLS protocol versions such as SSLv2, SSLv3, TLS 1.0, or TLS 1.1, then report findings with per-resource metrics and remediation guidance toward TLS 1.2+ or service-specific secure defaults.
Installation
bash
# Install from registry
codemod run @codemod/arm-detect-weak-tls-protocols --target /path/to/repo
# Or run locally
codemod workflow run -w workflow.yaml -t /path/to/repo
Usage
This package is read-only. It does not rewrite source files.
It analyzes *.json files that look like ARM templates and emits:
Structured findings for insecure protocol declarations in ARM resources
codemod:metrics counters for insecure findings, scanned resources/templates, secure declarations, and unresolved expression-based sinks
Remediation guidance for enforcing modern TLS protocol baselines
The codemod inspects explicit protocol configuration such as:
Scalar version fields like minTlsVersion, minimumTlsVersion, minimumTlsVersionAllowed, and tlsVersion
Array-valued fields like supportedProtocols, enabledProtocols, sslProtocols, and tlsVersions
Nested SSL/TLS policy blocks such as sslPolicy and sslProfiles
Direct ARM references like [parameters('minTlsVersion')] and [variables('protocolList')] are resolved when the referenced value is statically available in the same template. Unresolved expressions are counted via metrics but are not reported as insecure unless a weak protocol is provably present.
Excluded cases:
Non-ARM JSON files
ARM templates with no explicit protocol-related settings
Secure-only declarations such as TLS1_2, TLS1_3, 1.2, or 1.3
Disabled protocol lists like disabledProtocols and disabledSslProtocols
Parameter or variable declarations that are never used by a resource protocol sink
Each finding includes:
severity: security-warning
file path
dotted property path and JSON pointer
resource type, API version, and statically known resource name
matched raw value and normalized protocol
confidence: literal|resolved
remediation guidance such as Set minimumTlsVersion to TLS1_2 or newer
Metrics
arm_weak_tls_findings_total
arm_weak_tls_resources_total
arm_protocol_declarations_insecure_total
arm_protocol_declarations_secure_total
arm_protocol_occurrences_by_version_total
arm_protocol_resolution_unresolved_total
arm_protocol_resolution_resolved_total
arm_resources_scanned_total
arm_templates_scanned_total
Development
bash
# Run fixture tests
pnpm test
# Type-check the codemod
pnpm check-types
# Validate the workflow definition
codemod workflow validate -w workflow.yaml
# Validate the package surface
codemod ai call validate_codemod_package --input '{"package_path":".","run_default_test":true,"run_check_types":true}'
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.