@codemod/arm-detect-weak-tls-protocols
Scan Azure Resource Manager (ARM) JSON templates to detect resources and properties that explicitly enable obsolete or weak SSL/TLS protocol versions such as SSLv2, SSLv3, TLS 1.0, or TLS 1.1, then report findings with per-resource metrics and remediation guidance toward TLS 1.2+ or service-specific secure defaults.
Installation
Usage
This package is read-only. It does not rewrite source files.
It analyzes *.json files that look like ARM templates and emits:
- Structured findings for insecure protocol declarations in ARM resources
codemod:metricscounters for insecure findings, scanned resources/templates, secure declarations, and unresolved expression-based sinks- Remediation guidance for enforcing modern TLS protocol baselines
The codemod inspects explicit protocol configuration such as:
- Scalar version fields like
minTlsVersion,minimumTlsVersion,minimumTlsVersionAllowed, andtlsVersion - Array-valued fields like
supportedProtocols,enabledProtocols,sslProtocols, andtlsVersions - Nested SSL/TLS policy blocks such as
sslPolicyandsslProfiles
Direct ARM references like [parameters('minTlsVersion')] and [variables('protocolList')] are resolved when the referenced value is statically available in the same template. Unresolved expressions are counted via metrics but are not reported as insecure unless a weak protocol is provably present.
Excluded cases:
- Non-ARM JSON files
- ARM templates with no explicit protocol-related settings
- Secure-only declarations such as
TLS1_2,TLS1_3,1.2, or1.3 - Disabled protocol lists like
disabledProtocolsanddisabledSslProtocols - Parameter or variable declarations that are never used by a resource protocol sink
Each finding includes:
severity: security-warning- file path
- dotted property path and JSON pointer
- resource type, API version, and statically known resource name
- matched raw value and normalized protocol
confidence: literal|resolved- remediation guidance such as
Set minimumTlsVersion to TLS1_2 or newer
Metrics
arm_weak_tls_findings_totalarm_weak_tls_resources_totalarm_protocol_declarations_insecure_totalarm_protocol_declarations_secure_totalarm_protocol_occurrences_by_version_totalarm_protocol_resolution_unresolved_totalarm_protocol_resolution_resolved_totalarm_resources_scanned_totalarm_templates_scanned_total
Development
License
MIT