@codemod/arm-no-cleartext-protocols
Mine Azure Resource Manager (ARM) JSON templates and linked deployment parameters for insecure clear-text protocol usage such as http://, ftp://, telnet://, ws://, and other non-TLS endpoint schemes in resource properties, variables, outputs, and parameter defaults; report locations, affected resource types, and remediation guidance to migrate to encrypted protocols like HTTPS/WSS.
Installation
Usage
This package is read-only for source files. It does not rewrite ARM templates or parameters files.
It analyzes **/*.json files that look like ARM deployment templates or ARM deployment parameters files and reports:
- direct clear-text endpoint literals such as
http://,ftp://,telnet://,ws://,smtp://, andldap:// - insecure protocol selector tokens such as
"protocol": "http" - simple ARM expressions resolved from
concat,format,toLower,toUpper,trim,parameters, andvariables - inline nested deployment templates under
Microsoft.Resources/deployments - linked template URIs under
properties.templateLink.uriandproperties.parametersLink.uri
Each finding includes file path, line/column, JSON pointer, matched protocol, scope, resource type/name when available, source provenance, and remediation guidance. The codemod also emits codemod:metrics counters for CI and trend reporting.
Example local run:
Optional workflow parameters:
exclude_path_regex: skip repo-relative paths that match a regexexclude_metadata_descriptions: defaults totrue; ignores known documentation-only paths such asmetadata.description
Machine-readable findings are printed as JSON objects with type: "arm_cleartext_protocol_report".
Development
License
MIT