Mine Azure Resource Manager (ARM) JSON templates and linked deployment parameters for insecure clear-text protocol usage such as http://, ftp://, telnet://, ws://, and other non-TLS endpoint schemes in resource properties, variables, outputs, and parameter defaults; report locations, affected resource types, and remediation guidance to migrate to encrypted protocols like HTTPS/WSS.
Mine Azure Resource Manager (ARM) JSON templates and linked deployment parameters for insecure clear-text protocol usage such as http://, ftp://, telnet://, ws://, and other non-TLS endpoint schemes in resource properties, variables, outputs, and parameter defaults; report locations, affected resource types, and remediation guidance to migrate to encrypted protocols like HTTPS/WSS.
Installation
bash
# Install from registry
codemod run @codemod/arm-no-cleartext-protocols
# Or run locally
codemod run -w workflow.yaml
Usage
This package is read-only for source files. It does not rewrite ARM templates or parameters files.
It analyzes **/*.json files that look like ARM deployment templates or ARM deployment parameters files and reports:
direct clear-text endpoint literals such as http://, ftp://, telnet://, ws://, smtp://, and ldap://
insecure protocol selector tokens such as "protocol": "http"
simple ARM expressions resolved from concat, format, toLower, toUpper, trim, parameters, and variables
inline nested deployment templates under Microsoft.Resources/deployments
linked template URIs under properties.templateLink.uri and properties.parametersLink.uri
Each finding includes file path, line/column, JSON pointer, matched protocol, scope, resource type/name when available, source provenance, and remediation guidance. The codemod also emits codemod:metrics counters for CI and trend reporting.
Example local run:
bash
pnpm dlx codemod@latest workflow run -w . -t /path/to/repo
Optional workflow parameters:
exclude_path_regex: skip repo-relative paths that match a regex
exclude_metadata_descriptions: defaults to true; ignores known documentation-only paths such as metadata.description
Machine-readable findings are printed as JSON objects with type: "arm_cleartext_protocol_report".
Development
bash
# Run read-only fixture tests
pnpm test
# Validate the workflow
pnpm validate
# Type-check the package
pnpm check-types
# Publish to registry
codemod login
codemod publish
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.