@codemod/arm-public-network-access-disabled
Analyze Azure Resource Manager (ARM) JSON templates to find deployable cloud resources that expose a publicNetworkAccess setting that is explicitly enabled, or omit the setting where the resource type/API version supports disabling it, and report security metrics plus remediation guidance.
This codemod is read-only. It does not rewrite source files.
Installation
Usage
Run the package against a repository that contains ARM template JSON files:
The workflow scans **/*.json, keeps source files unchanged, and emits:
- One finding record per violating ARM resource
- Metrics for total findings, explicit enabled cases, implicit missing cases, affected files, resource types, API versions, conditional resources, and embedded template findings
Detection
The codemod:
- Parses ARM template JSON ASTs and inspects
resources[*]recursively, including nested child resources and embedded templates underMicrosoft.Resources/deployments - Detects explicit insecure values on
properties.publicNetworkAccesswhen the value is a literalEnabledor a statically reducible ARM expression that evaluates toEnabled - Detects implicit missing-property cases only for resource types and API versions in the curated support matrix in
scripts/supportMatrix.ts - Resolves deterministic ARM expression forms used in the spec: direct literals,
variables(), parameter default chains,if(),equals(),concat(),toLower(),toUpper(), and simple boolean helpers used incondition
The current support matrix is intentionally conservative and externalized so API-version thresholds can be updated without changing the parser or reporting logic.
Reporting
Each finding includes:
filePathresourceTyperesourceNameand resolved literal when statically knowableapiVersionpropertyPathissueKind:explicit-enabled,explicit-expression-enabled, orimplicit-missingisConditionalinEmbeddedTemplatejsonPointersourceSpanevidenceremediation
Remediation instructs users to set the controlling property to Disabled explicitly and prefer private endpoints, firewall/IP rules, VNet integration, or other service-restricted access where supported.
Exclusions
- Non-ARM JSON files without deployment-template markers
- Bicep files
- Parameter files without deployable
resources - Unresolved dynamic expressions unless
report_manual_review=true - Missing-property checks for resource types or API versions outside the support matrix
- The
Microsoft.Resources/deploymentsresource itself; only its embedded inner template resources are reported
Development
License
MIT