Ccodemod

codemod/arm-public-network-access-disabled

Analyze Azure Resource Manager (ARM) JSON templates to find deployable cloud resources that expose a `publicNetworkAccess` setting that is explicitly enabled, or omit the setting where the resource type/API version supports disabling it, and report security metrics plus remediation guidance.

azurearmsecuritymininganalysis
Public
0 executions
Use dashboard
Apply to Repository

Run locally

npx codemod @codemod/arm-public-network-access-disabled

@codemod/arm-public-network-access-disabled

Analyze Azure Resource Manager (ARM) JSON templates to find deployable cloud resources that expose a publicNetworkAccess setting that is explicitly enabled, or omit the setting where the resource type/API version supports disabling it, and report security metrics plus remediation guidance.

This codemod is read-only. It does not rewrite source files.

Installation

bash

Usage

Run the package against a repository that contains ARM template JSON files:

bash

The workflow scans **/*.json, keeps source files unchanged, and emits:

  • One finding record per violating ARM resource
  • Metrics for total findings, explicit enabled cases, implicit missing cases, affected files, resource types, API versions, conditional resources, and embedded template findings

Detection

The codemod:

  • Parses ARM template JSON ASTs and inspects resources[*] recursively, including nested child resources and embedded templates under Microsoft.Resources/deployments
  • Detects explicit insecure values on properties.publicNetworkAccess when the value is a literal Enabled or a statically reducible ARM expression that evaluates to Enabled
  • Detects implicit missing-property cases only for resource types and API versions in the curated support matrix in scripts/supportMatrix.ts
  • Resolves deterministic ARM expression forms used in the spec: direct literals, variables(), parameter default chains, if(), equals(), concat(), toLower(), toUpper(), and simple boolean helpers used in condition

The current support matrix is intentionally conservative and externalized so API-version thresholds can be updated without changing the parser or reporting logic.

Reporting

Each finding includes:

  • filePath
  • resourceType
  • resourceName and resolved literal when statically knowable
  • apiVersion
  • propertyPath
  • issueKind: explicit-enabled, explicit-expression-enabled, or implicit-missing
  • isConditional
  • inEmbeddedTemplate
  • jsonPointer
  • sourceSpan
  • evidence
  • remediation

Remediation instructs users to set the controlling property to Disabled explicitly and prefer private endpoints, firewall/IP rules, VNet integration, or other service-restricted access where supported.

Exclusions

  • Non-ARM JSON files without deployment-template markers
  • Bicep files
  • Parameter files without deployable resources
  • Unresolved dynamic expressions unless report_manual_review=true
  • Missing-property checks for resource types or API versions outside the support matrix
  • The Microsoft.Resources/deployments resource itself; only its embedded inner template resources are reported

Development

bash

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community