@codemod/arm-public-network-access-disabled

Analyze Azure Resource Manager (ARM) JSON templates to find deployable cloud resources that expose a publicNetworkAccess setting that is explicitly enabled, or omit the setting where the resource type/API version supports disabling it, and report security metrics plus remediation guidance.

This codemod is read-only. It does not rewrite source files.

Installation

bash
Copy
# Install from registry
codemod run @codemod/arm-public-network-access-disabled

# Or run locally
codemod run -w workflow.yaml

Usage

Run the package against a repository that contains ARM template JSON files:

bash
Copy
# Local package
codemod run -w workflow.yaml

# Optional: count unresolved expressions as manual-review metrics
codemod run -w workflow.yaml --param report_manual_review=true

The workflow scans **/*.json, keeps source files unchanged, and emits:

• One finding record per violating ARM resource
• Metrics for total findings, explicit enabled cases, implicit missing cases, affected files, resource types, API versions, conditional resources, and embedded template findings

Detection

The codemod:

• Parses ARM template JSON ASTs and inspects resources[*] recursively, including nested child resources and embedded templates under Microsoft.Resources/deployments
• Detects explicit insecure values on properties.publicNetworkAccess when the value is a literal Enabled or a statically reducible ARM expression that evaluates to Enabled
• Detects implicit missing-property cases only for resource types and API versions in the curated support matrix in scripts/supportMatrix.ts
• Resolves deterministic ARM expression forms used in the spec: direct literals, variables(), parameter default chains, if(), equals(), concat(), toLower(), toUpper(), and simple boolean helpers used in condition

The current support matrix is intentionally conservative and externalized so API-version thresholds can be updated without changing the parser or reporting logic.

Reporting

Each finding includes:

• filePath
• resourceType
• resourceName and resolved literal when statically knowable
• apiVersion
• propertyPath
• issueKind: explicit-enabled, explicit-expression-enabled, or implicit-missing
• isConditional
• inEmbeddedTemplate
• jsonPointer
• sourceSpan
• evidence
• remediation

Remediation instructs users to set the controlling property to Disabled explicitly and prefer private endpoints, firewall/IP rules, VNet integration, or other service-restricted access where supported.

Exclusions

• Non-ARM JSON files without deployment-template markers
• Bicep files
• Parameter files without deployable resources
• Unresolved dynamic expressions unless report_manual_review=true
• Missing-property checks for resource types or API versions outside the support matrix
• The Microsoft.Resources/deployments resource itself; only its embedded inner template resources are reported

Development

bash
Copy
# Run read-only fixture tests and metric snapshots
pnpm test

# Typecheck the JSSG package
pnpm check-types

# Validate the workflow package
npx codemod workflow validate -w workflow.yaml

# Publish to registry
codemod login
codemod publish

License

MIT