@codemod/arm-rbac-disabled-detection
Scan Azure Resource Manager templates and Bicep-compiled ARM JSON for resources that explicitly disable Azure Role-Based Access Control on services that expose a data-plane or secret-management authorization mode, and report findings with resource type, property path, configured value, and remediation guidance to enable Azure RBAC.
This package is read-only for source files. It does not rewrite templates.
Installation
Usage
The codemod scans ARM template JSON, including Bicep-compiled ARM JSON, and emits:
- structured runtime warnings for each finding
- Codemod metrics for findings, files, resource types, and property paths
Default high-confidence detection:
Microsoft.KeyVault/vaultswithproperties.enableRbacAuthorization: falseMicrosoft.KeyVault/vaultswithproperties.enableRbacAuthorizationfolded tofalsefrom a simple ARM expression such as[bool('false')],[if(true, false, true)],[variables('x')], or[parameters('x')]when the value is statically resolvable from the same template
Important exclusions:
- properties that are absent
- values that resolve to RBAC-enabled settings
- unresolved runtime expressions by default
- non-ARM JSON documents and parameter files without
resources - weak-signal local-auth toggles such as
disableLocalAuth: false
Each finding includes:
filePathjsonPointerlineandcolumnresourceType,resourceApiVersion, andresourceNamewhen statically knownpropertyPathconfiguredValueandnormalizedValueconfidence- service-specific
remediation
Optional workflow parameter:
reportUnresolvedCandidates=true: emit theazure_arm_rbac_disabled_unresolved_candidatemetric for supported properties whose values cannot be folded safely
Development
Metrics
azure_arm_rbac_disabled_findingazure_arm_rbac_disabled_fileazure_arm_rbac_disabled_resource_typeazure_arm_rbac_disabled_property_pathazure_arm_rbac_disabled_unresolved_candidate
Metric cardinality keys are aligned to the spec and use normalized values.
License
MIT