Scan Azure Resource Manager templates and Bicep-compiled ARM JSON for resources that explicitly disable Azure Role-Based Access Control on services that expose a data-plane or secret-management authorization mode, and report findings with resource type, property path, configured value, and remediation guidance to enable Azure RBAC.
Scan Azure Resource Manager templates and Bicep-compiled ARM JSON for resources that explicitly disable Azure Role-Based Access Control on services that expose a data-plane or secret-management authorization mode, and report findings with resource type, property path, configured value, and remediation guidance to enable Azure RBAC.
This package is read-only for source files. It does not rewrite templates.
Installation
bash
# Run locally against a target repository
pnpm dlx codemod@latest workflow run -w . --target ../path-to-repo
Usage
The codemod scans ARM template JSON, including Bicep-compiled ARM JSON, and emits:
structured runtime warnings for each finding
Codemod metrics for findings, files, resource types, and property paths
Default high-confidence detection:
Microsoft.KeyVault/vaults with properties.enableRbacAuthorization: false
Microsoft.KeyVault/vaults with properties.enableRbacAuthorization folded to false from a simple ARM expression such as [bool('false')], [if(true, false, true)], [variables('x')], or [parameters('x')] when the value is statically resolvable from the same template
Important exclusions:
properties that are absent
values that resolve to RBAC-enabled settings
unresolved runtime expressions by default
non-ARM JSON documents and parameter files without resources
weak-signal local-auth toggles such as disableLocalAuth: false
Each finding includes:
filePath
jsonPointer
line and column
resourceType, resourceApiVersion, and resourceName when statically known
propertyPath
configuredValue and normalizedValue
confidence
service-specific remediation
Optional workflow parameter:
reportUnresolvedCandidates=true: emit the azure_arm_rbac_disabled_unresolved_candidate metric for supported properties whose values cannot be folded safely
Development
bash
# Test the read-only analysis fixtures
pnpm test
# Regenerate expected snapshots, including metrics.json
pnpm test:update
# Validate the package workflow
pnpm validate
# Type-check the JSSG implementation
pnpm check-types
Metrics
azure_arm_rbac_disabled_finding
azure_arm_rbac_disabled_file
azure_arm_rbac_disabled_resource_type
azure_arm_rbac_disabled_property_path
azure_arm_rbac_disabled_unresolved_candidate
Metric cardinality keys are aligned to the spec and use normalized values.
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.