@codemod/arm-storage-encryption-disabled

Scan Azure Resource Manager (ARM) JSON templates for Microsoft.Storage/storageAccounts resources where encryption is explicitly disabled or configured in a way that leaves blob or file service encryption off, then report findings, counts, and remediation guidance.

What It Does

Read-only mining codemod for ARM JSON templates.
Detects properties.encryption.enabled: false.
Detects properties.encryption.services.blob.enabled: false.
Detects properties.encryption.services.file.enabled: false.
Constant-folds simple ARM boolean expressions such as [false()].
Scans inline nested deployment templates under Microsoft.Resources/deployments.
Emits one structured warning per insecure storage account resource plus aggregate codemod:metrics counters.

Usage

Run the local workflow against a target repository:

bash
pnpm dlx codemod@latest workflow run -w . -t /path/to/repo

This package scans **/*.json, skips non-ARM JSON documents, and does not rewrite source files.

Findings

Each finding includes:

file path
resource JSON path
statically known resource name when available
issue types: top_level_disabled, blob_disabled, file_disabled
offending JSON path list
raw offending values
remediation guidance

Remediation guidance: enable encryption for all supported storage services, ensure properties.encryption is present, set properties.encryption.services.blob.enabled and properties.encryption.services.file.enabled to true, and validate against current Azure storage account API requirements.

Metrics

The codemod emits these metrics:

arm_files_scanned
arm_storage_accounts_scanned
arm_storage_encryption_disabled_findings
arm_storage_encryption_blob_disabled
arm_storage_encryption_file_disabled
arm_storage_encryption_top_level_disabled
arm_storage_encryption_unresolved_expressions

Exclusions

Non-ARM JSON files
Storage account resources whose type is dynamic or otherwise not statically resolvable
Storage accounts where properties.encryption is absent
Blob/file enabled expressions that cannot be statically resolved
queue and table service encryption states

Development

bash
# Run fixture tests
pnpm test

# Validate the workflow
pnpm dlx codemod@latest workflow validate -w workflow.yaml

# Type-check the codemod
pnpm check-types

License

MIT