@codemod/arm-storage-encryption-disabled
Scan Azure Resource Manager (ARM) JSON templates for Microsoft.Storage/storageAccounts resources where encryption is explicitly disabled or configured in a way that leaves blob or file service encryption off, then report findings, counts, and remediation guidance.
What It Does
- Read-only mining codemod for ARM JSON templates.
- Detects
properties.encryption.enabled: false. - Detects
properties.encryption.services.blob.enabled: false. - Detects
properties.encryption.services.file.enabled: false. - Constant-folds simple ARM boolean expressions such as
[false()]. - Scans inline nested deployment templates under
Microsoft.Resources/deployments. - Emits one structured warning per insecure storage account resource plus aggregate
codemod:metricscounters.
Usage
Run the local workflow against a target repository:
This package scans **/*.json, skips non-ARM JSON documents, and does not rewrite source files.
Findings
Each finding includes:
- file path
- resource JSON path
- statically known resource name when available
- issue types:
top_level_disabled,blob_disabled,file_disabled - offending JSON path list
- raw offending values
- remediation guidance
Remediation guidance: enable encryption for all supported storage services, ensure properties.encryption is present, set properties.encryption.services.blob.enabled and properties.encryption.services.file.enabled to true, and validate against current Azure storage account API requirements.
Metrics
The codemod emits these metrics:
arm_files_scannedarm_storage_accounts_scannedarm_storage_encryption_disabled_findingsarm_storage_encryption_blob_disabledarm_storage_encryption_file_disabledarm_storage_encryption_top_level_disabledarm_storage_encryption_unresolved_expressions
Exclusions
- Non-ARM JSON files
- Storage account resources whose
typeis dynamic or otherwise not statically resolvable - Storage accounts where
properties.encryptionis absent - Blob/file
enabledexpressions that cannot be statically resolved queueandtableservice encryption states
Development
License
MIT