@codemod/azure-security-bundle
Workflow-only bundle package that runs all 17 Azure-related codemods currently discoverable for azure, using their published Codemod registry package names.
This bundle is intended for Azure Pipelines YAML and Azure Resource Manager (ARM) JSON scenarios. It mixes read-only analysis codemods with remediation transforms so teams can run a single reusable Azure security workflow.
Registry intent:
- Package name:
@codemod/azure-security-bundle - Scope: Codemod organization
- Visibility:
public - Access:
pro
What It Runs
| Order | Step name | Package source | Summary |
|---|---|---|---|
| 1 | Azure Pipelines: lock Swift deps | @codemod/azure-pipelines-lock-swift-deps | Locks Swift dependency resolution in Azure Pipelines workflows. |
| 2 | Azure Pipelines: task parameter injection | @codemod/azure-pipelines-task-param-injection | Detects or remediates unsafe task parameter injection patterns. |
| 3 | Azure Pipelines: script injection audit | @codemod/azure-pipelines-script-injection-audit | Audits pipeline script execution for script injection risk. |
| 4 | Azure Pipelines: pin external task version | @codemod/azure-pipelines-pin-external-task-version | Pins externally referenced task versions in pipeline definitions. |
| 5 | ARM: RBAC disabled detection | @codemod/arm-rbac-disabled-detection | Detects ARM resources with RBAC protections disabled. |
| 6 | ARM: missing managed identity | @codemod/arm-detect-missing-managed-identity | Flags ARM resources that should use managed identity but do not. |
| 7 | ARM: custom role owner capabilities | @codemod/arm-no-custom-role-owner-capabilities | Detects custom roles that grant owner-like capabilities. |
| 8 | ARM: high-privilege role assignments | @codemod/arm-detect-high-privilege-role-assigns | Audits high-privilege role assignment usage. |
| 9 | ARM: duplicate string literals | @codemod/arm-duplicate-string-literals-s1192 | Detects repeated string literals that indicate ARM template duplication issues. |
| 10 | ARM: public network access disabled | @codemod/arm-public-network-access-disabled | Audits or remediates public network access exposure. |
| 11 | ARM: storage encryption disabled | @codemod/arm-storage-encryption-disabled | Detects storage resources with encryption disabled. |
| 12 | ARM: weak TLS protocols | @codemod/arm-detect-weak-tls-protocols | Detects weak TLS protocol settings in ARM resources. |
| 13 | ARM: role assignment broad scope audit | @codemod/arm-role-assignment-broad-scope-audit | Audits role assignments applied at overly broad scopes. |
| 14 | ARM: no cleartext protocols | @codemod/arm-no-cleartext-protocols | Detects or remediates cleartext protocol usage. |
| 15 | ARM: hardcoded apiVersion | @codemod/arm-hardcoded-apiversion | Updates or flags hardcoded ARM apiVersion values. |
| 16 | ARM: require client cert auth endpoints | @codemod/arm-client-cert-auth-endpoints | Enforces or audits client certificate authentication on endpoints. |
| 17 | ARM: remove redundant dependsOn | @codemod/arm-redundant-resource-dependson | Removes redundant dependsOn declarations from ARM templates. |
Workflow Behavior
The default workflow runs the 17 bundled registry codemods in this order:
- Azure Pipelines analysis and remediation steps.
- ARM and Azure security analysis steps.
- ARM remediation transforms.
- Optional AI review and cleanup.
The bundle itself does not ship a new AST transform. It is a workflow-only package that delegates to the published child packages by registry source.
Parameter
runAiCleanup
- Type:
boolean - Default:
true - Purpose: runs the optional
AI review and cleanupstep after the bundled codemods finish.
The AI step is gated with if: params.runAiCleanup == true so campaign creation can expose a toggle.
Usage
Run the published bundle:
Run the local package:
Disable the AI cleanup step:
Validate the package locally:
Development
License
MIT