Synapse Workspace Managed Virtual Network Not Enabled

• Query id: 8221c5b3-0031-4233-a9a2-08ec4cd20ced
• Query name: Synapse Workspace Managed Virtual Network Not Enabled
• Platform: AzureResourceManager
• Severity: Low
• Category: Networking and Firewall
• CWE: 732
• Risk score: 1.0
• URL: Github

Description

Azure Synapse workspaces should have Managed Virtual Network enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - bicep file

resource positive1 'Microsoft.Synapse/workspaces@2021-06-01' = {
  name: 'positive1'
  location: 'location1'
  properties: {
    defaultDataLakeStorage: {
      accountUrl: 'https://accountname.dfs.core.windows.net'
      filesystem: 'filesystem1'
    }
    sqlAdministratorLogin: 'sqladminuser'
  }
}

Positive test num. 2 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.Synapse/workspaces",
      "apiVersion": "2021-06-01",
      "name": "positive1",
      "location": "location1",
      "properties": {
        "defaultDataLakeStorage": {
          "accountUrl": "https://accountname.dfs.core.windows.net",
          "filesystem": "filesystem1"
        },
        "sqlAdministratorLogin": "sqladminuser"
      }
    }
  ],
  "outputs": {}
}

Positive test num. 3 - bicep file

resource positive2 'Microsoft.Synapse/workspaces@2021-06-01' = {
  name: 'positive2'
  location: 'location1'
  properties: {
    defaultDataLakeStorage: {
      accountUrl: 'https://accountname.dfs.core.windows.net'
      filesystem: 'filesystem1'
    }
    sqlAdministratorLogin: 'sqladminuser'
    managedVirtualNetwork: ''
  }
}

Positive test num. 4 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.Synapse/workspaces",
      "apiVersion": "2021-06-01",
      "name": "positive2",
      "location": "location1",
      "properties": {
        "defaultDataLakeStorage": {
          "accountUrl": "https://accountname.dfs.core.windows.net",
          "filesystem": "filesystem1"
        },
        "sqlAdministratorLogin": "sqladminuser",
        "managedVirtualNetwork": ""
      }
    }
  ],
  "outputs": {}
}

Code samples without security vulnerabilities

Negative test num. 1 - bicep file

resource negative1 'Microsoft.Synapse/workspaces@2021-06-01' = {
  name: 'negative1'
  location: 'location1'
  properties: {
    defaultDataLakeStorage: {
      accountUrl: 'https://accountname.dfs.core.windows.net'
      filesystem: 'filesystem1'
    }
    sqlAdministratorLogin: 'sqladminuser'
    managedVirtualNetwork: 'default'
  }
}

Negative test num. 2 - json file

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.Synapse/workspaces",
      "apiVersion": "2021-06-01",
      "name": "negative1",
      "location": "location1",
      "properties": {
        "defaultDataLakeStorage": {
          "accountUrl": "https://accountname.dfs.core.windows.net",
          "filesystem": "filesystem1"
        },
        "sqlAdministratorLogin": "sqladminuser",
        "managedVirtualNetwork": "default"
      }
    }
  ],
  "outputs": {}
}