Redis Cache Allows Non SSL Connections

  • Query id: 49e30ac8-f58e-4222-b488-3dcb90158ec1
  • Query name: Redis Cache Allows Non SSL Connections
  • Platform: Pulumi
  • Severity: Medium
  • Category: Encryption
  • URL: Github

Description

Redis Cache resource should not allow non-SSL connections.
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file
name: azure-aks
runtime: yaml
description: An Aks cluster
resources:
  redis:
    type: azure-native:cache:Redis
    properties:
      enableNonSslPort: true
      location: West US
      minimumTlsVersion: 1.2
      name: cache1
      redisConfiguration:
        maxmemoryPolicy: allkeys-lru
      replicasPerMaster: 2
      resourceGroupName: rg1
      shardCount: 2
      sku:
        capacity: 1
        family: P
        name: Premium
      staticIP: 192.168.0.5
      subnetId: /subscriptions/subid/resourceGroups/rg2/providers/Microsoft.Network/virtualNetworks/network1/subnets/subnet1
      zones:
        - 1

Code samples without security vulnerabilities

Negative test num. 1 - yaml file
name: azure-aks
runtime: yaml
description: An Aks cluster
resources:
  redis:
    type: azure-native:cache:Redis
    properties:
      enableNonSslPort: false
      location: West US
      minimumTlsVersion: 1.2
      name: cache1
      redisConfiguration:
        maxmemoryPolicy: allkeys-lru
      replicasPerMaster: 2
      resourceGroupName: rg1
      shardCount: 2
      sku:
        capacity: 1
        family: P
        name: Premium
      staticIP: 192.168.0.5
      subnetId: /subscriptions/subid/resourceGroups/rg2/providers/Microsoft.Network/virtualNetworks/network1/subnets/subnet1
      zones:
        - 1