Beta - Logic App Managed Identity Disabled

• Query id: 7fa50094-0ca5-4253-aa71-f1a3b575d4a5
• Query name: Beta - Logic App Managed Identity Disabled
• Platform: Terraform
• Severity: Medium
• Category: Insecure Configurations
• CWE: 522
• Risk score: 3.0
• URL: Github

Description

Logic Apps should have managed identity enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_logic_app_standard" "positive" {
  name                       = "example-logic-app"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_logic_app_standard" "negative1" {
  name                       = "example-logic-app"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  identity {
    type = "SystemAssigned, UserAssigned"
  }
}

Negative test num. 2 - tf file

resource "azurerm_logic_app_standard" "negative2" {
  name                       = "example-logic-app"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  identity {
    type = "UserAssigned"
  }
}

Negative test num. 3 - tf file

resource "azurerm_logic_app_standard" "negative3" {
  name                       = "example-logic-app"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  identity {
    type = "SystemAssigned"
  }
}