App Service Managed Identity Disabled

• Query id: b61cce4b-0cc4-472b-8096-15617a6d769b
• Query name: App Service Managed Identity Disabled
• Platform: Terraform
• Severity: Low
• Category: Resource Management
• CWE: 285
• Risk score: 2.6
• URL: Github

Description

Azure App Service should have managed identity enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_app_service" "positive1-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id
}

resource "azurerm_linux_web_app" "positive1-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id
}

resource "azurerm_windows_web_app" "positive1-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_app_service" "negative1-1" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_linux_web_app" "negative1-2" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_windows_web_app" "negative1-3" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id = azurerm_app_service_plan.example.id

  identity {
    type = "SystemAssigned"
  }
}