Synapse Workspace Managed Virtual Network Not Enabled

• Query id: cb76b715-5dbf-44a7-b3c6-486cd1e066f4
• Query name: Synapse Workspace Managed Virtual Network Not Enabled
• Platform: Terraform
• Severity: Low
• Category: Networking and Firewall
• CWE: 732
• Risk score: 1.0
• URL: Github

Description

Azure Synapse workspaces should have Managed Virtual Network enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_synapse_workspace" "positive1" {
  name                                 = "example"
  resource_group_name                  = azurerm_resource_group.example.name
  location                             = azurerm_resource_group.example.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
  sql_administrator_login              = "sqladminuser"
  sql_administrator_login_password     = "H@Sh1CoR3!"

  identity {
    type = "SystemAssigned"
  }
}

Positive test num. 2 - tf file

resource "azurerm_synapse_workspace" "positive2" {
  name                                 = "example"
  resource_group_name                  = azurerm_resource_group.example.name
  location                             = azurerm_resource_group.example.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
  sql_administrator_login              = "sqladminuser"
  sql_administrator_login_password     = "H@Sh1CoR3!"

  managed_virtual_network_enabled = false

  identity {
    type = "SystemAssigned"
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_synapse_workspace" "negative1" {
  name                                 = "example"
  resource_group_name                  = azurerm_resource_group.example.name
  location                             = azurerm_resource_group.example.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
  sql_administrator_login              = "sqladminuser"
  sql_administrator_login_password     = "H@Sh1CoR3!"

  managed_virtual_network_enabled = true

  identity {
    type = "SystemAssigned"
  }
}