Skip to content

Commit 1d9b935

Browse files
pregresspregress
committed
feat: scm ip restriction
1 parent f4b6419 commit 1d9b935

16 files changed

+1118
-2
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ You can install the plugin with `tflint --init`. Declare a config in `.tflint.hc
1717
plugin "azurerm-security" {
1818
enabled = true
1919
20-
version = "0.1.10"
20+
version = "0.1.11"
2121
source = "github.com/pregress/tflint-ruleset-azurerm-security"
2222
}
2323
```

‎docs/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,14 @@
1616
|[azurerm_linux_function_app_ftps_state](./rules/azurerm_linux_function_app_ftps_state.md)|Warning|✔|
1717
|[azurerm_linux_function_app_https_only](./rules/azurerm_linux_function_app_https_only.md)|Warning|✔|
1818
|[azurerm_linux_function_app_minimum_tls_version](./rules/azurerm_linux_function_app_minimum_tls_version.md)|Warning|✔|
19+
|[azurerm_linux_function_app_scm_ip_restriction_default_action](./rules/azurerm_linux_function_app_scm_ip_restriction_default_action.md)|Warning|✔|
1920
|[azurerm_linux_function_app_slot_ftps_state](./rules/azurerm_linux_function_app_slot_ftps_state.md)|Warning|✔|
2021
|[azurerm_linux_function_app_slot_https_only](./rules/azurerm_linux_function_app_slot_https_only.md)|Warning|✔|
2122
|[azurerm_linux_function_app_slot_minimum_tls_version](./rules/azurerm_linux_function_app_slot_minimum_tls_version.md)|Warning|✔|
2223
|[azurerm_linux_web_app_ftps_state](./rules/azurerm_linux_web_app_ftps_state.md)|Warning|✔|
2324
|[azurerm_linux_web_app_https_only](./rules/azurerm_linux_web_app_https_only.md)|Warning|✔|
2425
|[azurerm_linux_web_app_minimum_tls_version](./rules/azurerm_linux_web_app_minimum_tls_version.md)|Warning|✔|
26+
|[azurerm_linux_web_app_scm_ip_restriction_default_action](./rules/azurerm_linux_web_app_scm_ip_restriction_default_action.md)|Warning|✔|
2527
|[azurerm_linux_web_app_slot_ftps_state](./rules/azurerm_linux_web_app_slot_ftps_state.md)|Warning|✔|
2628
|[azurerm_linux_web_app_slot_https_only](./rules/azurerm_linux_web_app_slot_https_only.md)|Warning|✔|
2729
|[azurerm_linux_web_app_slot_minimum_tls_version](./rules/azurerm_linux_web_app_slot_minimum_tls_version.md)|Warning|✔|
@@ -39,12 +41,14 @@
3941
|[azurerm_windows_function_app_ftps_state](./rules/azurerm_windows_function_app_ftps_state.md)|Warning|✔|
4042
|[azurerm_windows_function_app_https_only](./rules/azurerm_windows_function_app_https_only.md)|Warning|✔|
4143
|[azurerm_windows_function_app_minimum_tls_version](./rules/azurerm_windows_function_app_minimum_tls_version.md)|Warning|✔|
44+
|[azurerm_windows_function_app_scm_ip_restriction_default_action](./rules/azurerm_windows_function_app_scm_ip_restriction_default_action.md)|Warning|✔|
4245
|[azurerm_windows_function_app_slot_ftps_state](./rules/azurerm_windows_function_app_slot_ftps_state.md)|Warning|✔|
4346
|[azurerm_windows_function_app_slot_https_only](./rules/azurerm_windows_function_app_slot_https_only.md)|Warning|✔|
4447
|[azurerm_windows_function_app_slot_minimum_tls_version](./rules/azurerm_windows_function_app_slot_minimum_tls_version.md)|Warning|✔|
4548
|[azurerm_windows_web_app_ftps_state](./rules/azurerm_windows_web_app_ftps_state.md)|Warning|✔|
4649
|[azurerm_windows_web_app_https_only](./rules/azurerm_windows_web_app_https_only.md)|Warning|✔|
4750
|[azurerm_windows_web_app_minimum_tls_version](./rules/azurerm_windows_web_app_minimum_tls_version.md)|Warning|✔|
51+
|[azurerm_windows_web_app_scm_ip_restriction_default_action](./rules/azurerm_windows_web_app_scm_ip_restriction_default_action.md)|Warning|✔|
4852
|[azurerm_windows_web_app_slot_ftps_state](./rules/azurerm_windows_web_app_slot_ftps_state.md)|Warning|✔|
4953
|[azurerm_windows_web_app_slot_https_only](./rules/azurerm_windows_web_app_slot_https_only.md)|Warning|✔|
5054
|[azurerm_windows_web_app_slot_minimum_tls_version](./rules/azurerm_windows_web_app_slot_minimum_tls_version.md)|Warning|✔|
@@ -83,6 +87,7 @@
8387
- [azurerm_linux_function_app_ftps_state](./rules/azurerm_linux_function_app_ftps_state.md)
8488
- [azurerm_linux_function_app_https_only](./rules/azurerm_linux_function_app_https_only.md)
8589
- [azurerm_linux_function_app_minimum_tls_version](./rules/azurerm_linux_function_app_minimum_tls_version.md)
90+
- [azurerm_linux_function_app_scm_ip_restriction_default_action](./rules/azurerm_linux_function_app_scm_ip_restriction_default_action.md)
8691

8792
### azurerm_linux_function_app_slot
8893

@@ -95,6 +100,7 @@
95100
- [azurerm_linux_web_app_ftps_state](./rules/azurerm_linux_web_app_ftps_state.md)
96101
- [azurerm_linux_web_app_https_only](./rules/azurerm_linux_web_app_https_only.md)
97102
- [azurerm_linux_web_app_minimum_tls_version](./rules/azurerm_linux_web_app_minimum_tls_version.md)
103+
- [azurerm_linux_web_app_scm_ip_restriction_default_action](./rules/azurerm_linux_web_app_scm_ip_restriction_default_action.md)
98104

99105
### azurerm_linux_web_app_slot
100106

@@ -133,6 +139,7 @@
133139
- [azurerm_windows_function_app_ftps_state](./rules/azurerm_windows_function_app_ftps_state.md)
134140
- [azurerm_windows_function_app_https_only](./rules/azurerm_windows_function_app_https_only.md)
135141
- [azurerm_windows_function_app_minimum_tls_version](./rules/azurerm_windows_function_app_minimum_tls_version.md)
142+
- [azurerm_windows_function_app_scm_ip_restriction_default_action](./rules/azurerm_windows_function_app_scm_ip_restriction_default_action.md)
136143

137144
### azurerm_windows_function_app_slot
138145

@@ -145,6 +152,7 @@
145152
- [azurerm_windows_web_app_ftps_state](./rules/azurerm_windows_web_app_ftps_state.md)
146153
- [azurerm_windows_web_app_https_only](./rules/azurerm_windows_web_app_https_only.md)
147154
- [azurerm_windows_web_app_minimum_tls_version](./rules/azurerm_windows_web_app_minimum_tls_version.md)
155+
- [azurerm_windows_web_app_scm_ip_restriction_default_action](./rules/azurerm_windows_web_app_scm_ip_restriction_default_action.md)
148156

149157
### azurerm_windows_web_app_slot
150158

‎docs/rules/azurerm_linux_function_app_scm_ip_restriction_default_action.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# azurerm_linux_function_app_scm_ip_restriction_default_action
2+
3+
**Severity:** Warning
4+
5+
6+
## Example
7+
8+
```hcl
9+
resource "azurerm_linux_function_app" "example" {
10+
site_config {
11+
scm_ip_restriction_default_action = "Allow"
12+
}
13+
}
14+
```
15+
or
16+
```hcl
17+
resource "azurerm_linux_function_app" "example" {
18+
site_config {
19+
# Missing scm_ip_restriction_default_action (defaults to Allow)
20+
}
21+
}
22+
```
23+
24+
## Why
25+
26+
Setting the `scm_ip_restriction_default_action` to "Deny" prevents unauthorized access to the Source Control Manager (SCM) interface, reducing exposure to potential threats and ensuring only trusted networks can connect to the deployment and management endpoints.
27+
28+
## How to Fix
29+
30+
Set the `scm_ip_restriction_default_action` to "Deny" and configure specific `scm_ip_restriction` rules to allow legitimate access.
31+
32+
### Using service tag
33+
```hcl
34+
resource "azurerm_linux_function_app" "example" {
35+
site_config {
36+
scm_ip_restriction_default_action = "Deny"
37+
38+
scm_ip_restriction {
39+
service_tag = "AzureDevOps"
40+
name = "Allow Azure DevOps"
41+
priority = 100
42+
action = "Allow"
43+
}
44+
}
45+
}
46+
```
47+
48+
### Using IP range
49+
```hcl
50+
resource "azurerm_linux_function_app" "example" {
51+
site_config {
52+
scm_ip_restriction_default_action = "Deny"
53+
54+
scm_ip_restriction {
55+
ip_address = "203.0.113.0/24"
56+
name = "Corporate Network"
57+
priority = 100
58+
action = "Allow"
59+
}
60+
}
61+
}
62+
```
63+
64+
65+
## How to disable
66+
67+
```hcl
68+
rule "azurerm_linux_function_app_scm_ip_restriction_default_action" {
69+
enabled = false
70+
}
71+
```
72+

‎docs/rules/azurerm_linux_web_app_scm_ip_restriction_default_action.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# azurerm_linux_web_app_scm_ip_restriction_default_action
2+
3+
**Severity:** Warning
4+
5+
6+
## Example
7+
8+
```hcl
9+
resource "azurerm_linux_web_app" "example" {
10+
site_config {
11+
scm_ip_restriction_default_action = "Allow"
12+
}
13+
}
14+
```
15+
or
16+
```hcl
17+
resource "azurerm_linux_web_app" "example" {
18+
site_config {
19+
# Missing scm_ip_restriction_default_action (defaults to Allow)
20+
}
21+
}
22+
```
23+
24+
## Why
25+
26+
Setting the `scm_ip_restriction_default_action` to "Deny" prevents unauthorized access to the Source Control Manager (SCM) interface, reducing exposure to potential threats and ensuring only trusted networks can connect to the deployment and management endpoints.
27+
28+
## How to Fix
29+
30+
Set the `scm_ip_restriction_default_action` to "Deny" and configure specific `scm_ip_restriction` rules to allow legitimate access.
31+
32+
### Using service tag
33+
```hcl
34+
resource "azurerm_linux_web_app" "example" {
35+
site_config {
36+
scm_ip_restriction_default_action = "Deny"
37+
38+
scm_ip_restriction {
39+
service_tag = "AzureDevOps"
40+
name = "Allow Azure DevOps"
41+
priority = 100
42+
action = "Allow"
43+
}
44+
}
45+
}
46+
```
47+
48+
### Using IP range
49+
```hcl
50+
resource "azurerm_linux_web_app" "example" {
51+
site_config {
52+
scm_ip_restriction_default_action = "Deny"
53+
54+
scm_ip_restriction {
55+
ip_address = "203.0.113.0/24"
56+
name = "Corporate Network"
57+
priority = 100
58+
action = "Allow"
59+
}
60+
}
61+
}
62+
```
63+
64+
65+
## How to disable
66+
67+
```hcl
68+
rule "azurerm_linux_web_app_scm_ip_restriction_default_action" {
69+
enabled = false
70+
}
71+
```
72+

‎docs/rules/azurerm_windows_function_app_scm_ip_restriction_default_action.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# azurerm_windows_function_app_scm_ip_restriction_default_action
2+
3+
**Severity:** Warning
4+
5+
6+
## Example
7+
8+
```hcl
9+
resource "azurerm_windows_function_app" "example" {
10+
site_config {
11+
scm_ip_restriction_default_action = "Allow"
12+
}
13+
}
14+
```
15+
or
16+
```hcl
17+
resource "azurerm_windows_function_app" "example" {
18+
site_config {
19+
# Missing scm_ip_restriction_default_action (defaults to Allow)
20+
}
21+
}
22+
```
23+
24+
## Why
25+
26+
Setting the `scm_ip_restriction_default_action` to "Deny" prevents unauthorized access to the Source Control Manager (SCM) interface, reducing exposure to potential threats and ensuring only trusted networks can connect to the deployment and management endpoints.
27+
28+
## How to Fix
29+
30+
Set the `scm_ip_restriction_default_action` to "Deny" and configure specific `scm_ip_restriction` rules to allow legitimate access.
31+
32+
### Using service tag
33+
```hcl
34+
resource "azurerm_windows_function_app" "example" {
35+
site_config {
36+
scm_ip_restriction_default_action = "Deny"
37+
38+
scm_ip_restriction {
39+
service_tag = "AzureDevOps"
40+
name = "Allow Azure DevOps"
41+
priority = 100
42+
action = "Allow"
43+
}
44+
}
45+
}
46+
```
47+
48+
### Using IP range
49+
```hcl
50+
resource "azurerm_windows_function_app" "example" {
51+
site_config {
52+
scm_ip_restriction_default_action = "Deny"
53+
54+
scm_ip_restriction {
55+
ip_address = "203.0.113.0/24"
56+
name = "Corporate Network"
57+
priority = 100
58+
action = "Allow"
59+
}
60+
}
61+
}
62+
```
63+
64+
65+
## How to disable
66+
67+
```hcl
68+
rule "azurerm_windows_function_app_scm_ip_restriction_default_action" {
69+
enabled = false
70+
}
71+
```
72+

‎docs/rules/azurerm_windows_web_app_scm_ip_restriction_default_action.md

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# azurerm_windows_web_app_scm_ip_restriction_default_action
2+
3+
**Severity:** Warning
4+
5+
6+
## Example
7+
8+
```hcl
9+
resource "azurerm_windows_web_app" "example" {
10+
site_config {
11+
scm_ip_restriction_default_action = "Allow"
12+
}
13+
}
14+
```
15+
or
16+
```hcl
17+
resource "azurerm_windows_web_app" "example" {
18+
site_config {
19+
# Missing scm_ip_restriction_default_action (defaults to Allow)
20+
}
21+
}
22+
```
23+
24+
## Why
25+
26+
Setting the `scm_ip_restriction_default_action` to "Deny" prevents unauthorized access to the Source Control Manager (SCM) interface, reducing exposure to potential threats and ensuring only trusted networks can connect to the deployment and management endpoints.
27+
28+
## How to Fix
29+
30+
Set the `scm_ip_restriction_default_action` to "Deny" and configure specific `scm_ip_restriction` rules to allow legitimate access.
31+
32+
### Using service tag
33+
```hcl
34+
resource "azurerm_windows_web_app" "example" {
35+
site_config {
36+
scm_ip_restriction_default_action = "Deny"
37+
38+
scm_ip_restriction {
39+
service_tag = "AzureDevOps"
40+
name = "Allow Azure DevOps"
41+
priority = 100
42+
action = "Allow"
43+
}
44+
}
45+
}
46+
```
47+
48+
### Using IP range
49+
```hcl
50+
resource "azurerm_windows_web_app" "example" {
51+
site_config {
52+
scm_ip_restriction_default_action = "Deny"
53+
54+
scm_ip_restriction {
55+
ip_address = "203.0.113.0/24"
56+
name = "Corporate Network"
57+
priority = 100
58+
action = "Allow"
59+
}
60+
}
61+
}
62+
```
63+
64+
65+
## How to disable
66+
67+
```hcl
68+
rule "azurerm_windows_web_app_scm_ip_restriction_default_action" {
69+
enabled = false
70+
}
71+
```
72+

‎main.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,14 @@ func createRuleSet() *tflint.BuiltinRuleSet {
2525
rules.NewAzurermLinuxFunctionAppFtpsState(),
2626
rules.NewAzurermLinuxFunctionAppHTTPSOnly(),
2727
rules.NewAzurermLinuxFunctionAppMinimumTLSVersion(),
28+
rules.NewAzurermLinuxFunctionAppScmIPRestrictionDefaultAction(),
2829
rules.NewAzurermLinuxFunctionAppSlotFtpsState(),
2930
rules.NewAzurermLinuxFunctionAppSlotHTTPSOnly(),
3031
rules.NewAzurermLinuxFunctionAppSlotMinimumTLSVersion(),
3132
rules.NewAzurermLinuxWebAppFtpsState(),
3233
rules.NewAzurermLinuxWebAppHTTPSOnly(),
3334
rules.NewAzurermLinuxWebAppMinimumTLSVersion(),
35+
rules.NewAzurermLinuxWebAppScmIPRestrictionDefaultAction(),
3436
rules.NewAzurermLinuxWebAppSlotFtpsState(),
3537
rules.NewAzurermLinuxWebAppSlotHTTPSOnly(),
3638
rules.NewAzurermLinuxWebAppSlotMinimumTLSVersion(),
@@ -48,12 +50,14 @@ func createRuleSet() *tflint.BuiltinRuleSet {
4850
rules.NewAzurermWindowsFunctionAppFtpsState(),
4951
rules.NewAzurermWindowsFunctionAppHTTPSOnly(),
5052
rules.NewAzurermWindowsFunctionAppMinimumTLSVersion(),
53+
rules.NewAzurermWindowsFunctionAppScmIPRestrictionDefaultAction(),
5154
rules.NewAzurermWindowsFunctionAppSlotFtpsState(),
5255
rules.NewAzurermWindowsFunctionAppSlotHTTPSOnly(),
5356
rules.NewAzurermWindowsFunctionAppSlotMinimumTLSVersion(),
5457
rules.NewAzurermWindowsWebAppFtpsState(),
5558
rules.NewAzurermWindowsWebAppHTTPSOnly(),
5659
rules.NewAzurermWindowsWebAppMinimumTLSVersion(),
60+
rules.NewAzurermWindowsWebAppScmIPRestrictionDefaultAction(),
5761
rules.NewAzurermWindowsWebAppSlotFtpsState(),
5862
rules.NewAzurermWindowsWebAppSlotHTTPSOnly(),
5963
rules.NewAzurermWindowsWebAppSlotMinimumTLSVersion(),

0 commit comments

Comments
 (0)