Project: Checkov (Provisioning / Security & Compliance)
File: arm.md

layout: default title: arm resource scans nav_order: 1 | | Id | Type | Entity | Policy | IaC | Resource Link | |-||--||--|-|| | 0 | CKVAZURE1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | | | 1 | CKVAZURE2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | | | 2 | CKVAZURE3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | | | 3 | CKVAZURE4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | | | 4 | CKVAZURE5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | | | 5 | CKVAZURE6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | | | 6 | CKVAZURE7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | | | 7 | CKVAZURE8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | | | 8 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | | | 9 | CKVAZURE9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | | | 10 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | | | 11 | CKVAZURE10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | | | 12 | CKVAZURE11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | | | 13 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 14 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 15 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 16 | CKVAZURE12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | | | 17 | CKVAZURE13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | | | 18 | CKVAZURE13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | | | 19 | CKVAZURE14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | | | 20 | CKVAZURE15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | | | 21 | CKVAZURE16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | | | 22 | CKVAZURE17 | resource |

| Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | | | 23 | CKVAZURE18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | | | 24 | CKVAZURE19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | | | 25 | CKVAZURE20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | | | 26 | CKVAZURE21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | | | 27 | CKVAZURE22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | | | 28 | CKVAZURE23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | | | 29 | CKVAZURE23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | | | 30 | CKVAZURE24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | | | 31 | CKVAZURE25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | | | 32 | CKVAZURE26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | | | 33 | CKVAZURE27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | | | 34 | CKVAZURE28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | | | 35 | CKVAZURE29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | | | 36 | CKVAZURE30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | | | 37 | CKVAZURE30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | | | 38 | CKVAZURE31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | | | 39 | CKVAZURE31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | | | 40 | CKVAZURE32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | | | 41 | CKVAZURE32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | | | 42 | CKVAZURE33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | | | 43 | CKVAZURE34 | resource |

| Ensure that 'Public access level' is set to Private for blob containers | arm | | | 44 | CKVAZURE34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | | | 45 | CKVAZURE34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | | | 46 | CKVAZURE35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | | | 47 | CKVAZURE36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | | | 48 | CKVAZURE37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | | | 49 | CKVAZURE38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | | | 50 | CKVAZURE39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | | | 51 | CKVAZURE40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | arm | | | 52 | CKVAZURE41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | | | 53 | CKVAZURE42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | | | 54 | CKVAZURE44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | arm | | | 55 | CKVAZURE47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | | | 56 | CKVAZURE49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | | | 57 | CKVAZURE50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | arm | | | 58 | CKVAZURE58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | arm | | | 59 | CKVAZURE59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | arm | | | 60 | CKVAZURE63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | arm | | | 61 | CKVAZURE65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | arm | | | 62 | CKVAZURE66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | arm | | | 63 | CKVAZURE80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | arm | | | 64 | CKVAZURE88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | arm | | | 65 | CKVAZURE89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | arm | | | 66 | CKVAZURE93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | arm | | | 67 | CKVAZURE94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | arm | | | 68 | CKVAZURE95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | arm | | | 69 | CKVAZURE96 | resource |

| Ensure that MySQL server enables infrastructure encryption | arm | | | 70 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | arm | | | 71 | CKVAZURE97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | arm | | | 72 | CKVAZURE100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | arm | | | 73 | CKVAZURE101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | arm | | | 74 | CKVAZURE103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | arm | | | 75 | CKVAZURE107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | arm | | | 76 | CKVAZURE109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | arm | | | 77 | CKVAZURE111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | arm | | | 78 | CKVAZURE112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | arm | | | 79 | CKVAZURE113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | arm | | | 80 | CKVAZURE114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | arm | | | 81 | CKVAZURE121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | arm | | | 82 | CKVAZURE123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | arm | | | 83 | CKVAZURE130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | arm | | | 84 | CKVAZURE131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | | | 85 | CKVAZURE132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | | | 86 | CKVAZURE134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | arm | | | 87 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | arm | | | 88 | CKVAZURE149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | arm | | | 89 | CKVAZURE151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | arm | | | 90 | CKVAZURE160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | arm | | | 91 | CKVAZURE160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | arm | | | 92 | CKVAZURE216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | arm | | | 93 | CKV2AZURE23 | resource | Microsoft.AppPlatform/Spring | Ensure Azure spring cloud is configured with Virtual network (Vnet) | arm | | | 94 | CKV2AZURE27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | arm | |