Project: KICS (Provisioning / Security & Compliance)
File: 4d2cf896-c053-4be5-9c95-8b4771112f29.md

title: Hardcoded SecureString Parameter Default Value hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4d2cf896-c053-4be5-9c95-8b4771112f29 Query name: Hardcoded SecureString Parameter Default Value Platform: AzureResourceManager Severity: <span style="color:#bb2124">High</span> Category: Secret Management URL: Secure parameters should not have hardcoded default value<br> ```json title="Positive test num. 1 - json file" hl_lines="7" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "adminPassword": { "defaultValue": "HardcodedPassword", "type": "secureString" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('adminPassword')]", "version": "12.0" } } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="9" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "adminPassword": { "defaultValue": "HardcodedPassword", "type": "secureString" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('adminPassword')]", "version": "12.0" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "secureParameter": { "type": "secureString", "defaultValue": "[newGuid()]" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('secureParameter')]", "version": "12.0" } } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "adminPassword": { "type": "secureString" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('adminPassword')]", "version": "12.0" } } ], "outputs": {} } ``` ```json title="Negative test num. 3 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "secureParameter": { "type": "secureString", "defaultValue": "[newGuid()]" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('secureParameter')]", "version": "12.0" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": { "adminPassword": { "type": "secureString" }, "adminLogin": { "type": "string" }, "sqlServerName": { "type": "string" } }, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "tags": {}, "properties": { "administratorLogin": "[parameters('adminLogin')]", "administratorLoginPassword": "[parameters('adminPassword')]", "version": "12.0" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details>