Arm Rules
IaC rules for Arm that identify insecure configurations in infrastructure and cloud resources.
Arm Rule Catalog
| ID | Title | Severity |
|---|---|---|
IAC-0520 | Azure RDP Internet access is not restricted | HIGH |
IAC-0522 | Azure SQL Servers Firewall rule allow ingress access from 0.0.0.0/0 | HIGH |
IAC-0535 | Azure SQL Server audit log retention is not greater than 90 days | HIGH |
IAC-0536 | Azure SQL Server threat detection alerts are not enabled for all threat types | HIGH |
IAC-0537 | Azure SQL server send alerts to field value is not set | HIGH |
IAC-0545 | Azure storage account has a blob container that is publicly accessible | HIGH |
IAC-0550 | Azure subscriptions with custom roles does not have minimum permissions | HIGH |
IAC-0552 | Azure Key Vault secrets does not have expiration date | HIGH |
IAC-0559 | Azure Linux scale set does not use an SSH key | HIGH |
IAC-0806 | Azure Machine learning workspace configured with overly permissive network access | HIGH |
IAC-0516 | Azure AKS enable role-based access control (RBAC) not enforced | MEDIUM |
IAC-0525 | Azure App Service Web app doesn't redirect HTTP to HTTPS | MEDIUM |
IAC-0527 | App Service is not registered with an Azure Active Directory account | MEDIUM |
IAC-0746 | Azure Machine learning workspace is not configured with private endpoint | MEDIUM |
IAC-0512 | Azure Virtual Machine (Linux) does not authenticate using SSH keys | LOW |
IAC-0517 | Azure AKS cluster configured with overly permissive API server access | LOW |
IAC-0518 | Azure AKS cluster network policies are not enforced | LOW |
IAC-0519 | Kubernetes dashboard is not disabled | LOW |
IAC-0523 | Azure Network Watcher Network Security Group (NSG) flow logs retention is less than 90 days | LOW |
IAC-0524 | Azure App Service Web app authentication is off | LOW |
IAC-0526 | Azure App Service Web app doesn't use latest TLS version | LOW |
IAC-0534 | Azure SQL Server auditing policy is disabled | LOW |
IAC-0539 | Azure MySQL Database Server SSL connection is disabled | LOW |
IAC-0540 | Azure PostgreSQL database server with SSL connection disabled | LOW |
IAC-0547 | Azure Storage Account 'Trusted Microsoft Services' access not enabled | LOW |
IAC-0557 | Azure MariaDB database server with SSL connection disabled | LOW |
IAC-0639 | Azure Cosmos DB key based authentication is enabled | LOW |
IAC-0805 | Azure Databricks Workspaces not using customer-managed key for root DBFS encryption | LOW |
IAC-0513 | Azure VM data disk is not encrypted with ADE/CMK | INFO |
IAC-0515 | Azure AKS cluster monitoring not enabled | INFO |
IAC-0521 | Azure Network Security Group allows all traffic on SSH port 22 | INFO |
IAC-0528 | Azure App Service Web app client certificate is disabled | INFO |
IAC-0529 | Azure App Service Web app doesn't use HTTP 2.0 | INFO |
IAC-0530 | Azure Microsoft Defender for Cloud Defender plans is set to Off | INFO |
IAC-0531 | Azure Microsoft Defender for Cloud security contact phone number is not set | INFO |
IAC-0533 | Azure Microsoft Defender for Cloud email notification for subscription owner is not set | INFO |
IAC-0538 | Azure SQL Databases with disabled Email service and co-administrators for Threat Detection | INFO |
IAC-0541 | Azure PostgreSQL database server with log checkpoints parameter disabled | INFO |
IAC-0542 | Azure PostgreSQL database server with log connections parameter disabled | INFO |
IAC-0543 | Azure PostgreSQL database server with connection throttling parameter is disabled | INFO |
IAC-0544 | Azure storage account logging for queues is disabled | INFO |
IAC-0546 | Azure Storage Account default network access is set to 'Allow' | INFO |
IAC-0548 | Azure Activity Log retention should not be set to less than 365 days | INFO |
IAC-0549 | Azure Monitor log profile does not capture all activities | INFO |
IAC-0553 | Azure Key Vault is not recoverable | INFO |
IAC-0638 | Azure Microsoft Defender for Cloud security alert email notifications is not set | INFO |
IAC-0745 | Azure Cognitive Services account is not configured with managed identity | INFO |
Total Rules: 47
Click on any rule ID to view detailed information, examples, and remediation guidance.