Moderne OnlyThis recipe is proprietary to Moderne and runs on the Moderne platform or CLI — it isn’t part of the open-source catalog. Available with a Moderne subscription.
Best practices for Azure
Recipe ID
org.openrewrite.terraform.azure.AzureBestPracticesArtifact
org.openrewrite.recipe:rewrite-terraformDefinition
Recipes45
45 recipes
- Encrypt Azure VM data disk with ADE/CMK
- Enable Azure Storage secure transfer required
- Disable Kubernetes dashboard
- Ensure the storage container storing activity logs is not publicly accessible
- Ensure Azure Network Watcher NSG flow logs retention is greater than 90 days
- Ensure Azure App Service Web app redirects HTTP to HTTPS
- Ensure Web App uses the latest version of TLS encryption
- Ensure Web App uses the latest version of HTTP
- Ensure standard pricing tier is selected
- Ensure a security contact phone number is present
- Ensure Send email notification for high severity alerts is enabled
- Ensure Send email notification for high severity alerts to admins is enabled
- Ensure Azure SQL server audit log retention is greater than 90 days
- Ensure Azure SQL Server threat detection alerts are enabled for all threat types
- Ensure Azure SQL server send alerts to field value is set
- Ensure MSSQL servers have email service and co-administrators enabled
- Ensure MySQL server databases have Enforce SSL connection enabled
- Ensure Azure PostgreSQL database server with SSL connection is enabled
- Set Azure Storage Account default network access to deny
- Enable Azure Storage Account Trusted Microsoft Services access
- Ensure activity log retention is set to 365 days or greater
- Ensure log profile is configured to capture all activities
- Ensure all keys have an expiration date
- Ensure AKV secrets have an expiration date set
- Ensure Azure key vault is recoverable
- Ensure storage account uses latest TLS version
- Ensure public network access enabled is set to False for mySQL servers
- Ensure MySQL is using the latest version of TLS encryption
- Ensure app service enables HTTP logging
- Ensure app service enables detailed error messages
- Ensure app service enables failed request tracing
- Ensure PostgreSQL server disables public network access
- Ensure managed identity provider is enabled for app services
- Ensure FTP Deployments are disabled
- Ensure MySQL server disables public network access
- Ensure MySQL server enables geo-redundant backups
- Enable geo-redundant backups on PostgreSQL server
- Ensure key vault allows firewall rules settings
- Ensure key vault enables purge protection
- Ensure key vault secrets have
content_typeset - Ensure AKS policies add-on
- Ensure Azure application gateway has WAF enabled
- Ensure MySQL server enables Threat Detection policy
- Ensure PostgreSQL server enables Threat Detection policy
- Ensure PostgreSQL server enables infrastructure encryption
Usage
Run this recipe
This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.
You will need to have configured the Moderne CLI on your machine before you can run the following command.
shell
mod run . --recipe AzureBestPractices
If the recipe is not available locally, then you can install it using:
mod config recipes jar install org.openrewrite.recipe:rewrite-terraform:3.14.3
Data tables
Source files that had results
org.openrewrite.table.SourcesFileResultsSource files that were modified by the recipe run.
| Column | Description |
|---|---|
| Source path before the run | The source path of the file before the run. null when a source file was created during the run. |
| Source path after the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
| Parent of the recipe that made changes | In a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all. |
| Recipe that made changes | The specific recipe that made a change. |
| Estimated time saving | An estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds. |
| Cycle | The recipe cycle in which the change was made. |
Source files that had search results
org.openrewrite.table.SearchResultsSearch results that were found during the recipe run.
| Column | Description |
|---|---|
| Source path of search result before the run | The source path of the file with the search result markers present. |
| Source path of search result after run the run | A recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run. |
| Result | The trimmed printed tree of the LST element that the marker is attached to. |
| Description | The content of the description of the marker. |
| Recipe that added the search marker | The specific recipe that added the Search marker. |
Source files that errored on a recipe
org.openrewrite.table.SourcesFileErrorsThe details of all errors produced by a recipe run.
| Column | Description |
|---|---|
| Source path | The file that failed to parse. |
| Recipe that made changes | The specific recipe that made a change. |
| Stack trace | The stack trace of the failure. |
Recipe performance
org.openrewrite.table.RecipeRunStatsStatistics used in analyzing the performance of recipes.
| Column | Description |
|---|---|
| The recipe | The recipe whose stats are being measured both individually and cumulatively. |
| Source file count | The number of source files the recipe ran over. |
| Source file changed count | The number of source files which were changed in the recipe run. Includes files created, deleted, and edited. |
| Cumulative scanning time (ns) | The total time spent across the scanning phase of this recipe. |
| Max scanning time (ns) | The max time scanning any one source file. |
| Cumulative edit time (ns) | The total time spent across the editing phase of this recipe. |
| Max edit time (ns) | The max time editing any one source file. |