Skip to content

Security workflow #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 24 commits into
base: main
Choose a base branch
from
Open

Security workflow #3

wants to merge 24 commits into from

Conversation

pamelafox
Copy link
Owner

No description provided.

@github-advanced-security
Copy link

You have successfully added a new templateanalyzer configuration .github/workflows/azure-bicep-validate.yaml:build. As part of the setup process, we have scanned this repository and found 9 existing alerts. Please check the repository Security tab to see all alerts.

@@ -6,7 +6,6 @@ param tags object = {}
param applicationInsightsName string = ''
param appServicePlanId string
param keyVaultName string = ''
param managedIdentity bool = !empty(keyVaultName)
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Didn't make that change in azure-dev yet, raised a discussion

@@ -33,6 +32,7 @@ param numberOfWorkers int = -1
param scmDoBuildDuringDeployment bool = false
param use32BitWorkerProcess bool = false
param ftpsState string = 'FtpsOnly'
param healthCheckPath string = ''
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is from upstream

param containerName string = 'main'
param containerRegistryName string = ''
param containerRegistryName string
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In PR

param logAnalyticsWorkspaceName string = ''
param containerAppsEnvironmentName string
param containerRegistryName string
param logAnalyticsWorkspaceName string
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In PR

@@ -62,7 +62,6 @@ module functions 'appservice.bicep' = {
keyVaultName: keyVaultName
kind: kind
linuxFxVersion: linuxFxVersion
managedIdentity: managedIdentity
Copy link
Owner Author

@pamelafox pamelafox Mar 22, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Related to my own change to appservice.bicep

@@ -1,6 +1,6 @@
param name string = 'add'

param keyVaultName string = ''
param keyVaultName string
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In PR

@@ -45,11 +45,13 @@ resource appService 'Microsoft.Web/sites@2022-03-01' = {
linuxFxVersion: linuxFxVersion
alwaysOn: alwaysOn
ftpsState: ftpsState
minTlsVersion: '1.2'
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In upstream already

appCommandLine: appCommandLine
numberOfWorkers: numberOfWorkers != -1 ? numberOfWorkers : null
minimumElasticInstanceCount: minimumElasticInstanceCount != -1 ? minimumElasticInstanceCount : null
use32BitWorkerProcess: use32BitWorkerProcess
functionAppScaleLimit: functionAppScaleLimit != -1 ? functionAppScaleLimit : null
healthCheckPath: healthCheckPath
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In upstream

@@ -58,7 +60,7 @@ resource appService 'Microsoft.Web/sites@2022-03-01' = {
httpsOnly: true
}

identity: { type: managedIdentity ? 'SystemAssigned' : 'None' }
identity: { type: 'SystemAssigned' }
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undecided managedIdentity change

@@ -93,6 +95,6 @@ resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing
name: applicationInsightsName
}

output identityPrincipalId string = managedIdentity ? appService.identity.principalId : ''
output identityPrincipalId string = appService.identity.principalId
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undecided managedIdentity change

@pamelafox
Copy link
Owner Author

Pending suggestions for how to fix functions.bicep:
Azure/template-analyzer#314
Azure/template-analyzer#296

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant