feat: added ssh key generation support - #24
Closed
asharma-cd wants to merge 6 commits into
Closed
Conversation
🛡️ Checkov Security Scan: 4 Issues Found🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
} |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces functionality to automatically generate SSH keys for Linux virtual machines using the tls provider. The review identified several critical issues: potential Terraform index out-of-range errors in the output definitions, a security regression where the public_key variable is no longer marked as sensitive, a breaking change due to the default value of generate_ssh_key, and an unintended change to the default value of allow_extension_operations. Additionally, the review highlighted redundant commented-out code and incorrect indentation in the linux.tf configuration.
| } | ||
|
|
||
| output "private_key_pem" { | ||
| value = var.generate_ssh_key ? tls_private_key.ssh_key[0].private_key_pem : null |
There was a problem hiding this comment.
This expression will cause a Terraform error if var.enable is false and var.generate_ssh_key is true. In that case, tls_private_key.ssh_key will be an empty list, and attempting to access index [0] will result in an 'index out of range' error. You should ensure var.enable is checked.
value = var.enable && var.generate_ssh_key ? tls_private_key.ssh_key[0].private_key_pem : null
| } | ||
|
|
||
| output "public_key" { | ||
| value = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key |
There was a problem hiding this comment.
Similar to the private key output, this will fail if var.enable is false but var.generate_ssh_key is true. The condition should account for the module being disabled to avoid indexing errors.
value = var.enable && var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key
Comment on lines
+904
to
+908
| variable "public_key" { | ||
| description = "Existing public key (used if generate_ssh_key = false)" | ||
| type = string | ||
| default = null | ||
| } No newline at end of file |
There was a problem hiding this comment.
The public_key variable is missing the sensitive = true attribute. This is a security regression compared to the previous definition and could lead to sensitive key data being exposed in logs or console output. Additionally, the description should be more informative.
variable "public_key" {
description = "SSH public key for authentication (e.g. ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQ). Used if generate_ssh_key is false."
type = string
default = null
sensitive = true
}
| variable "generate_ssh_key" { | ||
| description = "Generate SSH key inside module" | ||
| type = bool | ||
| default = true |
There was a problem hiding this comment.
Defaulting generate_ssh_key to true is a breaking change. Existing users who provide a public_key will find their key ignored because the logic in linux.tf prioritizes the generated key when this variable is true. It is safer to default this to false to preserve backward compatibility.
default = false
Comment on lines
+141
to
+146
| # variable "public_key" { | ||
| # type = string | ||
| # default = null | ||
| # description = "SSH public key for authentication (e.g. `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQ`)." | ||
| # sensitive = true | ||
| # } |
There was a problem hiding this comment.
Redundant commented-out code should be removed to keep the codebase clean and maintainable. The variable has been moved to the end of the file.
Comment on lines
23
to
27
| for_each = var.disable_password_authentication ? [1] : [] | ||
| content { | ||
| username = var.admin_username | ||
| public_key = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key | ||
| } |
There was a problem hiding this comment.
The indentation within the admin_ssh_key block is incorrect. It should follow the standard 2-space increment (4 spaces relative to the resource block) to match the rest of the configuration.
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key
}
| variable "allow_extension_operations" { | ||
| type = bool | ||
| default = false | ||
| default = true |
There was a problem hiding this comment.
The default value for allow_extension_operations was changed from false to true. This appears unrelated to the SSH key generation feature and changes the default behavior of the module. Please revert if this was not intended.
default = false
dverma-cd
reviewed
May 6, 2026
| source = "terraform-az-modules/key-vault/azurerm" | ||
| version = "1.0.1" | ||
| name = "core" | ||
| name = "core-ayush" |
dverma-cd
reviewed
May 6, 2026
| for_each = var.disable_password_authentication ? [1] : [] | ||
| content { | ||
| username = var.admin_username | ||
| public_key = var.generate_ssh_key ? tls_private_key.ssh_key[0].public_key_openssh : var.public_key |
Contributor
There was a problem hiding this comment.
logic is wrong .. if some passed the public_key ,it should be pass from there else it should generate it .. so need of generate_ssh_key variable. its should only depend upon public_key values
…urerm-virtual-machine into feat/add-ssh-key-generation-support
🛡️ Checkov Security Scan: 6 Issues Found🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
} |
1 similar comment
🛡️ Checkov Security Scan: 6 Issues Found🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
} |
🛡️ Checkov Security Scan: 6 Issues Found🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
} |
🛡️ Checkov Security Scan: 6 Issues Found🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_linux_virtual_machine" "default" {
count = var.is_vm_linux && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
resource_group_name = var.resource_group_name
location = var.location
size = var.vm_size
admin_username = var.admin_username
admin_password = var.disable_password_authentication ? null : var.admin_password
disable_password_authentication = var.disable_password_authentication
network_interface_ids = [azurerm_network_interface.default[0].id]
source_image_id = var.source_image_id
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
proximity_placement_group_id = var.proximity_placement_group_id
encryption_at_host_enabled = var.enable_encryption_at_host
patch_assessment_mode = var.patch_assessment_mode
patch_mode = var.linux_patch_mode
provision_vm_agent = var.provision_vm_agent
zone = var.vm_availability_zone
allow_extension_operations = var.allow_extension_operations
tags = module.labels.tags
user_data = var.user_data
dynamic "admin_ssh_key" {
for_each = var.disable_password_authentication ? [1] : []
content {
username = var.admin_username
public_key = var.public_key != null ? var.public_key : tls_private_key.ssh_key[0].public_key_openssh
}
}
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
dynamic "plan" {
for_each = var.plan_enabled ? [1] : []
content {
name = var.plan_name
publisher = var.plan_publisher
product = var.plan_product
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_112] Ensure that key vault key is backed by HSM resource "azurerm_key_vault_key" "main" {
count = var.enable && var.enable_disk_encryption_set ? 1 : 0
name = var.resource_position_prefix ? format("cmk-key-vm-%s", local.name) : format("%s-cmk-key-vm", local.name)
key_vault_id = var.key_vault_id
key_type = var.key_type
key_size = var.key_size
expiration_date = var.key_expiration_date
key_opts = var.key_opts
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
}🔴 [CKV_AZURE_50] Ensure Virtual Machine Extensions are not Installed resource "azurerm_windows_virtual_machine" "win_vm" {
count = var.is_vm_windows && var.enable ? 1 : 0
name = var.resource_position_prefix ? format("vm-%s", local.name) : format("%s-vm", local.name)
computer_name = var.computer_name != null ? var.computer_name : (var.resource_position_prefix ? format("win-vm-%s", local.name) : format("%s-win-vm", local.name))
resource_group_name = var.resource_group_name
location = var.location
network_interface_ids = [azurerm_network_interface.default[0].id]
size = var.vm_size
admin_username = var.admin_username
admin_password = var.admin_password
source_image_id = var.source_image_id
provision_vm_agent = var.provision_vm_agent
allow_extension_operations = var.allow_extension_operations
dedicated_host_id = var.dedicated_host_id
automatic_updates_enabled = var.enable_automatic_updates
license_type = var.license_type
availability_set_id = var.availability_set_enabled ? azurerm_availability_set.default[0].id : null
encryption_at_host_enabled = var.enable_encryption_at_host
proximity_placement_group_id = var.proximity_placement_group_id
patch_mode = var.windows_patch_mode
patch_assessment_mode = var.patch_assessment_mode
zone = var.vm_availability_zone
timezone = var.timezone
tags = module.labels.tags
dynamic "boot_diagnostics" {
for_each = var.boot_diagnostics_enabled ? [1] : []
content {
storage_account_uri = var.blob_endpoint
}
}
dynamic "additional_capabilities" {
for_each = var.additional_capabilities_enabled ? [1] : []
content {
ultra_ssd_enabled = var.ultra_ssd_enabled
}
}
dynamic "identity" {
for_each = var.identity_enabled ? [1] : []
content {
type = var.vm_identity_type
identity_ids = var.identity_ids
}
}
os_disk {
name = var.resource_position_prefix ? format("osdisk-%s", local.name) : format("%s-osdisk", local.name)
storage_account_type = var.os_disk_storage_account_type
caching = var.caching
disk_encryption_set_id = var.enable_disk_encryption_set ? azurerm_disk_encryption_set.main[0].id : null
disk_size_gb = var.disk_size_gb
write_accelerator_enabled = var.write_accelerator_enabled
dynamic "diff_disk_settings" {
for_each = var.diff_disk_settings == null ? [] : ["diff_disk_settings"]
content {
option = var.diff_disk_settings.option
placement = var.diff_disk_settings.placement
}
}
}
dynamic "source_image_reference" {
for_each = var.source_image_id == null && var.storage_image_reference_enabled ? [1] : []
content {
publisher = var.image_publisher
offer = var.image_offer
sku = var.image_sku
version = var.image_version
}
}
dynamic "termination_notification" {
for_each = var.termination_notification == null ? [] : ["termination_notification"]
content {
enabled = var.termination_notification.enabled
timeout = var.termination_notification.timeout
}
}
dynamic "winrm_listener" {
for_each = var.winrm_listeners
content {
protocol = winrm_listener.value.protocol
certificate_url = winrm_listener.value.certificate_url
}
}
depends_on = [
azurerm_role_assignment.azurerm_disk_encryption_set_key_vault_access
]
} |
|
💤 This PR has been automatically marked as stale because it has been inactive |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #
Closes #
Type of Change
Checklist