Azure / Azure/azure-rest-api-specs

[BUG] CloudPosture pricing extension list is missing valid ApiPosture extension used for API Security Posture Management

Open Beginner friendly
#43,338 1 comment 0 reactions 0 assignees View on GitHub
bug customer-reported Mgmt question Security Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-01-01/pricings.json

### API Spec version

2024-01-01

### Describe the bug

The Microsoft.Security/pricings CloudPosture extension documentation is missing the ApiPosture extension name.

The current Extension.name description lists supported CloudPosture values such as AgentlessDiscoveryForKubernetes, SensitiveDataDiscovery, ContainerRegistriesVulnerabilityAssessments, AgentlessVmScanning, and EntraPermissionsManagement, but does not include ApiPosture.

However, ApiPosture is accepted by Azure and returned by Set-AzSecurityPricing/Get-AzSecurityPricing as a valid CloudPosture extension. It can be enabled and disabled successfully.

Impact:

Because ApiPosture is missing from the public API specification and generated Microsoft Learn documentation, documentation-driven validation tools may incorrectly classify valid PowerShell remediation commands as invalid. This creates false negatives for automation systems that rely on Microsoft Learn or generated API reference content to validate Azure remediation scripts.

### Expected behavior

The API spec should include ApiPosture in the supported values for Microsoft.Security/pricings Extension.name.

Suggested addition:

**ApiPosture** - Enables API Security Posture Management for Defender CSPM.
Available for CloudPosture plan.

### Actual behavior

ApiPosture is not listed in the supported extension names in the 2024-01-01 Microsoft.Security/pricings API spec, even though Azure accepts and returns this extension.

### Reproduction Steps

`Set-AzSecurityPricing -Name "CloudPosture" -PricingTier "Standard" -Extension '[{"name":"AgentlessVmScanning","isEnabled":true},{"name":"AgentlessDiscoveryForKubernetes","isEnabled":true},{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":true},{"name":"SensitiveDataDiscovery","isEnabled":true},{"name":"EntraPermissionsManagement","isEnabled":true},{"name":"ApiPosture","isEnabled":true}]'

Get-AzSecurityPricing -Name "CloudPosture"`

Observed Output :

`[{"name":"SensitiveDataDiscovery","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":"True","additionalExtensio
nProperties":null,"operationStatus":null},{"name":"AgentlessDiscoveryForKubernetes","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"AgentlessVmScanning","isEnabled":
"True","additionalExtensionProperties":{"ExclusionTags":"[]"},"operationStatus":null},{"name":"EntraPermissionsManagement","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"n
ame":"ApiPosture","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"AgentlessServerlessPosture","isEnabled":"True","additionalExtensionProperties":null,"operationStatu
s":null},{"name":"DatabricksSecurityPosture","isEnabled":"False","additionalExtensionProperties":null,"operationStatus":null}]`

Image

### Environment

Azure PowerShell
Command: Set-AzSecurityPricing
Resource provider: Microsoft.Security
Resource type: Microsoft.Security/pricings
Plan: CloudPosture
API version in spec: 2024-01-01

Contributor guide

Open the contributing guide

Research direction

Open the linked 2024-01-01 Microsoft.Security/pricings.json specification and inspect the CloudPosture Extension.name description. Verify the accepted ApiPosture value and its behavior against the supplied Set-AzSecurityPricing and Get-AzSecurityPricing commands. Done means the API specification describes ApiPosture with its CloudPosture availability and generated documentation reflects it.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, json, powershell
Domain
api, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.