Azure / Azure/bicep-registry-modules

[AVM Module Issue]: Web-Site - Account Key exposure

Open
#6,504 12 comments 1 reaction 3 assignees Claimed by @tsc-buddy View on GitHub
Class: Resource Module :package: Status: Long Term :hourglass_flowing_sand: Status: Won't Fix :broken_heart: Type: AVM :a: :v: :m: Type: Security Bug :lock:
Dominant language
Bicep
Stars
736
Forks
564
Avg merge
3d 15h
Merged PRs (30d)
30

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Security Bug

### Module Name

avm/res/web/site

### (Optional) Module Version

_No response_

### Description
```bicep
// avm/res/web/site/config/main.bicep

var azureWebJobsValues

? {
AzureWebJobsStorage: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount!.listKeys().keys[0].value};EndpointSuffix=${environment().suffixes.storage}'
}
```

The Storage Account Key is submitted to ARM in clear text and triggers the Defender for Cloud recommendation: Azure Resource Manager deployments should have secrets findings resolved.

Are there any plans to pass this securely, without me having to make modifications to this file and parent files?

### (Optional) Correlation Id

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.