Azure / Azure/bicep-registry-modules
[AVM Module Issue]: Web-Site - Account Key exposure
- Dominant language
- Bicep
- Stars
- 736
- Forks
- 564
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 30
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Issue Type?
Security Bug
### Module Name
avm/res/web/site
### (Optional) Module Version
_No response_
### Description
```bicep
// avm/res/web/site/config/main.bicep
var azureWebJobsValues
? {
AzureWebJobsStorage: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount!.listKeys().keys[0].value};EndpointSuffix=${environment().suffixes.storage}'
}
```
The Storage Account Key is submitted to ARM in clear text and triggers the Defender for Cloud recommendation: Azure Resource Manager deployments should have secrets findings resolved.
Are there any plans to pass this securely, without me having to make modifications to this file and parent files?
### (Optional) Correlation Id
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.