For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/cloudformation-aws-directory-service-microsoft-ad-password-set-to-plaintext-or-default-ref.md. A documentation index is available at /llms.txt.

Directory service Microsoft AD password set to plaintext or default ref

This product is not supported for your selected Datadog site. ().

Metadata

Id: cloudformation-aws-directory-service-microsoft-ad-password-set-to-plaintext-or-default-ref

Provider: AWS

Platform: CloudFormation

Severity: High

Category: Secret Management

Learn More

Description

Storing Microsoft AD passwords in plaintext or as a parameter Default in CloudFormation exposes credentials to source control, template archives, and other readers. This can enable unauthorized access to the directory and lateral movement across your environment.

For resources of type AWS::DirectoryService::MicrosoftAD, Properties.Password must not be a literal string or a Ref to a Parameters.<Name> that defines a Default password.

Instead, Password should reference a secure secret (for example, an AWS Secrets Manager secret or an AWS Systems Manager Parameter Store SecureString parameter) or be supplied via a CloudFormation parameter that has no Default and uses NoEcho set to true. This rule flags Password values that are plaintext or that point to a parameter with a Default value matching a password pattern. Remove parameter defaults containing secrets and prefer Secrets Manager references or parameterized input at deployment time.

Secure examples:

MyDirectory:
  Type: AWS::DirectoryService::MicrosoftAD
  Properties:
    Name: corp.example.com
    Password: '{{resolve:secretsmanager:my-secret-id:SecretString:password}}'
    VpcSettings:
      VpcId: vpc-123456
      SubnetIds:
        - subnet-abc
        - subnet-def

Parameters:
  ADPassword:
    Type: String
    NoEcho: true

MyDirectory:
  Type: AWS::DirectoryService::MicrosoftAD
  Properties:
    Name: corp.example.com
    Password: !Ref ADPassword
    VpcSettings:
      VpcId: vpc-123456
      SubnetIds:
        - subnet-abc
        - subnet-def

Compliant Code Examples

Parameters:
  ParentMasterPassword:
    Description: 'Password'
    Type: String
    Default: ''
  ParentMasterUsername:
    Description: 'username'
    Type: String
    Default: 'username!'
Resources:
  NewAmpApp-1:
      Type: AWS::DirectoryService::MicrosoftAD
      Properties:
          CreateAlias: true
          Edition: String
          EnableSso: true
          Name: String
          Password: !Ref ParentMasterPassword
          ShortName: String


Parameters:
  ParentMasterPassword:
    Description: 'Password'
    Type: String
  ParentMasterUsername:
    Description: 'username'
    Type: String
    Default: 'username'
Resources:
  NewAmpApp-1:
    Type: AWS::DirectoryService::MicrosoftAD
    Properties:
      CreateAlias: true
      Edition: String
      EnableSso: true
      Name: String
      Password: !Ref ParentMasterPassword
      ShortName: String


Resources:
    NewAmpApp-2:
        Type: AWS::DirectoryService::MicrosoftAD
        Properties:
            CreateAlias: true
            Edition: String
            EnableSso: true
            Name: String
            Password:  !Sub '{{resolve:secretsmanager:${MyAmpAppSecretManagerRotater}::password}}'
            ShortName: String
    MyAmpAppSecretManagerRotater:
        Type: AWS::SecretsManager::Secret
        Properties:
          Description: 'This is my amp app instance secret'
          GenerateSecretString:
            SecretStringTemplate: '{"username": "admin"}'
            GenerateStringKey: 'password'
            PasswordLength: 16
            ExcludeCharacters: '"@/\'

Non-Compliant Code Examples

Parameters:
  ParentMasterUsername:
    Description: 'username'
    Type: String
    Default: 'username!'
Resources:
  NewAmpApp-2:
      Type: AWS::DirectoryService::MicrosoftAD
      Properties:
          CreateAlias: true
          Edition: String
          EnableSso: true
          Name: String
          Password: 'asDjskjs73!!'
          ShortName: String

Resources:
  NewAmpApp:
      Type: AWS::DirectoryService::MicrosoftAD
      Properties:
          CreateAlias: true
          Edition: String
          EnableSso: true
          Name: String
          Password: 'asDjskjs73!!'
          ShortName: String

Parameters:
  ParentMasterPassword:
    Description: 'Password'
    Type: String
    Default: 'asDjskjs73!'
  ParentMasterUsername:
    Description: 'username'
    Type: String
    Default: 'username!'
Resources:
  NewAmpApp-1:
      Type: AWS::DirectoryService::MicrosoftAD
      Properties:
          CreateAlias: true
          EnableSso: true
          Edition: String
          Name: String
          Password: !Ref ParentMasterPassword
          ShortName: String