Azure instance using basic authentication

Docs > Datadog Security > Code Security > Infrastructure as Code (IaC) Security > IaC Security Rules > Azure instance using basic authentication

Metadata

Id: terraform-azure-azure-instance-using-basic-authentication

Provider: Azure

Platform: Terraform

Severity: Medium

Category: Best Practices

Learn More

Provider Reference

Description

Allowing basic password authentication for Azure virtual machines introduces a significant security risk, as passwords can be easily guessed, brute-forced, or leaked. When disable_password_authentication = false is set in the os_profile_linux_config block, as shown below, the VM permits password-based SSH logins:

os_profile_linux_config {
  disable_password_authentication = false
}

Instead, SSH key authentication should be required to ensure secure, cryptographically strong access to the instance, as in the following configuration:

admin_ssh_key {
  username   = "adminuser"
  public_key = file("~/.ssh/id_rsa.pub")
}

Failure to enforce SSH key authentication can lead to unauthorized access, data breaches, or compromise of critical resources.

Compliant Code Examples

resource "azurerm_resource_group" "main" {
  name     = "test-rg"
  location = "eastus"
}

resource "azurerm_virtual_network" "main" {
  name                = "test-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

resource "azurerm_subnet" "main" {
  name                 = "test-subnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_network_interface" "main" {
  name                = "test-nic"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.main.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "negative1" {
  name                  = "test-vm"
  location              = azurerm_resource_group.main.location
  resource_group_name   = azurerm_resource_group.main.name
  network_interface_ids = [azurerm_network_interface.main.id]
  size                  = "Standard_DS1_v2"
  admin_username        = "adminuser"

  admin_ssh_key {
    username   = "adminuser"
    public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPG0WCOikqW7R5HJe0i7lS9NLNtes99J44GlJYQRfvcKJTehk3p33c3MtvM8IZslTBi1dUjfr8kvFpOHSRL90UcvKCc8b60IFkDiKLXbM0spkFEpKqT3FjT+RzJy0zTsW+haU+Qpir2Jhd3Y5i/tnj0QuvhqaprSeDLbUAo7ii6rTFMvzlCIcqCVKwoKvurgQTGy3oPRlf8TEw68y3HIGHTB6Z8GdlIexoDuhzRFHkCA9ddZaKtYoB2aoYJFo1uHpX7eeiA+RI+o5zz3Xni+fCDoe7z3fZpx3GIAidIim1cVf03b05IjX+Flkao6j8zWNx8ib/6XZgNv28ERoQM4ih"
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "18.04-LTS"
    version   = "latest"
  }
}

resource "azurerm_virtual_machine" "negative1" {
  name                  = "${var.prefix}-vm"
  location              = azurerm_resource_group.main.location
  resource_group_name   = azurerm_resource_group.main.name
  network_interface_ids = [azurerm_network_interface.main.id]
  vm_size               = "Standard_DS1_v2"

  os_profile_linux_config {
    disable_password_authentication = true
  }

  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }
}

Non-Compliant Code Examples

resource "azurerm_virtual_machine" "positive1" {
  name                  = "${var.prefix}-vm"
  location              = azurerm_resource_group.main.location
  resource_group_name   = azurerm_resource_group.main.name
  network_interface_ids = []
  vm_size               = "Standard_DS1_v2"

  os_profile_linux_config {
    disable_password_authentication = false
  }
}

resource "azurerm_resource_group" "main" {
  name     = "test-rg"
  location = "eastus"
}

resource "azurerm_virtual_network" "main" {
  name                = "test-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

resource "azurerm_subnet" "main" {
  name                 = "test-subnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_network_interface" "main" {
  name                = "test-nic"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.main.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "positive1" {
  name                             = "test-vm"
  location                         = azurerm_resource_group.main.location
  resource_group_name              = azurerm_resource_group.main.name
  network_interface_ids            = [azurerm_network_interface.main.id]
  size                             = "Standard_DS1_v2"
  disable_password_authentication = false
  admin_username                   = "adminuser"
  admin_password                   = "P@ssw0rd1234!"

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "18.04-LTS"
    version   = "latest"
  }
}