Metadata

Id: 9db38e87-f6aa-4b5e-a1ec-7266df259409

Cloud Provider: azure

Framework: Terraform

Severity: Medium

Category: Observability

Learn More

• Provider Reference

Description

Azure Security Center contact alert notifications should be enabled to ensure that designated security contacts receive email alerts about security issues or threats in your Azure environment. If the alert_notifications attribute is set to false, such as shown below, critical security incidents could go unnoticed, increasing the risk of delayed response to threats.

resource "azurerm_security_center_contact" "example" {
    email = "contact@example.com"
    phone = "+1-555-555-5555"
    alert_notifications = false
}

Setting alert_notifications = true ensures timely awareness and response to potential security incidents.

Compliant Code Examples

resource "azurerm_security_center_contact" "negative1" {
    email = "contact@example.com"
    phone = "+1-555-555-5555"
    alert_notifications = true
}

Non-Compliant Code Examples

resource "azurerm_security_center_contact" "positive1" {
    email = "contact@example.com"
    phone = "+1-555-555-5555"
   alert_notifications = false
}