Description

Identifies Azure Data Factory resources configured with unrestricted public network access. This configuration could allow access from any IP address, potentially exposing the data factory to unauthorized access from the internet.

Detection Strategy

• Scans Terraform configuration files for Azure Data Factory resource definitions

• Checks if public network access is explicitly enabled or if network access restrictions are missing

• Reports a vulnerability when an Azure Data Factory is found without proper network access restrictions

Vulnerable code example

resource "azurerm_data_factory" "example" {
  name                = "example-df"
  location            = "eastus"
  resource_group_name = "example-rg"
  public_network_enabled = true  # Security risk: Exposes Data Factory to public internet access
}

✅ Secure code example

resource "azurerm_data_factory" "example" {
  name                = "example-df"
  location            = "eastus"
  resource_group_name = "example-rg"
  
  # Disable public network access for improved security
  public_network_enabled = false
  ...