logo

Database

Terraform Missing Admin Auth Method

Description

Detects Azure Linux Virtual Machines configured without secure administrator authentication methods in Terraform configurations. This misconfiguration could allow unauthorized access to the VM if proper authentication mechanisms are not enforced.

Weakness:

015 - Insecure authentication method - Basic

Category: Protocol Manipulation

Detection Strategy

    • Identifies Terraform resource blocks of type 'azurerm_linux_virtual_machine'

    • Verifies if the VM resource lacks proper administrator authentication configuration

    • Reports a security issue when a Linux VM is defined without required authentication methods for administrator access

Vulnerable code example

resource "azurerm_linux_virtual_machine" "vulnerable" {
  name                = "example-machine"
  size                = "Standard_F2"
  admin_username      = "adminuser"  # Vulnerable: Missing password/SSH configuration creates security risk
  resource_group_name = "example-rg"
  location            = "eastus"
}

✅ Secure code example

resource "azurerm_linux_virtual_machine" "secure" {
  name                = "example-machine"
  size                = "Standard_F2"
  admin_username      = "adminuser"
  resource_group_name = "example-rg"
  location            = "eastus"

  # Secure: Configure SSH key authentication for remote access...