Description

Detects when Azure resources are configured without client certificate authentication enabled in Terraform configurations. Missing client certificate authentication can allow unauthorized access to Azure resources since an important authentication mechanism is disabled.

Detection Strategy

• Inspect Terraform resource blocks that configure Azure services

• Check if client_certificate_enabled or similar certificate authentication settings are present and enabled

• Report a vulnerability if the certificate authentication settings are disabled or missing

• Only examine Azure-specific resource types that support client certificate authentication

Vulnerable code example

# Vulnerable: client_certificate_enabled not set (defaults to false)
resource "azurerm_linux_web_app" "vulnerable" {
  name                = "example-app-service"
  service_plan_id     = "plan_id"
  location            = "eastus"
  resource_group_name = "example-rg"
  https_only         = true
...

✅ Secure code example

resource "azurerm_linux_web_app" "secure" {
  name                = "example-app-service"
  service_plan_id     = "plan_id"
  location            = "eastus"
  resource_group_name = "example-rg"
  https_only          = true
  client_certificate_enabled = true  # Enable client certificate authentication for secure access
...