rules:
- id: appservice-account-identity-registered
  message: >-
    Registering the identity used by an App with AD allows it to interact with other services without
    using username and password.
    Set the `identity` block in your appservice.
  patterns:
  - pattern: resource
  - pattern-not-inside: |
      resource "azurerm_app_service" "..." {
      ...
        identity {
          type = "..."
          identity_ids = "..."
        }
      ...
      }
  - pattern-not-inside: |
      resource "azurerm_app_service" "..." {
      ...
        identity {
          type = "SystemAssigned"
        }
      ...
      }
  - pattern-inside: |
      resource "azurerm_app_service" "..." {
      ...
      }
  metadata:
    category: security
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-287: Improper Authentication'
    technology:
    - terraform
    - azure
    references:
    - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#identity
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages: [hcl]
  severity: INFO