[AVM Module Issue]:

[RT235]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Security Bug

Module Name

avm/res/web/site

(Optional) Module Version

No response

Description

avm/res/web/site/config/main.bicep

var azureWebJobsValues
...
? {
AzureWebJobsStorage: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${storageAccount!.listKeys().keys[0].value};EndpointSuffix=${environment().suffixes.storage}'
}
...

The Storage Account Key is submitted to ARM in clear text and triggers the Defender for Cloud recommendation: Azure Resource Manager deployments should have secrets findings resolved.

Are there any plans to pass this securely, without me having to make modifications to this file and parent files?

(Optional) Correlation Id

No response

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

[avm-organizer]

@RT235, thanks for submitting this issue for the avm/res/web/site module!

Important

A member of the @Azure/avm-res-web-site-module-owners-bicep team will review it soon!