Storage account uses an insecure TLS version.
demos/sample1-sa/main.tf:6-16

resource "azurerm_storage_account" "example" {
  name                     = "storageaccountname"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "GRS"

  tags = {
    environment = "staging"


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/storage/use-secure-tls-policy/

Custom check failed for resource azurerm_storage_account.example. The required CostCenter tag was missing
demos/sample1-sa/main.tf:6-16

resource "azurerm_storage_account" "example" {
  name                     = "storageaccountname"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "GRS"

  tags = {
    environment = "staging"


See https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging

Custom check failed for resource azurerm_resource_group.example. The required CostCenter tag was missing
demos/sample1-sa/main.tf:1-4

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}


See https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging

Vault network ACL does not block access by default.
demos/sample2-kv/main.tf:18-46

resource "azurerm_key_vault" "example" {
  name                        = "examplekeyvault"
  location                    = azurerm_resource_group.example.location
  resource_group_name         = azurerm_resource_group.example.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  #tfsec:ignore:azure-keyvault-no-purge
  purge_protection_enabled    = false


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/keyvault/specify-network-acl/

Custom check failed for resource azurerm_resource_group.example. The required CostCenter tag was missing
demos/sample2-kv/main.tf:12-16

resource "azurerm_resource_group" "example" {
  #ts:skip=AC_AZURE_0389 Disabling for Demo
  name     = "example-resources"
  location = "West Europe"
}


See https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging

App service does not have an identity type.
demos/sample3-as/main.tf:17-37

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/appservice/account-identity-registered/

App service does not have authentication enabled.
demos/sample3-as/main.tf:17-37

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/appservice/authentication-enabled/

App service does not have HTTP/2 enabled.
demos/sample3-as/main.tf:23-26

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
  }


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/appservice/enable-http2/

App service does not have client certificates enabled.
demos/sample3-as/main.tf:17-37

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"


See https://aquasecurity.github.io/tfsec/v1.28.14/checks/azure/appservice/require-client-cert/

Custom check failed for resource azurerm_app_service.example. Using a deprecated resource - azurerm_app_service
demos/sample3-as/main.tf:17-37

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"


See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service

Custom check failed for resource azurerm_app_service.example. The required CostCenter tag was missing
demos/sample3-as/main.tf:17-37

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"


See https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging

Custom check failed for resource azurerm_resource_group.example. The required CostCenter tag was missing
demos/sample3-as/main.tf:1-4

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}


See https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-tagging