@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/lint/post-synth/arm-refs.js

@@ -0,0 +1,96 @@
+/**
+ * Shared utility for extracting ARM template resource references
+ * from template properties.
+ *
+ * Used by AZR010 (redundant DependsOn) and other post-synth checks.
+ *
+ * ARM templates use bracket expressions like [resourceId(...)],
+ * [reference(...)], and [concat(...)] to reference other resources.
+ */
+/**
+ * Parse a serialized ARM template from build output.
+ * Accepts either a raw string or a SerializerResult (extracts primary).
+ */
+export function parseArmTemplate(output) {
+    const raw = typeof output === "string" ? output : output.primary;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON
+    }
+    return null;
+}
+/**
+ * Extract resource names referenced via bracket expressions in a value.
+ *
+ * Parses ARM bracket expressions like:
+ * - [resourceId('Microsoft.Storage/storageAccounts', 'myStorage')]
+ * - [reference('myStorage')]
+ * - [reference('myStorage').primaryEndpoints.blob]
+ *
+ * Returns the set of resource names found in these references.
+ */
+export function findArmResourceRefs(value) {
+    const refs = new Set();
+    walkArmValue(value, refs);
+    return refs;
+}
+/**
+ * Check if a string value is an ARM bracket expression.
+ */
+export function isBracketExpression(value) {
+    return typeof value === "string" && value.startsWith("[") && value.endsWith("]");
+}
+/**
+ * Extract resource names from an ARM bracket expression string.
+ *
+ * Handles:
+ * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
+ * - [reference('name')]           -> extracts 'name'
+ * - [reference('name').prop]      -> extracts 'name'
+ */
+export function extractRefsFromExpression(expr) {
+    const refs = [];
+    // Match resourceId('Type', 'name', ...): the name is every quoted argument
+    // after the type, joined with "/" for a child resource ('vnet', 'subnet').
+    const resourceIdPattern = /resourceId\s*\(\s*'[^']+'((?:\s*,\s*'[^']+')+)\s*\)/g;
+    let match;
+    while ((match = resourceIdPattern.exec(expr)) !== null) {
+        refs.push([...match[1].matchAll(/'([^']+)'/g)].map((m) => m[1]).join("/"));
+    }
+    // Match reference('name') — extract the name
+    const referencePattern = /reference\s*\(\s*'([^']+)'\s*\)/g;
+    while ((match = referencePattern.exec(expr)) !== null) {
+        refs.push(match[1]);
+    }
+    return refs;
+}
+function walkArmValue(value, refs) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value === "string") {
+        if (isBracketExpression(value)) {
+            for (const ref of extractRefsFromExpression(value)) {
+                refs.add(ref);
+            }
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            walkArmValue(item, refs);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        const obj = value;
+        for (const val of Object.values(obj)) {
+            walkArmValue(val, refs);
+        }
+    }
+}

package/dist/lint/post-synth/azr010.js

@@ -0,0 +1,45 @@
+/**
+ * AZR010: Redundant DependsOn
+ *
+ * Detects dependsOn entries that are already implied by reference() or
+ * resourceId() bracket expressions in the resource's properties. ARM
+ * automatically creates dependencies for these references, making
+ * explicit dependsOn redundant.
+ */
+import { parseArmTemplate, findArmResourceRefs, extractRefsFromExpression } from "./arm-refs.js";
+export const azr010 = {
+    id: "AZR010",
+    description: "Redundant dependsOn — target is already referenced via reference() or resourceId() in properties",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (!resource.dependsOn || resource.dependsOn.length === 0)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                // Find all refs in properties
+                const propertyRefs = findArmResourceRefs(resource.properties);
+                for (const dep of resource.dependsOn) {
+                    // dependsOn entries may be bracket expressions like [resourceId('Type', 'name')]
+                    // or plain resource names
+                    const depNames = dep.startsWith("[") ? extractRefsFromExpression(dep) : [dep];
+                    for (const depName of depNames) {
+                        if (propertyRefs.has(depName)) {
+                            diagnostics.push({
+                                checkId: "AZR010",
+                                severity: "warning",
+                                message: `Resource "${resourceName}" has redundant dependsOn "${depName}" — already referenced in properties`,
+                                entity: resourceName,
+                                lexicon: "azure",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr011.js

@@ -0,0 +1,43 @@
+/**
+ * AZR011: Missing or Invalid API Version
+ *
+ * Checks that every ARM resource has a valid apiVersion field.
+ * The apiVersion must be a non-empty string matching the date format
+ * YYYY-MM-DD (optionally with a suffix like -preview).
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const API_VERSION_PATTERN = /^\d{4}-\d{2}-\d{2}(-preview|-privatepreview)?$/;
+export const azr011 = {
+    id: "AZR011",
+    description: "Missing or invalid apiVersion — every ARM resource must have a valid apiVersion in YYYY-MM-DD format",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                if (!resource.apiVersion) {
+                    diagnostics.push({
+                        checkId: "AZR011",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${resource.type}) is missing apiVersion`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+                else if (typeof resource.apiVersion !== "string" || !API_VERSION_PATTERN.test(resource.apiVersion)) {
+                    diagnostics.push({
+                        checkId: "AZR011",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${resource.type}) has invalid apiVersion "${resource.apiVersion}" — expected YYYY-MM-DD format`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr012.js

@@ -0,0 +1,41 @@
+/**
+ * AZR012: Deprecated API Version
+ *
+ * Warns when a resource uses an apiVersion older than 2023-01-01.
+ * Older API versions may lack features, security patches, and
+ * could be deprecated by Azure.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const MINIMUM_API_DATE = "2023-01-01";
+export const azr012 = {
+    id: "AZR012",
+    description: "Deprecated API version — apiVersion older than 2023 may lack features and security patches",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                if (typeof resource.apiVersion !== "string")
+                    continue;
+                // Extract the date portion (YYYY-MM-DD) ignoring any suffix like -preview
+                const dateMatch = resource.apiVersion.match(/^(\d{4}-\d{2}-\d{2})/);
+                if (!dateMatch)
+                    continue;
+                const apiDate = dateMatch[1];
+                if (apiDate < MINIMUM_API_DATE) {
+                    diagnostics.push({
+                        checkId: "AZR012",
+                        severity: "warning",
+                        message: `Resource "${resourceName}" (${resource.type}) uses outdated apiVersion "${resource.apiVersion}" — consider updating to a version from 2023 or later`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr013.js

@@ -0,0 +1,50 @@
+/**
+ * AZR013: Resource Missing Location
+ *
+ * Warns when an ARM resource does not have a location property.
+ * Most Azure resources require a location. Resources that are
+ * inherently global (e.g., Microsoft.Resources/deployments) are excluded.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+/**
+ * Resource types that do not require a location property.
+ * These are global or subscription-level resources.
+ */
+const LOCATION_EXEMPT_TYPES = new Set([
+    "Microsoft.Resources/deployments",
+    "Microsoft.Authorization/roleAssignments",
+    "Microsoft.Authorization/roleDefinitions",
+    "Microsoft.Authorization/policyAssignments",
+    "Microsoft.Authorization/policyDefinitions",
+    "Microsoft.Authorization/locks",
+    "Microsoft.Management/managementGroups",
+    "Microsoft.Subscription/aliases",
+]);
+export const azr013 = {
+    id: "AZR013",
+    description: "Resource missing location — most Azure resources require a location property",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                // Skip resource types that don't need location
+                if (LOCATION_EXEMPT_TYPES.has(resource.type))
+                    continue;
+                if (resource.location === undefined || resource.location === null || resource.location === "") {
+                    diagnostics.push({
+                        checkId: "AZR013",
+                        severity: "warning",
+                        message: `Resource "${resourceName}" (${resource.type}) is missing a location property`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr014.js

@@ -0,0 +1,49 @@
+/**
+ * AZR014: Public Blob Access Enabled
+ *
+ * Warns when a Storage Account has allowBlobPublicAccess set to true
+ * or when the property is missing (defaults to true in older API versions).
+ * Public blob access can expose data to the internet.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const STORAGE_ACCOUNT_TYPE = "Microsoft.Storage/storageAccounts";
+export const azr014 = {
+    id: "AZR014",
+    description: "Public blob access enabled on storage account — disable allowBlobPublicAccess to prevent public data exposure",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== STORAGE_ACCOUNT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                // allowBlobPublicAccess defaults to true in older API versions
+                // It should be explicitly set to false
+                const allowBlobPublicAccess = props.allowBlobPublicAccess;
+                if (allowBlobPublicAccess === true) {
+                    diagnostics.push({
+                        checkId: "AZR014",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has allowBlobPublicAccess set to true — disable public blob access`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+                else if (allowBlobPublicAccess === undefined) {
+                    diagnostics.push({
+                        checkId: "AZR014",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" does not set allowBlobPublicAccess — explicitly set to false to prevent public access`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr015.js

@@ -0,0 +1,66 @@
+/**
+ * AZR015: Missing Encryption on Storage Account
+ *
+ * Warns when a Storage Account does not have encryption configured.
+ * Storage accounts should have encryption services enabled for blob,
+ * file, table, and queue to protect data at rest.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const STORAGE_ACCOUNT_TYPE = "Microsoft.Storage/storageAccounts";
+export const azr015 = {
+    id: "AZR015",
+    description: "Missing encryption on storage account — enable encryption services to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== STORAGE_ACCOUNT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const encryption = props.encryption;
+                if (!encryption) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has no encryption configuration — enable encryption services for blob, file, table, and queue`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                    continue;
+                }
+                // Check that encryption services are defined
+                const services = encryption.services;
+                if (!services) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has encryption configured but no encryption services specified — enable blob, file, table, and queue encryption`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                    continue;
+                }
+                // Check for blob and file at minimum
+                const missingServices = [];
+                if (!services.blob)
+                    missingServices.push("blob");
+                if (!services.file)
+                    missingServices.push("file");
+                if (missingServices.length > 0) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" is missing encryption for: ${missingServices.join(", ")}`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr016.js

@@ -0,0 +1,37 @@
+/**
+ * AZR016: Key Vault soft-delete not enabled
+ *
+ * Warns when a Key Vault does not have soft-delete enabled.
+ * Soft delete is required to protect against accidental deletion
+ * of keys, secrets, and certificates.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const KEY_VAULT_TYPE = "Microsoft.KeyVault/vaults";
+export const azr016 = {
+    id: "AZR016",
+    description: "Key Vault soft-delete not enabled — enable to protect against accidental deletion",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== KEY_VAULT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enableSoftDelete !== true) {
+                    diagnostics.push({
+                        checkId: "AZR016",
+                        severity: "warning",
+                        message: `Key Vault "${resourceName}" does not have soft-delete enabled — set enableSoftDelete to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr017.js

@@ -0,0 +1,37 @@
+/**
+ * AZR017: Key Vault purge protection not enabled
+ *
+ * Warns when a Key Vault does not have purge protection enabled.
+ * Purge protection prevents permanent deletion of soft-deleted vaults
+ * and vault objects during the retention period.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const KEY_VAULT_TYPE = "Microsoft.KeyVault/vaults";
+export const azr017 = {
+    id: "AZR017",
+    description: "Key Vault purge protection not enabled — enable to prevent permanent deletion during retention period",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== KEY_VAULT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enablePurgeProtection !== true) {
+                    diagnostics.push({
+                        checkId: "AZR017",
+                        severity: "warning",
+                        message: `Key Vault "${resourceName}" does not have purge protection enabled — set enablePurgeProtection to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr018.js

@@ -0,0 +1,42 @@
+/**
+ * AZR018: SQL Server missing auditing
+ *
+ * Warns when a SQL Server does not have auditing configured.
+ * Azure SQL auditing tracks database events and writes them
+ * to an audit log, helping meet compliance requirements.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const SQL_SERVER_TYPE = "Microsoft.Sql/servers";
+const AUDIT_TYPE = "Microsoft.Sql/servers/auditingSettings";
+export const azr018 = {
+    id: "AZR018",
+    description: "SQL Server missing auditing — enable auditing for compliance and threat detection",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const sqlServers = template.resources.filter((r) => r.type === SQL_SERVER_TYPE);
+            const auditSettings = template.resources.filter((r) => r.type === AUDIT_TYPE);
+            for (const server of sqlServers) {
+                const serverName = typeof server.name === "string" ? server.name : String(server.name);
+                // Check for a matching auditing settings resource
+                const hasAudit = auditSettings.some((a) => {
+                    const auditName = typeof a.name === "string" ? a.name : String(a.name);
+                    return auditName.startsWith(`${serverName}/`);
+                });
+                if (!hasAudit) {
+                    diagnostics.push({
+                        checkId: "AZR018",
+                        severity: "warning",
+                        message: `SQL Server "${serverName}" does not have auditing configured — add a Microsoft.Sql/servers/auditingSettings resource`,
+                        entity: serverName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr019.js

@@ -0,0 +1,41 @@
+/**
+ * AZR019: SQL Server missing Transparent Data Encryption (TDE)
+ *
+ * Warns when a SQL Server database does not have TDE configured.
+ * TDE provides encryption at rest for the entire database, backups,
+ * and transaction log files.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const SQL_DB_TYPE = "Microsoft.Sql/servers/databases";
+const TDE_TYPE = "Microsoft.Sql/servers/databases/transparentDataEncryption";
+export const azr019 = {
+    id: "AZR019",
+    description: "SQL Server database missing TDE — enable Transparent Data Encryption to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const databases = template.resources.filter((r) => r.type === SQL_DB_TYPE);
+            const tdeSettings = template.resources.filter((r) => r.type === TDE_TYPE);
+            for (const db of databases) {
+                const dbName = typeof db.name === "string" ? db.name : String(db.name);
+                const hasTde = tdeSettings.some((t) => {
+                    const tdeName = typeof t.name === "string" ? t.name : String(t.name);
+                    return tdeName.startsWith(`${dbName}/`);
+                });
+                if (!hasTde) {
+                    diagnostics.push({
+                        checkId: "AZR019",
+                        severity: "warning",
+                        message: `SQL database "${dbName}" does not have TDE configured — add transparentDataEncryption resource`,
+                        entity: dbName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr020.js

@@ -0,0 +1,37 @@
+/**
+ * AZR020: App Service missing managed identity
+ *
+ * Warns when a Web App does not have a managed identity configured.
+ * Managed identity eliminates the need for credentials in code
+ * and enables secure access to Azure services.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr020 = {
+    id: "AZR020",
+    description: "App Service missing managed identity — enable SystemAssigned or UserAssigned identity",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const identity = resource.identity;
+                if (!identity || !identity.type) {
+                    diagnostics.push({
+                        checkId: "AZR020",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not have managed identity configured — set identity.type to "SystemAssigned" or "UserAssigned"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr021.js

@@ -0,0 +1,36 @@
+/**
+ * AZR021: App Service missing HTTPS-only
+ *
+ * Warns when a Web App does not enforce HTTPS-only traffic.
+ * HTTP traffic can be intercepted and exposes sensitive data.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr021 = {
+    id: "AZR021",
+    description: "App Service missing HTTPS-only — set httpsOnly to true to enforce encrypted traffic",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.httpsOnly !== true) {
+                    diagnostics.push({
+                        checkId: "AZR021",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not enforce HTTPS-only — set httpsOnly to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr022.js

@@ -0,0 +1,39 @@
+/**
+ * AZR022: App Service missing minimum TLS 1.2
+ *
+ * Warns when a Web App does not enforce a minimum TLS version of 1.2.
+ * Older TLS versions (1.0, 1.1) have known vulnerabilities and should
+ * not be used.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr022 = {
+    id: "AZR022",
+    description: "App Service missing minimum TLS 1.2 — set minTlsVersion in siteConfig to enforce TLS 1.2+",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const siteConfig = props.siteConfig;
+                const minTlsVersion = siteConfig?.minTlsVersion;
+                if (minTlsVersion !== "1.2" && minTlsVersion !== "1.3") {
+                    diagnostics.push({
+                        checkId: "AZR022",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not enforce minimum TLS 1.2 — set siteConfig.minTlsVersion to "1.2"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};