Does developer access to ARM Templates prevent PCI compliance?

Question

I would like my company to use ARM templates deployed by a VSTS Release Pipeline to allow developers to define resources that will be deployed to a subscription owned by our OPs team at our company to ensure that developers don't have production access to these resources per PCI DSS 6.4.2.

However, it has come to our attention that the "Microsoft.SQL/server" template allows the administrator's username and password to be set as well as the firewall settings. This would allow a developer to hard-code a password and open a port allowing them to directly access any SQL Server.

    {
        "name": "creditcardinfo",
        "type": "Microsoft.Sql/servers",
        "apiVersion": "2014-04-01",
        "location": "[resourceGroup().location]",
        "properties": {
            "administratorLogin": "maliciousDev",
            "administratorLoginPassword": "HardCodedPassword",
            "version": "12.0"
        }
    }

We could add a script to our VSTS Pipeline blacklisting the setting of this property, but there's now a concern that there may be other ways a developer could access production resources through other ARM Templates.

Is there a way developers can use ARM templates with confidence that access can't be granted using these templates for any Azure Resources or will we have to come up with an alternate solution?

score 0 · Answer 1 · answered Jun 29 '17 at 14:57

0

Just create a separate repo for those and you're good.

And there's no "defence" from someone editing the ARM Template. There are endless possibilities to edit the template to get access to resources.

answered Jun 29 '17 at 14:57

4c74356b41

69,186
6
100
141

Just to clarify, are you suggesting that the ARM templates reside in a repo where OPs owns "master". devs can submit PRs to them to get them updated which gives OPs an opportunity to verify that a dev didn't hardcode a password or something else malicious (or just stupid)? – jt000 Jun 29 '17 at 15:30
yeah, why not? pretty common practice – 4c74356b41 Jun 29 '17 at 19:17
That is going to make for a fun VSTS pipeline. – CtrlDot Jun 29 '17 at 19:19
@4c74356b41 - No reason, why not... Just seemed too simple :) – jt000 Jun 30 '17 at 18:49
@CtrlDot - Do you have an alternate suggestion? – jt000 Jul 05 '17 at 13:42

Does developer access to ARM Templates prevent PCI compliance?

1 Answers1