Repository navigation

IaC Scanning with Checkmarx KICS

Add DevSecOps-10309 demo page with intentional vulnerabilities for GHAS scanning #292

Sign in to view logs

Triggered via pull request October 8, 2026 11:36

CalinL

synchronize #143

copilot/featuredevsecops-demo-12345-yet-again

Status Success

Total duration 56s

Artifacts –

IACS-Checkmarx-kics.yml

on: pull_request

Annotations

10 warnings and 1 notice

[MEDIUM] App Service Authentication Disabled: terraform/azure/app_service.tf#L12

Azure App Service authentication settings should be enabled

[MEDIUM] App Service Authentication Disabled: terraform/azure/app_service.tf#L31

Azure App Service authentication settings should be enabled

[MEDIUM] AKS RBAC Disabled: terraform/azure/aks.tf#L23

Azure Container Service (AKS) instance should have role-based access control (RBAC) enabled

[MEDIUM] AKS Private Cluster Disabled: terraform/azure/aks.tf#L1

Azure Kubernetes Service (AKS) API should not be exposed to the internet

[MEDIUM] AD Admin Not Configured For SQL Server: terraform/azure/sql.tf#L9

The Active Directory Administrator is not configured for a SQL server

[HIGH] RDP Is Exposed To The Internet: terraform/azure/networking.tf#L64

Port 3389 (Remote Desktop) is exposed to the internet

[HIGH] Passwords And Secrets - Generic Password: terraform/azure/sql.tf#L15

Query to find passwords and secrets in infrastructure code.

[HIGH] Passwords And Secrets - Generic Password: terraform/azure/sql.tf#L64

Query to find passwords and secrets in infrastructure code.

[HIGH] MySQL Server Public Access Enabled: terraform/azure/sql.tf#L50

MySQL Server public access should be disabled

[HIGH] Default Azure Storage Account Network Access Is Too Permissive: terraform/azure/storage.tf#L13

Default Azure Storage Account network access should be set to Deny

Run KICS scan

"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"