From ea28ad7be81dd48021cc25110744524b2a27fd93 Mon Sep 17 00:00:00 2001 From: Steve Nolen Date: Wed, 12 Aug 2026 07:30:00 -0400 Subject: [PATCH] feat(azure): pin TLS 1.2 and HTTPS-only on state storage account The Pulumi-state storage account created at bootstrap left MinimumTLSVersion and EnableHTTPSTrafficOnly at Azure's API defaults (TLS 1.0, HTTPS not enforced), which fails customer security baselines evaluated by Azure Policy. Set both explicitly at create time: TLS 1.2 minimum and secure-transfer-only. --- lib/azure/blobstorage.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/azure/blobstorage.go b/lib/azure/blobstorage.go index 7e22208f..250c270b 100644 --- a/lib/azure/blobstorage.go +++ b/lib/azure/blobstorage.go @@ -38,6 +38,12 @@ func CreateStorageAccount(ctx context.Context, credentials *Credentials, subscri Properties: &armstorage.AccountPropertiesCreateParameters{ AllowBlobPublicAccess: to.Ptr(false), AccessTier: to.Ptr(armstorage.AccessTierCool), + // Azure defaults MinimumTLSVersion to TLS1_0 when unset; pin to TLS1_2 + // so the account meets customer security baselines (Azure Policy). + MinimumTLSVersion: to.Ptr(armstorage.MinimumTLSVersionTLS12), + // Require secure transfer (HTTPS). Set explicitly rather than relying + // on the API default. + EnableHTTPSTrafficOnly: to.Ptr(true), }, }, nil) if err != nil {