Skip to content

Checkov Resolve Plan

Generated: 2026-05-09 Run: https://github.com/SvenRelijveld1995/portfolio/actions/runs/25600968186 Summary: Passed 15 | Failed 11 | Skipped 0 | Parse errors 4

Fixed (in this PR)

CKV_AZURE_41 — Ensure that the expiration date is set on all secrets

  • Resources affected:
  • database_url_secret in infra/modules/postgres.bicep:133-140
  • email_address_secret in infra/modules/key_vault.bicep:74-81
  • email_password_secret in infra/modules/key_vault.bicep:83-90
  • entra_client_secret_secret in infra/modules/key_vault.bicep:92-99
  • api_admin_token_secret in infra/modules/key_vault.bicep:104-111
  • Fix applied: Added attributes: { exp: dateTimeToEpoch(dateTimeAdd(utcNow(), 'P2Y')) } to all secrets (2-year rolling expiry, re-set on each deploy).

False Positives (parse errors — no action needed)

Checkov cannot fully parse these files due to unsupported Bicep syntax (conditions, loops, existing references). Checks reported against resources inside these files are unreliable:

  • infra/modules/container_apps.bicep — conditional resources, for-loops
  • infra/main.bicep — module chaining, conditional deployments
  • infra/modules/app_configuration_rbac.bicep — likely existing resource reference
  • infra/modules/entra_app.bicep — complex object expressions

This includes CKV_AZURE_114 reported on entra_client_secret_secret — the contentType property is present in the source; the check fired because checkov misparsed the if (!empty(...)) conditional resource syntax.

KV soft-delete / purge protection checks (CKV_AZURE_111, CKV_AZURE_42, CKV_AZURE_110) also fire as SARIF annotations on key_vault.bicep:50-69 — those properties are already set correctly in the Bicep; these are checkov annotation noise, not real failures.

Skipped via .checkov.yaml

Check Resource Reason
CKV_AZURE_139 ACR Public networking required — Container Apps pulls images directly from ACR; private endpoint not warranted for a portfolio
CKV_AZURE_163 ACR Vulnerability scanning requires Defender for Containers (~€15/mo) — not cost-justified
CKV_AZURE_166 ACR Image quarantine requires Defender for Containers — same as above
CKV_AZURE_189 Key Vault Public network access must remain enabled — GitHub Actions writes secrets post-deploy from dynamic runner IPs
CKV_AZURE_109 Key Vault Firewall rules would require maintaining a GitHub Actions IP allowlist that changes frequently

Next Run Expected Result

After this PR merges: Passed ~20 | Failed 0 | Skipped 5 | Parse errors 4

The 4 parse errors are a checkov limitation with advanced Bicep syntax — not actionable without upstream checkov fixes.