HDInsight cluster should enforce TLS 1.2+

High Azure General clusters-min-tls

Applies to

Microsoft.HDInsight/clusters

What CGPulse checks

A resource passes this rule when minSupportedTlsVersion must be one of ["1.2","1.3"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set minimum TLS version to 1.2 to prevent protocol downgrade attacks. In Azure Portal: Resource > Settings > set Minimum TLS version to 1.2. See: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview

CLI

az hdinsight update --ids "{id}" --minimal-tls-version 1.2

Bicep

// Minimum TLS version must be set at creation time
resource hdinsight 'Microsoft.HDInsight/clusters@2024-08-01-preview' = {{
  name: '{name}'
  location: resourceGroup().location
  properties: {{
    minSupportedTlsVersion: '1.2'
    clusterDefinition: {{
      kind: 'Spark'
    }}
  }}
}}

Terraform

resource "azurerm_hdinsight_spark_cluster" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  cluster_version     = "5.1"
  tier                = "Standard"
  tls_min_version     = "1.2"
  component_version {
    spark = "3.3"
  }
  roles {
    head_node {
      vm_size  = "Standard_D12_v2"
      username = "admin"
    }
    worker_node {
      vm_size               = "Standard_D12_v2"
      username              = "admin"
      target_instance_count = 3
    }
  }
  gateway {
    username = "admin"
    password = "<password>"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan