Service Bus queue should enable dead-lettering on message expiration

Medium Azure General queues-service-bus-queue-enable

Applies to

Microsoft.ServiceBus/namespaces/queues

What CGPulse checks

A resource passes this rule when deadLetteringOnMessageExpiration must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable dead-lettering on message expiration to capture expired messages and prevent silent data loss. In Azure Portal: Service Bus > Queues > select queue > enable Dead lettering. See: https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-dead-letter-queues

CLI

az servicebus queue update --ids "{id}" --enable-dead-lettering-on-message-expiration true

Bicep

resource queue 'Microsoft.ServiceBus/namespaces/queues@2024-01-01' = {
  name: '<queue-name>'
  parent: serviceBusNamespace
  properties: {
    deadLetteringOnMessageExpiration: true
  }
}

Terraform

resource "azurerm_servicebus_queue" "{name}" {
  name                                 = "<queue-name>"
  namespace_id                         = azurerm_servicebus_namespace.{name}.id
  dead_lettering_on_message_expiration = true
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan