[AVM Module Issue]: actionGroup displays LogicAppRecievers callbackURL in plain text.

[anderpups]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Security Bug

Module Name

avm/res/insights/action-group

(Optional) Module Version

No response

Description

The listCallbackURL parameter in LogicAppReceivers is sensitive. It contains an SAS token to trigger the Logic App.

Currently it is being displayed in plain text as an input parameter in the deployment logs.

Attached is some sample bicep to show how we are able to work around this issue with the regular resource module, but this won't work with the AVM one since the logicAppReceivers param is defined without the secure decorator.

An easy fix would be making the entire logicAppReceivers array secure, but you would lose the other params in the logs.

test.bicep.txt

actionGroupCreateModule.bicep.txt

(Optional) Correlation Id

No response

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

[avm-team-linter]

@anderpups, thanks for submitting this issue for the avm/res/insights/action-group module!

Important

A member of the @Azure/avm-res-insights-actiongroup-module-owners-bicep or @Azure/avm-res-insights-actiongroup-module-contributors-bicep team will review it soon!