[BUG] CloudPosture pricing extension list is missing valid ApiPosture extension used for API Security Posture Management
bugquestionSecurityService Attentioncustomer-reportedMgmt
### API Spec link
https://github.com/Azure/azure-rest-api-specs/blob/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2024-01-01/pricings.json
### API Spec version
2024-01-01
### Describe the bug
The Microsoft.Security/pricings CloudPosture extension documentation is missing the ApiPosture extension name.
The current Extension.name description lists supported CloudPosture values such as AgentlessDiscoveryForKubernetes, SensitiveDataDiscovery, ContainerRegistriesVulnerabilityAssessments, AgentlessVmScanning, and EntraPermissionsManagement, but does not include ApiPosture.
However, ApiPosture is accepted by Azure and returned by Set-AzSecurityPricing/Get-AzSecurityPricing as a valid CloudPosture extension. It can be enabled and disabled successfully.
Impact:
Because ApiPosture is missing from the public API specification and generated Microsoft Learn documentation, documentation-driven validation tools may incorrectly classify valid PowerShell remediation commands as invalid. This creates false negatives for automation systems that rely on Microsoft Learn or generated API reference content to validate Azure remediation scripts.
### Expected behavior
The API spec should include ApiPosture in the supported values for Microsoft.Security/pricings Extension.name.
Suggested addition:
**ApiPosture** - Enables API Security Posture Management for Defender CSPM.
Available for CloudPosture plan.
### Actual behavior
ApiPosture is not listed in the supported extension names in the 2024-01-01 Microsoft.Security/pricings API spec, even though Azure accepts and returns this extension.
### Reproduction Steps
`Set-AzSecurityPricing -Name "CloudPosture" -PricingTier "Standard" -Extension '[{"name":"AgentlessVmScanning","isEnabled":true},{"name":"AgentlessDiscoveryForKubernetes","isEnabled":true},{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":true},{"name":"SensitiveDataDiscovery","isEnabled":true},{"name":"EntraPermissionsManagement","isEnabled":true},{"name":"ApiPosture","isEnabled":true}]'
Get-AzSecurityPricing -Name "CloudPosture"`
Observed Output :
`[{"name":"SensitiveDataDiscovery","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":"True","additionalExtensio
nProperties":null,"operationStatus":null},{"name":"AgentlessDiscoveryForKubernetes","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"AgentlessVmScanning","isEnabled":
"True","additionalExtensionProperties":{"ExclusionTags":"[]"},"operationStatus":null},{"name":"EntraPermissionsManagement","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"n
ame":"ApiPosture","isEnabled":"True","additionalExtensionProperties":null,"operationStatus":null},{"name":"AgentlessServerlessPosture","isEnabled":"True","additionalExtensionProperties":null,"operationStatu
s":null},{"name":"DatabricksSecurityPosture","isEnabled":"False","additionalExtensionProperties":null,"operationStatus":null}]`
<img width="1869" height="550" alt="Image" src="https://github.com/user-attachments/assets/b7fc4da6-e559-4e9f-b7cf-321aaee470eb" />
### Environment
Azure PowerShell
Command: Set-AzSecurityPricing
Resource provider: Microsoft.Security
Resource type: Microsoft.Security/pricings
Plan: CloudPosture
API version in spec: 2024-01-01
0 条评论