Skip to content

Commit 8f7732d

Browse files
yagreutsimar7nikpivkin
authored
feat(misconf): Add AppService checks (#503)
* add appService checks * fix python version check * fix php check --------- Co-authored-by: simar7 <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]>
1 parent 54d51ac commit 8f7732d

20 files changed

+809
-0
lines changed

‎avd_docs/azure/appservice/AVD-AZU-0069/Terraform.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Update to a supported PHP version (8.1 or higher). Consider migrating from azurerm_app_service to azurerm_linux_web_app for access to modern PHP versions.
3+
4+
```hcl
5+
resource "azurerm_app_service" "good_example" {
6+
name = "example-app-service"
7+
location = azurerm_resource_group.example.location
8+
resource_group_name = azurerm_resource_group.example.name
9+
app_service_plan_id = azurerm_app_service_plan.example.id
10+
11+
site_config {
12+
php_version = "8.2"
13+
}
14+
}
15+
```
16+
```hcl
17+
resource "azurerm_app_service" "good_example_no_php" {
18+
name = "example-app-service"
19+
location = azurerm_resource_group.example.location
20+
resource_group_name = azurerm_resource_group.example.name
21+
app_service_plan_id = azurerm_app_service_plan.example.id
22+
23+
site_config {
24+
# No PHP version specified - not using PHP
25+
}
26+
}
27+
```
28+
29+
#### Remediation Links
30+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#php_version
31+

‎avd_docs/azure/appservice/AVD-AZU-0069/docs.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
2+
Using an unsupported PHP runtime in Azure App Service may expose applications to security vulnerabilities
3+
as these versions no longer receive security patches. This check ensures PHP versions are still supported.
4+
5+
6+
### Impact
7+
<!-- Add Impact here -->
8+
9+
<!-- DO NOT CHANGE -->
10+
{{ remediationActions }}
11+
12+
### Links
13+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#php_version
14+
15+

‎avd_docs/azure/appservice/AVD-AZU-0070/Terraform.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
2+
Update to a supported Python version (3.9 or higher). Consider migrating from azurerm_app_service to azurerm_linux_web_app for access to modern Python versions.
3+
4+
```hcl
5+
# Supported Python version (3.9 or higher)
6+
resource "azurerm_app_service" "good_example_supported" {
7+
name = "example-app-service"
8+
location = azurerm_resource_group.example.location
9+
resource_group_name = azurerm_resource_group.example.name
10+
app_service_plan_id = azurerm_app_service_plan.example.id
11+
12+
site_config {
13+
python_version = "3.9"
14+
}
15+
}
16+
```
17+
```hcl
18+
# Current stable version
19+
resource "azurerm_app_service" "good_example_current" {
20+
name = "example-app-service"
21+
location = azurerm_resource_group.example.location
22+
resource_group_name = azurerm_resource_group.example.name
23+
app_service_plan_id = azurerm_app_service_plan.example.id
24+
25+
site_config {
26+
python_version = "3.12"
27+
}
28+
}
29+
```
30+
```hcl
31+
# No Python version specified - not using Python
32+
resource "azurerm_app_service" "good_example_no_python" {
33+
name = "example-app-service"
34+
location = azurerm_resource_group.example.location
35+
resource_group_name = azurerm_resource_group.example.name
36+
app_service_plan_id = azurerm_app_service_plan.example.id
37+
38+
site_config {
39+
# No Python version specified - not using Python
40+
}
41+
}
42+
```
43+
```hcl
44+
# Modern Linux Web App with latest Python (recommended approach)
45+
resource "azurerm_linux_web_app" "good_example_modern" {
46+
name = "example-linux-webapp"
47+
location = azurerm_resource_group.example.location
48+
resource_group_name = azurerm_resource_group.example.name
49+
service_plan_id = azurerm_service_plan.example.id
50+
51+
site_config {
52+
application_stack {
53+
python_version = "3.12"
54+
}
55+
}
56+
}
57+
```
58+
59+
#### Remediation Links
60+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#python_version
61+
62+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#python_version
63+

‎avd_docs/azure/appservice/AVD-AZU-0070/docs.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
Using an unsupported Python runtime in Azure App Service may expose applications to security vulnerabilities
3+
as these versions no longer receive security patches. This check ensures Python versions are still supported by the Python Foundation.
4+
5+
6+
### Impact
7+
<!-- Add Impact here -->
8+
9+
<!-- DO NOT CHANGE -->
10+
{{ remediationActions }}
11+
12+
### Links
13+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#python_version
14+
15+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#python_version
16+
17+
- https://peps.python.org/pep-0602/
18+
19+

‎avd_docs/azure/appservice/AVD-AZU-0071/Terraform.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Set FTPS state to 'FTPS Only' in App Service settings to prevent plaintext FTP.
3+
4+
```hcl
5+
resource "azurerm_app_service" "good_example" {
6+
name = "example-app-service"
7+
location = azurerm_resource_group.example.location
8+
resource_group_name = azurerm_resource_group.example.name
9+
app_service_plan_id = azurerm_app_service_plan.example.id
10+
11+
site_config {
12+
ftps_state = "FtpsOnly"
13+
}
14+
}
15+
```
16+
```hcl
17+
resource "azurerm_app_service" "good_example_disabled" {
18+
name = "example-app-service"
19+
location = azurerm_resource_group.example.location
20+
resource_group_name = azurerm_resource_group.example.name
21+
app_service_plan_id = azurerm_app_service_plan.example.id
22+
23+
site_config {
24+
ftps_state = "Disabled"
25+
}
26+
}
27+
```
28+
29+
#### Remediation Links
30+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#ftps_state
31+

‎avd_docs/azure/appservice/AVD-AZU-0071/docs.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
2+
Allowing plain FTP risks credentials and data being transmitted unencrypted.
3+
4+
5+
### Impact
6+
<!-- Add Impact here -->
7+
8+
<!-- DO NOT CHANGE -->
9+
{{ remediationActions }}
10+
11+
### Links
12+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#ftps_state
13+
14+

‎avd_docs/azure/appservice/AVD-AZU-0072/Terraform.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
Set 'HTTPS Only' to true in App Service TLS settings to force encrypted transport.
3+
4+
```hcl
5+
resource "azurerm_app_service" "good_example" {
6+
name = "example-app-service"
7+
location = azurerm_resource_group.example.location
8+
resource_group_name = azurerm_resource_group.example.name
9+
app_service_plan_id = azurerm_app_service_plan.example.id
10+
https_only = true
11+
}
12+
```
13+
14+
#### Remediation Links
15+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only
16+

‎avd_docs/azure/appservice/AVD-AZU-0072/docs.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
2+
Allowing HTTP undermines transport encryption and exposes user data.
3+
4+
5+
### Impact
6+
<!-- Add Impact here -->
7+
8+
<!-- DO NOT CHANGE -->
9+
{{ remediationActions }}
10+
11+
### Links
12+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#https_only
13+
14+

‎checks/cloud/azure/appservice/enforce_ftps.rego‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# METADATA
2+
# title: App Service FTPS Enforce Disabled
3+
# description: |
4+
# Allowing plain FTP risks credentials and data being transmitted unencrypted.
5+
# scope: package
6+
# schemas:
7+
# - input: schema["cloud"]
8+
# related_resources:
9+
# - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#ftps_state
10+
# custom:
11+
# id: AVD-AZU-0071
12+
# avd_id: AVD-AZU-0071
13+
# provider: azure
14+
# service: appservice
15+
# severity: MEDIUM
16+
# minimum_trivy_version: 0.68.0
17+
# short_code: enforce-ftps
18+
# recommended_action: Set FTPS state to 'FTPS Only' in App Service settings to prevent plaintext FTP.
19+
# input:
20+
# selector:
21+
# - type: cloud
22+
# subtypes:
23+
# - service: appservice
24+
# provider: azure
25+
# examples: checks/cloud/azure/appservice/enforce_ftps.yaml
26+
package builtin.azure.appservice.azure0071
27+
28+
import rego.v1
29+
30+
import data.lib.cloud.metadata
31+
32+
secure_ftps_states := {"FtpsOnly", "Disabled"}
33+
34+
deny contains res if {
35+
some service in input.azure.appservice.services
36+
isManaged(service)
37+
not is_secure_ftps_state(service)
38+
res := result.new(
39+
sprintf("App service allows insecure FTP access. FTPS state is set to '%s' but should be 'FtpsOnly' or 'Disabled'", [service.site.ftpsstate.value]),
40+
metadata.obj_by_path(service, ["site", "ftpsstate"]),
41+
)
42+
}
43+
44+
is_secure_ftps_state(service) if {
45+
service.site.ftpsstate.value in secure_ftps_states
46+
}

‎checks/cloud/azure/appservice/enforce_ftps.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
terraform:
2+
links:
3+
- https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#ftps_state
4+
good:
5+
- |-
6+
resource "azurerm_app_service" "good_example" {
7+
name = "example-app-service"
8+
location = azurerm_resource_group.example.location
9+
resource_group_name = azurerm_resource_group.example.name
10+
app_service_plan_id = azurerm_app_service_plan.example.id
11+
12+
site_config {
13+
ftps_state = "FtpsOnly"
14+
}
15+
}
16+
- |-
17+
resource "azurerm_app_service" "good_example_disabled" {
18+
name = "example-app-service"
19+
location = azurerm_resource_group.example.location
20+
resource_group_name = azurerm_resource_group.example.name
21+
app_service_plan_id = azurerm_app_service_plan.example.id
22+
23+
site_config {
24+
ftps_state = "Disabled"
25+
}
26+
}
27+
bad:
28+
- |-
29+
resource "azurerm_app_service" "bad_example" {
30+
name = "example-app-service"
31+
location = azurerm_resource_group.example.location
32+
resource_group_name = azurerm_resource_group.example.name
33+
app_service_plan_id = azurerm_app_service_plan.example.id
34+
35+
site_config {
36+
ftps_state = "AllAllowed"
37+
}
38+
}
39+
- |-
40+
resource "azurerm_app_service" "bad_example_default" {
41+
name = "example-app-service"
42+
location = azurerm_resource_group.example.location
43+
resource_group_name = azurerm_resource_group.example.name
44+
app_service_plan_id = azurerm_app_service_plan.example.id
45+
46+
site_config {
47+
# No ftps_state specified - defaults to insecure
48+
}
49+
}

0 commit comments

Comments
 (0)