Policy Packs

guardrails-samples

This section covers security recommendations for Azure App Service.

Azure CIS v2.0.0 - Section 9 - App Service

main

azure_appservice_web_app_client_cert_mode

Define the client certificate mode required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppClientCertMode

Azure > App Service > Web App > Client Certificate Mode

azure_appservice_web_app_ftps_state

Define the state of FTP/FTPS setting required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppFtpsState

Azure > App Service > Web App > FTPS State

azure_appservice_web_app_http20_enabled

Define the HTTP 2.0 setting required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppHttp20Enabled

Azure > App Service > Web App > HTTP 2.0 Enabled

azure_appservice_web_app_https_only

Define the HTTPS Only setting required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppHttpsOnly

Azure > App Service > Web App > HTTPS Only

azure_appservice_web_app_minimum_tls_version

Define the Minimum TLS Version setting required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppMinimumTlsVersion

Azure > App Service > Web App > Minimum TLS Version

azure_appservice_web_app_system_assigned_identity

Define the System Assigned Identity setting required for `Azure &gt; App Service &gt; Web App`.&#92;n

webAppSystemAssignedIdentity

Azure > App Service > Web App > System Assigned Identity

azure_appservice_webapp_approved

Determine the action to take when an Azure App Service web app is not approved based on `Azure &gt; App Service &gt; Web App &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

webAppApproved

Azure > App Service > Web App > Approved

azure_appservice_webapp_approved_custom

Determine whether the Azure App Service web app is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure App Service web app is not approved, it will be subject to the action specified in the `Azure &gt; App Service &gt; Web App &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

webAppApprovedCustom

Azure > App Service > Web App > Approved > Custom

turbot_policy_setting.azure_appservice_webapp_approved

turbot_policy_setting.azure_appservice_webapp_approved_custom

turbot_policy_setting.azure_appservice_web_app_client_cert_mode

turbot_policy_setting.azure_appservice_web_app_ftps_state

turbot_policy_setting.azure_appservice_web_app_http20_enabled

turbot_policy_setting.azure_appservice_web_app_https_only

turbot_policy_setting.azure_appservice_web_app_minimum_tls_version

turbot_policy_setting.azure_appservice_web_app_system_assigned_identity

Policy	Setting	Note
Azure > App Service > Web App > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 9.1, 9.6, 9.7 and 9.8
Azure > App Service > Web App > Approved > Custom	Calculated	Azure CIS v2.0.0 - Control: 9.1, 9.6, 9.7 and 9.8
Azure > App Service > Web App > Client Certificate Mode	Check: Require	Azure CIS v2.0.0 - Control: 9.4
Azure > App Service > Web App > FTPS State	Check: FTPS only	Azure CIS v2.0.0 - Control: 9.10
Azure > App Service > Web App > HTTP 2.0 Enabled	Check: Enabled	Azure CIS v2.0.0 - Control: 9.9
Azure > App Service > Web App > HTTPS Only	Check: Enabled	Azure CIS v2.0.0 - Control: 9.2
Azure > App Service > Web App > Minimum TLS Version	Check: TLS 1.2	Azure CIS v2.0.0 - Control: 9.3
Azure > App Service > Web App > System Assigned Identity	Check: Enabled	Azure CIS v2.0.0 - Control: 9.5

Policy Settings