Container App ingress should not be externally accessible unless required

Medium Azure General containerapps-container-app-ingress-externally

Applies to

Microsoft.App/containerApps

What CGPulse checks

A resource passes this rule when ingress.external must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set ingress to internal-only unless the app requires public access, reducing the attack surface. In Azure Portal: Container App > Ingress > set Ingress traffic to Limited to VNet. See: https://learn.microsoft.com/en-us/azure/container-apps/ingress-overview

CLI

az containerapp ingress update --ids "{id}" --type internal

Terraform

resource "azurerm_container_app" "{name}" {
  name                         = "{name}"
  resource_group_name          = "{rg}"
  container_app_environment_id = "<environment-id>"
  revision_mode                = "Single"

  ingress {
    external_enabled = false
    target_port      = 80
    transport        = "auto"

    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }

  template {
    container {
      name   = "app"
      image  = "<image>"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan