CDN endpoint should disable HTTP and enforce HTTPS only

High Azure General endpoints-cdn-endpoint-disable-http

Applies to

Microsoft.Cdn/profiles/endpoints

What CGPulse checks

A resource passes this rule when isHttpAllowed must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable HTTP on the CDN endpoint to force all traffic over encrypted HTTPS. In Azure Portal: CDN endpoint > Origin > set HTTPS Only. See: https://learn.microsoft.com/en-us/azure/cdn/cdn-custom-ssl

CLI

az cdn endpoint update --ids "{id}" --no-http

Bicep

resource cdnProfile 'Microsoft.Cdn/profiles@2024-02-01' existing = {{
  name: '{parentName}'
}}
resource endpoint 'Microsoft.Cdn/profiles/endpoints@2024-02-01' = {{
  parent: cdnProfile
  name: '{name}'
  location: 'global'
  properties: {{
    isHttpAllowed: false
    isHttpsAllowed: true
    origins: [{{
      name: 'origin1'
      properties: {{
        hostName: '<origin-hostname>'
      }}
    }}]
  }}
}}

Terraform

resource "azurerm_cdn_endpoint" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = "global"
  profile_name        = "<cdn-profile-name>"
  is_http_allowed     = false
  is_https_allowed    = true

  origin {
    name      = "origin1"
    host_name = "<origin-hostname>"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan