Front Door should have health probes configured

Medium Azure General frontdoors-front-door-health-probes

Applies to

Microsoft.Network/frontDoors

What CGPulse checks

A resource passes this rule when backendPools.hasHealthProbe must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure health probes to prevent routing traffic to unhealthy backends. In Azure Portal: Load Balancer/App Gateway > Health probes > configure probe settings. See: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

CLI

az afd origin-group list --profile-name "{name}" -g "{rg}" --query "[].healthProbeSettings" -o json

Bicep

// Health probes are configured per origin group
// TODO: Update origin group health probe settings (probePath, probeProtocol, probeIntervalInSeconds)

Terraform

# Health probes are configured per origin group in Azure Front Door
resource "azurerm_cdn_frontdoor_origin_group" "{name}" {
  name                     = "{name}-origin-group"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.{name}.id
  health_probe {
    protocol            = "Https"
    interval_in_seconds = 30
    path                = "/"
    request_type        = "HEAD"
  }
  load_balancing { }
}

Compliance frameworks

Cloud Security BaselineNS-1

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan