Front Door should have Web Application Firewall enabled

Critical Azure General frontdoors-front-door-web-application

Applies to

Microsoft.Network/frontDoors

What CGPulse checks

A resource passes this rule when webApplicationFirewallPolicyLink must be set. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Create and associate a WAF policy to block common web exploits like SQL injection and XSS. In Azure Portal: WAF policies > Create > associate with frontend resource. See: https://learn.microsoft.com/en-us/azure/web-application-firewall/overview

CLI

az afd waf-policy list -g "{rg}" -o table

Bicep

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2024-02-01' = {{
  name: '{name}-waf'
  location: 'global'
  sku: {{ name: 'Premium_AzureFrontDoor' }}
  properties: {{
    policySettings: {{
      enabledState: 'Enabled'
      mode: 'Prevention'
    }}
  }}
}}

Terraform

resource "azurerm_cdn_frontdoor_firewall_policy" "{name}" {
  name                = "{name}waf"
  resource_group_name = "{rg}"
  sku_name            = "Premium_AzureFrontDoor"
  enabled             = true
  mode                = "Prevention"
}
resource "azurerm_cdn_frontdoor_security_policy" "{name}" {
  name                     = "{name}-security"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.{name}.id
  security_policies {
    firewall {
      cdn_frontdoor_firewall_policy_id = azurerm_cdn_frontdoor_firewall_policy.{name}.id
      association {
        patterns_to_match = ["/*"]
        domain { cdn_frontdoor_domain_id = "<domain-id>" }
      }
    }
  }
}

Compliance frameworks

Cloud Security BaselineNS-6

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan