Public IP address should have DDoS protection

High Azure General publicip-ddos-protection

Applies to

Microsoft.Network/publicIPAddresses

What CGPulse checks

A resource passes this rule when ddosProtectionMode must be one of ["VirtualNetworkInherited","Enabled"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable DDoS protection to defend against volumetric attacks. In Azure Portal: Public IP > DDoS protection > associate with a DDoS Protection Plan. See: https://learn.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection

CLI

az network public-ip update --ids "{id}" --ddos-protection-mode Enabled --ddos-protection-plan "<ddos-plan-id>"

Bicep

// Note: Requires an existing DDoS Protection Plan

param ddosPlanId string

resource pip 'Microsoft.Network/publicIPAddresses@2023-11-01' existing = {{
  name: '{name}'
}}
// TODO: Update ddosSettings.protectionMode to 'Enabled' and set ddosSettings.ddosProtectionPlan.id

Terraform

resource "azurerm_network_ddos_protection_plan" "{name}" {
  name                = "{name}-ddos-plan"
  resource_group_name = "{rg}"
  location            = var.location
}
# Associate the Public IP with a VNet that has a DDoS plan # or use IP-level protection (requires DDoS IP Protection SKU)
resource "azurerm_public_ip" "{name}" {
  name                    = "{name}"
  resource_group_name     = "{rg}"
  location                = var.location
  allocation_method       = "Static"
  sku                     = "Standard"
  ddos_protection_mode    = "Enabled"
  ddos_protection_plan_id = azurerm_network_ddos_protection_plan.{name}.id
}

Compliance frameworks

Cloud Security BaselineNS-5

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan