API Management should enforce TLS 1.2 or higher

High Azure General service-min-tls

Applies to

Microsoft.ApiManagement/service

What CGPulse checks

A resource passes this rule when customProperties.tlsVersion must be one of ["Tls12","Tls13"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enforce TLS 1.2+ to protect data in transit from protocol downgrade attacks. In Azure Portal: API Management > Protocols + ciphers > disable TLS 1.0 and 1.1. See: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-manage-protocols-ciphers

CLI

az apim update --ids "{id}" --protocols-setting "{\"tls\":{\"minApiVersion\":\"1.2\"}}"

Terraform

resource "azurerm_api_management" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  publisher_name      = "My Org"
  publisher_email     = "admin@example.com"
  sku_name            = "Developer_1"
  security {
    enable_backend_tls10  = false
    enable_backend_tls11  = false
    enable_frontend_tls10 = false
    enable_frontend_tls11 = false
  }
}

Compliance frameworks

Cloud Security BaselineDP-3

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan