Traffic Manager should use HTTPS for endpoint monitoring

High Azure General trafficmanagerprofiles-https-only

Applies to

Microsoft.Network/trafficmanagerprofiles

What CGPulse checks

A resource passes this rule when monitorProtocol must equal HTTPS. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure health probes to prevent routing traffic to unhealthy backends. In Azure Portal: Load Balancer/App Gateway > Health probes > configure probe settings. See: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

CLI

az network traffic-manager profile update --ids "{id}" --monitor-protocol HTTPS

Terraform

resource "azurerm_traffic_manager_profile" "{name}" {
  name                   = "{name}"
  resource_group_name    = "{rg}"
  traffic_routing_method = "Weighted"
  monitor_config {
    protocol                  = "HTTPS"
    port                      = 443
    path                      = "/"
    interval_in_seconds       = 30
    timeout_in_seconds        = 10
    tolerated_number_of_failures = 3
  }
  dns_config {
    relative_name = "{name}"
    ttl           = 60
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan