Beta - Function App Deployment Slot Not Using Latest TLS Encryption Version

  • Query id: 03928f0d-bff0-4feb-a31a-615d093e6026
  • Query name: Beta - Function App Deployment Slot Not Using Latest TLS Encryption Version
  • Platform: Terraform
  • Severity: Medium
  • Category: Encryption
  • CWE: 326
  • Risk score: 3.0
  • URL: Github

Description

Ensure Function App Deployment Slot is using the latest version of TLS encryption
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file
resource "azurerm_linux_function_app_slot" "positive1" {
  name                 = "example-linux-function-app-slot"
  function_app_id      = azurerm_linux_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.1"
  }
}
Positive test num. 2 - tf file
resource "azurerm_windows_function_app_slot" "positive2" {
  name                 = "example-slot"
  function_app_id      = azurerm_windows_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.1"
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file
resource "azurerm_linux_function_app_slot" "negative1" {
  name                 = "example-linux-function-app-slot"
  function_app_id      = azurerm_linux_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {}
}
Negative test num. 2 - tf file
resource "azurerm_linux_function_app_slot" "negative2" {
  name                 = "example-linux-function-app-slot"
  function_app_id      = azurerm_linux_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.2"
  }
}
Negative test num. 3 - tf file
resource "azurerm_linux_function_app_slot" "negative3" {
  name                 = "example-linux-function-app-slot"
  function_app_id      = azurerm_linux_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.3"
  }
}

Negative test num. 4 - tf file 
resource "azurerm_windows_function_app_slot" "negative4" {
  name                 = "example-slot"
  function_app_id      = azurerm_windows_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {}
}
Negative test num. 5 - tf file 
resource "azurerm_windows_function_app_slot" "negative5" {
  name                 = "example-slot"
  function_app_id      = azurerm_windows_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.2"
  }
}
Negative test num. 6 - tf file 
resource "azurerm_windows_function_app_slot" "negative6" {
  name                 = "example-slot"
  function_app_id      = azurerm_windows_function_app.example.id
  storage_account_name = azurerm_storage_account.example.name

  site_config {
    minimum_tls_version = "1.3"
  }
}