Function App Not Using Latest TLS Encryption Version

• Query id: 45fc717a-bd86-415c-bdd8-677901be1aa6
• Query name: Function App Not Using Latest TLS Encryption Version
• Platform: Terraform
• Severity: Medium
• Category: Encryption
• CWE: 326
• Risk score: 5.9
• URL: Github

Description

Ensure Function App is using the latest version of TLS encryption
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_function_app" "positive1-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    min_tls_version = 1.1
  }
}

resource "azurerm_function_app" "positive1-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    min_tls_version = "1.1"
  }
}

Positive test num. 2 - tf file

resource "azurerm_linux_function_app" "positive2-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = 1.1
  }
}

resource "azurerm_linux_function_app" "positive2-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = "1.1"
  }
}


resource "azurerm_linux_function_app" "positive2-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
  }
}

resource "azurerm_linux_function_app" "positive2-4" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id
}

Positive test num. 3 - tf file

resource "azurerm_windows_function_app" "positive3-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = 1.1
  }
}

resource "azurerm_windows_function_app" "positive3-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = "1.1"
  }
}


resource "azurerm_windows_function_app" "positive3-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
  }
}

resource "azurerm_windows_function_app" "positive3-4" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_function_app" "negative1-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    min_tls_version = 1.2
  }
}

resource "azurerm_function_app" "negative1-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
  }
}

resource "azurerm_function_app" "negative1-3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id
}

resource "azurerm_function_app" "negative1-4" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  app_service_plan_id        = azurerm_app_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    min_tls_version = "1.2"
  }
}

Negative test num. 2 - tf file

resource "azurerm_linux_function_app" "negative2-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = 1.3
  }
}

resource "azurerm_linux_function_app" "negative2-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = "1.3"
  }
}

Negative test num. 3 - tf file

resource "azurerm_windows_function_app" "negative3-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = 1.3
  }
}

resource "azurerm_windows_function_app" "negative3-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  service_plan_id            = azurerm_service_plan.example.id

  site_config {
    dotnet_framework_version = "v4.0"
    scm_type                 = "LocalGit"
    minimum_tls_version = "1.3"
  }
}