Function App Client Certificates Unrequired

• Query id: 9bb3c639-5edf-458c-8ee5-30c17c7d671d
• Query name: Function App Client Certificates Unrequired
• Platform: Terraform
• Severity: Medium
• Category: Insecure Configurations
• CWE: 295
• Risk score: 6.1
• URL: Github

Description

Azure Function App should have 'client_cert_mode' set to required
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_function_app" "positive1-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
}

resource "azurerm_function_app" "positive1-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

  client_cert_mode = "Optional"
}

Positive test num. 2 - tf file

resource "azurerm_linux_function_app" "positive2-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}

resource "azurerm_linux_function_app" "positive2-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

  client_certificate_mode = "Optional"
}

Positive test num. 3 - tf file

resource "azurerm_windows_function_app" "positive3-1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}

resource "azurerm_windows_function_app" "positive3-2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

  client_certificate_mode = "Optional"
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_function_app" "negative1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id

  client_cert_mode = "Required"
}

Negative test num. 2 - tf file

resource "azurerm_linux_function_app" "negative2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

  client_certificate_mode = "Required"
}

Negative test num. 3 - tf file

resource "azurerm_windows_function_app" "negative3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id

  client_certificate_mode = "Required"
}