Function App Managed Identity Disabled

• Query id: c87749b3-ff10-41f5-9df2-c421e8151759
• Query name: Function App Managed Identity Disabled
• Platform: Terraform
• Severity: Medium
• Category: Insecure Configurations
• CWE: 284
• Risk score: 5.9
• URL: Github

Description

Azure Function App should have managed identity enabled
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - tf file

resource "azurerm_function_app" "positive1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
}

resource "azurerm_linux_function_app" "positive2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}

resource "azurerm_windows_function_app" "positive3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
}

Code samples without security vulnerabilities

Negative test num. 1 - tf file

resource "azurerm_function_app" "negative1" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_linux_function_app" "negative2" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_windows_function_app" "negative3" {
  name                       = "test-azure-functions"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  service_plan_id            = azurerm_app_service_plan.example.id
  identity {
    type = "SystemAssigned"
  }
}