Control: Ensure FTP deployments are Disabled

Description

By default, Azure Functions, Web, and API Services can be deployed over FTP. If FTP is required for an essential deployment workflow, FTPS should be required for FTP login for all App Service Apps and Functions.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.appservice_ftp_deployment_disabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.appservice_ftp_deployment_disabled --share

SQL

This control uses a named query:

select
    fa.id as resource,
    case
      when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then 'alarm'
      else 'ok'
    end as status,
    case
      when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then name || ' FTP deployments enabled.'
      else name || ' FTP deployments disabled.'
    end as reason
  
  , fa.resource_group as resource_group
  , sub.display_name as subscription
  from
    azure_app_service_function_app fa,
    azure_subscription sub
  where
    sub.subscription_id = fa.subscription_id
union
  select
    wa.id as resource,
    case
      when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then 'alarm'
      else 'ok'
    end as status,
    case
      when configuration -> 'properties' ->> 'ftpsState' = 'AllAllowed' then name || ' FTP deployments enabled.'
      else name || ' FTP deployments disabled.'
    end as reason
  
  , wa.resource_group as resource_group
  , sub.display_name as subscription
  from
    azure_app_service_web_app as wa,
    azure_subscription as sub
  where
    sub.subscription_id = wa.subscription_id;

Control: Ensure FTP deployments are Disabled

Description

Usage

SQL

Tags