Control: 7.10 Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway

Description

Azure Web Application Firewall helps protect applications from common exploits and attacks by inspecting and filtering incoming traffic.

Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.

Remediation

Note: Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway.

Remediate from Azure Portal

To remediate a Standard V2 tier application gateway:

Go to Application gateways.
Click Add filter.
From the Filter drop-down menu, select SKU size.
Check the box next to Standard_v2 only.
Click Apply.
Click the name of an application gateway.
Under Settings, click Web application firewall.
Under Configure, next to Tier, click WAF V2.
Select an existing or create a new WAF policy.
Click Save.
Repeat steps 1-10 for each Standard V2 tier application gateway requiring remediation.

Default Value

Azure Web Application Firewall is enabled by default for the WAF V2 tier of Azure Application Gateway. It is not available in the Basic tier. Application gateways deployed using the Standard V2 tier can be upgraded to the WAF V2 tier to enable Azure Web Application Firewall.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_7_10

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_7_10 --share

SQL

This control uses a named query:

select
  ag.id resource,
  case
    when web_application_firewall_configuration is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when web_application_firewall_configuration is not null then ag.name || ' WAF enabled.'
    else ag.name || ' WAF disabled.'
  end as reason
  
  , ag.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_application_gateway as ag
  left join azure_subscription as sub on sub.subscription_id = ag.subscription_id;

Control: 7.10 Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway

Description

Remediation

Default Value

Usage

SQL

Tags