Control: Web Application Firewall (WAF) should be enabled for Azure Front Door Service
Description
Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.frontdoor_waf_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.frontdoor_waf_enabled --shareSQL
This control uses a named query:
with frontdoor_with_waf as ( select distinct a.front_door_id from azure_frontdoor as a, jsonb_array_elements(frontend_endpoints) as endpoint where endpoint -> 'properties' -> 'webApplicationFirewallPolicyLink' ->> 'id' is not null)select a.front_door_id as resource, case when c.front_door_id is not null then 'ok' else 'alarm' end as status, case when c.front_door_id is not null then a.name || ' WAF enabled.' else a.name || ' WAF disabled.' end as reason , a.resource_group as resource_group , sub.display_name as subscriptionfrom azure_frontdoor as a left join frontdoor_with_waf as c on c.front_door_id = a.front_door_id, azure_subscription as subwhere sub.subscription_id = a.subscription_id;