Skip to content

Azure.FrontDoorWAF.Exclusions.md

Latest commit

 

History

History
130 lines (109 loc) · 3.9 KB

Azure.FrontDoorWAF.Exclusions.md

File metadata and controls

130 lines (109 loc) · 3.9 KB
Raw
reviewed 2022-09-20
severity Critical
pillar Security
category SE:06 Network controls
resource Front Door
resourceType Microsoft.Network/FrontDoorWebApplicationFirewallPolicies
online version https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.FrontDoorWAF.Exclusions/

Avoid configuring Front Door WAF rule exclusions

SYNOPSIS

Use recommended rule groups in Front Door Web Application Firewall (WAF) policies to protect back end resources. Avoid configuring rule exclusions.

DESCRIPTION

Front Door WAF supports exclusions lists.

Sometimes Web Application Firewall (WAF) might block a request that you want to allow for your application. WAF exclusion lists allow you to omit certain request attributes from a WAF evaluation. However, it should be allowed and only used as a last resort.

RECOMMENDATION

Avoid configuring Front Door WAF rule exclusions.

EXAMPLES

Configure with Azure template

To deploy WAF policies that pass this rule:

  • Remove any rule exclusions by:
    • Set the exclusions property for each managed rule group to an empty array. OR
    • Remove the exclusions property for each managed rule group.

For example:

{
  "type": "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies",
  "apiVersion": "2022-05-01",
  "name": "[parameters('name')]",
  "location": "Global",
  "sku": {
    "name": "Premium_AzureFrontDoor"
  },
  "properties": {
    "managedRules": {
      "managedRuleSets": [
        {
          "ruleSetType": "Microsoft_DefaultRuleSet",
          "ruleSetVersion": "2.0",
          "ruleSetAction": "Block",
          "exclusions": [],
          "ruleGroupOverrides": []
        },
        {
          "ruleSetType": "Microsoft_BotManagerRuleSet",
          "ruleSetVersion": "1.0",
          "ruleSetAction": "Block",
          "exclusions": [],
          "ruleGroupOverrides": []
        }
      ]
    },
    "policySettings": {
      "enabledState": "Enabled",
      "mode": "Prevention"
    }
  }
}

Configure with Bicep

To deploy WAF policies that pass this rule:

  • Remove any rule exclusions by:
    • Set the exclusions property for each managed rule group to an empty array. OR
    • Remove the exclusions property for each managed rule group.

For example:

resource waf 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = {
  name: name
  location: 'Global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    managedRules: {
      managedRuleSets: [
        {
          ruleSetType: 'Microsoft_DefaultRuleSet'
          ruleSetVersion: '2.0'
          ruleSetAction: 'Block'
          exclusions: []
          ruleGroupOverrides: []
        }
        {
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '1.0'
          ruleSetAction: 'Block'
          exclusions: []
          ruleGroupOverrides: []
        }
      ]
    }
    policySettings: {
      enabledState: 'Enabled'
      mode: 'Prevention'
    }
  }
}

LINKS