Back to Checks
azure

Virtual network has Azure DDoS Network Protection enabled

network_vnet_ddos_protection_enabled
Service: networkSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.network/virtualnetworks

Azure Virtual Networks are evaluated for DDoS Network Protection. When enabled, Azure DDoS Protection provides enhanced mitigation against volumetric, protocol, and application-layer DDoS attacks targeting resources deployed in the virtual network.

Prowler logoProwlerprowler-provider-azure

Risk

Without DDoS protection, Azure resources are only covered by DDoS Infrastructure Protection (basic), which may not mitigate sophisticated or large-scale attacks. Successful DDoS attacks cause service unavailability and potential data exposure during failover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks network_vnet_ddos_protection_enabled

Recommendation

Enable Azure DDoS Network Protection on virtual networks hosting internet-facing workloads. Consider cost implications — DDoS Network Protection has a monthly charge per plan. Use DDoS IP Protection as a lower-cost alternative for individual public IPs.

Remediation

CLI

az network ddos-protection create --resource-group <rg> --name <plan> && az network vnet update --resource-group <rg> --name <vnet> --ddos-protection-plan <plan_id>

Terraform

resource "azurerm_virtual_network" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<example_location>"
  resource_group_name = "<example_resource_name>"
  address_space       = ["10.0.0.0/16"]

  ddos_protection_plan {
    id     = "<example_resource_id>"  # Critical: associates DDoS Protection Plan
    enable = true
  }
}

NativeIaC

resource vnet 'Microsoft.Network/virtualNetworks@2023-09-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  properties: {
    addressSpace: { addressPrefixes: ['10.0.0.0/16'] }
    enableDdosProtection: true // Critical: enables DDoS Protection
    ddosProtectionPlan: { id: '<example_resource_id>' }
  }
}

Other

1Sign in to Azure portal
2Search for 'DDoS protection plans'
3Create a new DDoS protection plan
4Go to Virtual networks and select the target VNet
5Under DDoS protection, select 'Enable' and select the plan
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.network.network_client import network_client


class network_vnet_ddos_protection_enabled(Check):
    """
    Ensure Azure DDoS Network Protection is enabled on virtual networks.

    This check evaluates whether each virtual network has a DDoS protection plan associated, providing always-on traffic monitoring and adaptive mitigation against volumetric and protocol attacks.

    - PASS: The virtual network has DDoS protection enabled.
    - FAIL: The virtual network does not have DDoS protection enabled.
    """

    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_name, vnets in network_client.virtual_networks.items():
            for vnet in vnets:
                report = Check_Report_Azure(metadata=self.metadata(), resource=vnet)
                report.subscription = subscription_name
                report.resource_name = vnet.name
                report.resource_id = vnet.id
                report.location = vnet.location

                if vnet.enable_ddos_protection:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Virtual network '{vnet.name}' has DDoS "
                        f"protection enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Virtual network '{vnet.name}' does not have "
                        f"DDoS protection enabled."
                    )

                findings.append(report)

        return findings

References