Web App accepts incoming client certificate

AZU-0001

Service: appserviceSeverity: low

OfficialBuilt-inVerified

The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled only an authenticated client with valid certificates can access the app.

Prowler prowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud

Run

prowler iac --checks AZU-0001

Recommendation

Enable incoming certificates for clients

Check Code

# METADATA
# title: Web App accepts incoming client certificate
# description: |
#   The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled only an authenticated client with valid certificates can access the app.
# scope: package
# schemas:
#   - input: schema["cloud"]
# custom:
#   id: AZU-0001
#   long_id: azure-appservice-require-client-cert
#   aliases:
#     - AVD-AZU-0001
#     - require-client-cert
#     - azure-appservice-require-client-cert
#   provider: azure
#   service: appservice
#   severity: LOW
#   recommended_action: Enable incoming certificates for clients
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: appservice
#             provider: azure
#   examples: checks/cloud/azure/appservice/require_client_cert.yaml
package builtin.azure.appservice.azure0001

import rego.v1

deny contains res if {
	some service in input.azure.appservice.services
	isManaged(service)
	not service.enableclientcert.value
	res := result.new(
		"App service does not have client certificates enabled.",
		object.get(service, "enableclientcert", service),
	)
}