Azure Client Certificates are not enforced for API management misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_152
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	Terraform

Impact

By enforcing client certificates for API management, you can ensure that only clients that have a valid certificate are able to access your APIs. This can help prevent unauthorized access to your APIs, and can also help protect against potential security threats such as data breaches or denial of service attacks.

How to Fix

Resource: azurerm_app_service

• Arguments: client_cert_enabled [source,go]

---

resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id client_cert_enabled = true }