API Management Without Minimum TLS 1.2 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_173
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Transport Layer Security (TLS) is a protocol that provides secure communications. It is crucial to use a modern, robust version of this protocol to ensure the confidentiality and integrity of data in transit. This rule checks that Azure API Management is configured to use at least TLS 1.2 for both frontend and backend communications.

How to Fix

Resource: azurerm_api_management

• Arguments: security [source,go]

---

resource "azurerm_api_management" "example" { name = "example-api" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "[e-mail]"

security {

• enable_back_end_ssl30 = false
• enable_backend_tls10 = false
• enable_frontend_ssl30 = false
• enable_frontend_tls10 = false
• enable_frontend_tls11 = false }

tags = { Environment = "production" } }