Azure CDN Endpoint Custom domains is not configured with HTTPS misconfiguration detected in code

Azure CDN Endpoint Custom domains is not configured with HTTPS misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_198
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	037748a3-155b-4fca-b286-5fa6a4f07dc9

Impact

This policy identifies Azure CDN Endpoint Custom domains which has not configured with HTTPS. Enabling HTTPS would allow sensitive data to be delivered securely via TLS/SSL encryption when it is sent across the internet. It is recommended to enable HTTPS in Azure CDN Endpoint Custom domains which will provide additional security and protects your web applications from attacks.

How to Fix

Resource:

• azurerm_cdn_endpoint

Arguments:

• is_https_allowed [source,go]

---

resource "azurerm_cdn_endpoint" "example" { name = "example-cdn-endpoint"

... other configurations ...

• is_https_allowed = true

... other configurations ...

}