Azure App Services FTP deployment is All allowed misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_78
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	cd13ceb9-5139-4bf3-b722-0d6be1d36627

Impact

FTPS (Secure FTP) is used to enhance security for Azure web application using App Service as it adds an extra layer of security to the FTP protocol, and help you to comply with the industry standards and regulations. For enhanced security, it is highly advices to use FTP over TLS/SSL only. You can also disable both FTP and FTPS if you don't use FTP deployment.

How to Fix

Resource: azurerm_app_service

• Arguments: ftps_state - (Optional) State of FTP / FTPS service for this App Service.

Possible values include: AllAllowed, FtpsOnly and Disabled. [source,go]

resource "azurerm_app_service" "example" { ...

• ftps_state = "FtpsOnly" }

", }