| name | cis-azure-foundations-7.10 |
| description | Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","networking","waf","application-gateway"] |
| cis_id | 7.10 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-7.12","cis-azure-foundations-7.13","cis-azure-foundations-7.14","cis-azure-foundations-7.15"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure Azure Web Application Firewall (WAF) is enabled on Azure Application Gateway
Description
Azure Web Application Firewall helps protect applications from common exploits and attacks by inspecting and filtering incoming traffic.
Rationale
Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.
Impact
The WAF V2 tier for Azure Application Gateways costs more than the Basic and Standard V2 tiers. Pricing includes a fixed hourly charge plus a charge per capacity-unit hour. Refer to https://azure.microsoft.com/en-gb/pricing/details/application-gateway/ for details.
Audit Procedure
Using Azure Portal
- Go to
Application gateways.
- Click the name of an application gateway.
- In the
Overview, under Essentials, ensure Tier is set to WAF V2.
- Repeat steps 1-3 for each application gateway.
Using Azure CLI
Run the following command to list application gateways:
az network application-gateway list
For each application gateway, run the following command to get the firewall policy id:
az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id
Ensure a firewall policy id is returned.
Using Azure Policy
- Policy ID: 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - Name: 'Web Application Firewall (WAF) should be enabled for Application Gateway'
Expected Result
All Application Gateways should have Tier set to WAF V2 and have a firewall policy associated.
Remediation
Note: Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway.
Remediate from Azure Portal
To remediate a Standard V2 tier application gateway:
