Ensure FTP deployments are Disabled - azurerm_windows_function_app

Description:

By default, Azure Functions, Web, and API Services
can be deployed over FTP. If FTP is required for an
essential deployment workflow, FTPS should be required
for FTP login for all App Service Apps and Functions.

Rationale:

Azure FTP deployment endpoints are public. An attacker listening to traffic on a wifi network used by a remote employee or a corporate network could see login traffic in clear-text which would then grant them full control of the code base of the app or service. This finding is more severe if User Credentials for deployment are set at the subscription level rather than using the default Application Credentials which are unique per App.

Any deployment workflows that rely on FTP or FTPs rather than the WebDeploy or HTTPs endpoints may be affected.

From Azure Portal

1. Go to the Azure Portal
2. Select 'App Services'
3. Click on an app
4. Select 'Settings' and then 'Configuration'
5. Under 'General Settings', for the 'Platform Settings', the 'FTP state' should be set to 'Disabled' or 'FTPS Only'

From Azure CLI

For each out of compliance application, run the following choosing either 'disabled' or 'FtpsOnly' as appropriate:

az webapp config set --resource-group --name --ftps-state [disabled|FtpsOnly]

From PowerShell

For each out of compliance application, run the following:

Set-AzWebApp -ResourceGroupName -Name -FtpsState