Ensure managed identity is used in Azure Windows Function App

LOW

Description

Azure Function App identities can be managed by Azure so that administrators do not have access to individual credentials. To learn more about managed identities, see the Azure documentation.
References:
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Function App.
  2. Choose the Function App you wish to edit.
  3. Under Settings, select Identity.
  4. On the System assigned tab, set Status to On and add permissions as needed.

In Terraform -

  1. In the azurerm_windows_function_app resource, create an identity block.
  2. Set identity.type to SystemAssigned.
  3. Set identity_ids to the list of ids to use.

References:
https://learn.microsoft.com/en-us/azure/azure-functions/
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_function_app#identity

Policy Details

Rule Reference ID: AC_AZURE_0117
CSP: Azure
Remediation Available: Yes
Resource Category: Serverless
Resource Type: Function App

Frameworks