Ensure CORS is tightly controlled and managed for Azure Windows Function App

MEDIUM

Description

Too open CORS policies for Azure Windows Function App may invite unauthorized access to resources.

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Function App.
  2. Choose the Function App you wish to edit.
  3. Under API, select CORS.
  4. Configure as needed.

In Terraform -

  1. In the azurerm_windows_function_app resource, create a cors block.
  2. Configure the allowed_origins as needed.

References:
https://learn.microsoft.com/en-us/azure/azure-functions/
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_function_app#cors

Policy Details

Rule Reference ID: AC_AZURE_0119
CSP: Azure
Remediation Available: Yes
Resource Category: Serverless
Resource Type: Function App

Frameworks