Ensure managed identity is used in Azure Function App

LOW

Description

Azure Function App identities can be managed by Azure so that there is not a lack of accountability with regards to user activity. To learn more about managed identities, see the Azure documentation.
References:
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Function App.
  2. Choose the Function App you wish to edit.
  3. Under Settings, select Identity.
  4. On the System assigned tab, set Status to On and add permissions as needed.

In Terraform -
For Azure Provider versions prior to v4.x (deprecated in favor of azurerm_linux_function_app and azurerm_windows_function_app resources):

  1. In the azurerm_function_app resource, create an identity block.
  2. Set identity.type to SystemAssigned.
  3. Set identity_ids to the list of ids to use.

References:
https://learn.microsoft.com/en-us/azure/azure-functions/
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#identity

Policy Details

Rule Reference ID: AC_AZURE_0176
CSP: Azure
Remediation Available: Yes
Resource Category: Serverless
Resource Type: Function App

Frameworks