Ensure latest TLS/SSL version is in use for Azure API Management

MEDIUM

Description

Using the latest version of TLS can help keep data in-transit protected from man-in-the-middle and similar attacks.

Remediation

In Azure Console -

  1. Open the Azure Portal and go to API Management.
  2. Choose the API you wish to edit.
  3. Under Security, select Protocols + ciphers.
  4. Under Client protocol, check the box for each insecure version (SSLv3, TLS 1.1, and TLS 1.0), then select Disable.
  5. Repeat for Backend protocol.
  6. Select Save.

In Terraform -

  1. In the azurerm_api_management, set security.enable_backend_ssl30 to false, or remove completely (the default is false).
  2. In the azurerm_api_management, set security.enable_frontend_ssl30 to false, or remove completely (the default is false).
  3. Repeat for insecure TLS versions (TLS 1.1 and TLS 1.0).

References:
https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-manage-protocols-ciphers
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/api_management#security

Policy Details

Rule Reference ID: AC_AZURE_0224
CSP: Azure
Remediation Available: Yes
Resource Category: Virtual Network
Resource Type: API Management

Frameworks