BRS for FrontDoor CDN

Control coverage/Feature/CDN.md

@@ -5,6 +5,7 @@
 <!-- TOC -->
 
 - [Azure_CDN_DP_Enable_Https](#azure_cdn_dp_enable_https)
+- [Azure_FrontDoor_CDNProfile_NetSec_Enable_WAF_Configuration](#azure_frontdoor_cdnprofile_netsec_enable_waf_configuration)
 
 <!-- /TOC -->
 <br/>
@@ -60,5 +61,69 @@ One of the following conditions is met:
 /subscriptions/{subscriptionId}/resourceGroups/{resourcegroupName}/providers/Microsoft.Cdn/profiles/{profileName}/endpoints?api-version=2019-12-31<br />
 **Properties:** 
 properties.isHttpAllowed, properties.isHttpsAllowed, properties.deliveryPolicy.rules
+
+<br />
+
+___ 
+
+
+ ## Azure_FrontDoor_CDNProfile_NetSec_Enable_WAF_Configuration 
+
+### Display Name 
+Front Door should have Web Application Firewall configured
+
+### Rationale 
+Azure Web Application Firewall (WAF) on Azure Front Door provides centralized protection for your web applications. WAF defends your web services against common exploits & vulnerablities. It keeps your service highly available for your users and helps you meet compliance requirements.
+
+ ### Control Spec 
+
+> **Passed:** 
+> Web Application Firewall has been configured on Front Door CDN </br>
+> and Configured WAF Policy mode must be Prevention only. </br> 
+> and Configured WAF Policy mode must be in Enabled State only. </br> 
+> 
+> **Failed:** 
+> WAF is not configured on Front Door CDN. </br> 
+> or Configured WAF Policy mode is not Prevention. </br> 
+> or Configured WAF Policy mode is not in Enabled State. </br> 
+> 
+> **Error:** 
+> There was an error fetching WAF Configuration details of Front Door CDN.
+> 
+### Recommendation 
+- **Azure Portal** 
+
+	 Use the Azure portal to configure WAF Policy on the Front Door CDN.<br/>
+
+- **Powershell** 	
+
+     Use following Powershell Bulk Remediation scripts to Configure WAF Policy on the Front Door CDN: <br/>
+     You can configure WAF Policy on Front Door using below BRS:<br/>
+	 [Remediate-ConfigureWAFPolicyForFrontDoorCDN](../../Scripts/RemediationScripts/Remediate-ConfigureWAFPolicyForFrontDoorCDN.ps1) <br/>
+	 You can enable State of WAF Policy configured on Front Door using below BRS:  <br/>
+	 [Remediate-EnableWAFPolicyForFrontDoorCDN](../../Scripts/RemediationScripts/Remediate-EnableWAFPolicyForFrontDoorCDN.ps1) <br/>
+	 You can enable Prevention Mode on WAF Policy configured on Front Door using below BRS:  <br/>
+	 [Remediate-EnableWAFPolicyPreventionModeForFrontDoorCDN](../../Scripts/RemediationScripts/Remediate-EnableWAFPolicyPreventionModeForFrontDoorCDN.ps1) <br/>
+
+### Azure Policy or ARM API used for evaluation 
+
+- ARM API to get Front Door resources in a subscription: /subscriptions/{0}/
+/subscriptions/{0}/providers/Microsoft.Cdn/profiles?api-version=2021-06-01
+**Properties:** [*]
  <br />
 
+- ARM API to get Front Door Endpoints resources in a subscription: /subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Cdn/profiles/{2}/afdEndpoints?api-version=2021-06-01<br />
+**Properties:** [*]
+ <br />
+
+- ARM API to get WAF Policies in a subscription: /subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Network/frontDoorWebApplicationFirewallPolicies?api-version=2020-11-01<br />
+**Properties:** [*]
+ <br />
+
+- ARM API to get Security Policies in a subscription: 
+ /subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Cdn/profiles/{2}/securityPolicies?api-version=2021-06-01<br />
+**Properties:** [*]
+<br />
+
+___ 
+

Control coverage/README.md

@@ -44,6 +44,8 @@ Below resource types can be checked for validating the security controls:
 |[VirtualMachineScaleSet](Feature/VirtualMachineScaleSet.md)|Microsoft.Compute/virtualMachineScaleSets|
 |[VirtualNetwork](Feature/VirtualNetwork.md)|Microsoft.Network/virtualNetworks|
 
+
+
 ## Externally Scanned controls in Azure Tenant Security (AzTS)
 
 There are certain controls that cannot be effectively evaluated by AzTS (due to various limitations for e.g. some controls requires VM instances to be in running state) for such controls AzTS will put verification result as 'ExtScanned'. And effective verification result of such controls should be determined based on external feeds later (if available). 

Scripts/RemediationScripts/Readme.md

@@ -40,6 +40,7 @@ Bulk remediation scripts (BRS) can be used to remediate non-compliant resources/
 28. [Azure_Storage_DP_Use_Secure_TLS_Version_Trial](Readme.md#28-Azure_Storage_DP_Use_Secure_TLS_Version_Trial)
 29. [Azure_ApplicationGateway_NetSec_Enable_WAF_Configuration](Readme.md#29-Azure_ApplicationGateway_NetSec_Enable_WAF_Configuration)
 30. [Azure_LoadBalancer_NetSec_Restrict_Network_Traffic](Readme.md#30-Azure_LoadBalancer_NetSec_Restrict_Network_Traffic)
+32. [Azure_FrontDoor_CDNProfile_NetSec_Enable_WAF_Configuration](Readme.md#32-Azure_FrontDoor_CDNProfile_NetSec_Enable_WAF_Configuration)
 
 
 
@@ -606,7 +607,6 @@ Yes
 ___
 
 
-
 ## 29. Azure_ApplicationGateway_NetSec_Enable_WAF_Configuration
 
 ### Display Name
@@ -651,6 +651,31 @@ Yes
 ___
 
 
+## 32. Azure_FrontDoor_CDNProfile_NetSec_Enable_WAF_Configuration
+
+### Display Name
+WAF Policy should be configured on Endpoints in Front Door
+
+### Link to Bulk Remediation Script (BRS)
+You can Configure WAF Policy on Front Door CDN using below BRS:  <br/>
+[Remediate-ConfigureWAFPolicyForFrontDoorCDN](Remediate-ConfigureWAFPolicyForFrontDoorCDN.ps1) <br/>
+You can enable State of WAF Policy configured on Front Door using below BRS:  <br/>
+[Remediate-EnableWAFPolicyForFrontDoorCDN](Remediate-EnableWAFPolicyForFrontDoorCDN.ps1) <br/>
+You can enable Prevention Mode on WAF Policy configured on Front Door using below BRS:  <br/>
+[Remediate-EnableWAFPolicyPreventionModeForFrontDoorCDN](Remediate-EnableWAFPolicyPreventionModeForFrontDoorCDN.ps1) <br/>
+
+### Minimum permissions required to run the script
+Contributor role at resource level
+
+### [Supports managed identity](Readme.md#supports-managed-identity-based-remediations) based remediation
+Yes
+
+### Supports rollback?
+Yes
+
+
+___
+
 
 ## Supports managed identity based remediations
 Both System assigned and User assigned managed identities are supported.