terraform.azure.best-practice.azure-functionapp-http-version-latest.azure-functionapp-http-version-latest

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Ensure that HTTP Version is the latest if used to run the Function app

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: azure-functionapp-http-version-latest
    message: Ensure that HTTP Version is the latest if used to run the Function app
    patterns:
      - pattern: resource
      - pattern-not-inside: |
          resource "azurerm_function_app" "..." {
          ...
          site_config {
            ...
            http2_enabled = true
            ...
          }
          ...
          }
      - pattern-inside: |
          resource "azurerm_function_app" "..." {
          ...
          }
    metadata:
      category: best-practice
      technology:
        - terraform
        - azure
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - hcl
    severity: WARNING

Examples

azure-functionapp-http-version-latest.tf

# fail
# ruleid: azure-functionapp-http-version-latest
resource "azurerm_function_app" "example" {
    name                       = "test-azure-functions"
    location                   = azurerm_resource_group.example.location
    resource_group_name        = azurerm_resource_group.example.name
    app_service_plan_id        = azurerm_app_service_plan.example.id
    storage_account_name       = azurerm_storage_account.example.name
    storage_account_access_key = azurerm_storage_account.example.primary_access_key
    os_type                    = "linux"
}

# fail
# ruleid: azure-functionapp-http-version-latest
resource "azurerm_function_app" "example" {
    name                       = "test-azure-functions"
    location                   = azurerm_resource_group.example.location
    resource_group_name        = azurerm_resource_group.example.name
    app_service_plan_id        = azurerm_app_service_plan.example.id
    storage_account_name       = azurerm_storage_account.example.name
    storage_account_access_key = azurerm_storage_account.example.primary_access_key
    os_type                    = "linux"
    site_config {
    http2_enabled = false
    }
}

# pass
resource "azurerm_function_app" "example" {
    name                       = "test-azure-functions"
    location                   = azurerm_resource_group.example.location
    resource_group_name        = azurerm_resource_group.example.name
    app_service_plan_id        = azurerm_app_service_plan.example.id
    storage_account_name       = azurerm_storage_account.example.name
    storage_account_access_key = azurerm_storage_account.example.primary_access_key
    os_type                    = "linux"
    site_config {
    http2_enabled = true
    }
}