azure-appgw-waf-policy-delete
Deleting a WAF policy detaches it from all associated Application Gateways, removing all L7 filtering and reverting those gateways to Standard_v2 (WAF-less) behavior.
match (effective permission)
{
"action": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies in scope> |
| permissions | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete |
Narrative
{principal.name} can delete WAF policy {target.name} (ApplicationGatewayWebApplicationFirewallPolicies/delete), removing all L7 attack filtering (SQLi, XSS, SSRF, Bot Manager) from every Application Gateway that references this policy.
Raw rule rules/derived/azure/loadbalancer.yaml
id: azure-appgw-waf-policy-delete
emits: CanModifyConfiguration
description: Deleting a WAF policy detaches it from all associated Application Gateways, removing all
L7 filtering and reverting those gateways to Standard_v2 (WAF-less) behavior.
match_effective_permission:
action: Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies in scope>
permissions:
- Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/delete
escalation: Deleting the WAF policy removes all L7 filtering from every Application Gateway that references
it. All managed rule sets (OWASP CRS, Bot Manager, DRS) and custom rules are immediately removed from
the traffic pipeline.
false_positive_note: A WAF policy delete is immediately effective (no restart required) once the policy
is de-associated. Azure may prevent deletion of a WAF policy while it is still associated with an
active gateway (the operation will fail with a dependency error); in that case the principal would
need applicationGateways/write to disassociate first. Emit as CONDITIONAL(service_state) if the policy
is currently in active use by a running gateway (deletion may be blocked by the service until disassociated).
narrative: '{principal.name} can delete WAF policy {target.name} (ApplicationGatewayWebApplicationFirewallPolicies/delete),
removing all L7 attack filtering (SQLi, XSS, SSRF, Bot Manager) from every Application Gateway that
references this policy.'