azure-frontdoor-waf-policy-object-write
Write access to the WAF policy object itself (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write) lets an attacker modify or delete managed rule sets and custom rules, effectively neutering WAF protections without touching the AFD profile or securityPolicies link.
match (effective permission)
{
"action": "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <AFD WAF policy object node (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies)> |
| permissions | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write |
| conditions | deny_assignment |
| state logic | ACTIVE when no deny assignment exists for Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write at the relevant scope — the principal can modify/delete WAF rules immediately. CONDITIONAL(deny_assignment) when deny-assignment coverage cannot be confirmed. |
Narrative
{principal.name} can modify the WAF policy rules and detections (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write), enabling them to disable managed rule sets or custom rules directly on the AFD WAF policy.
Raw rule rules/derived/azure/frontdoor.yaml
id: azure-frontdoor-waf-policy-object-write
emits: CanModifyConfiguration
description: Write access to the WAF policy object itself (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write)
lets an attacker modify or delete managed rule sets and custom rules, effectively neutering WAF protections
without touching the AFD profile or securityPolicies link.
match_effective_permission:
action: Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <AFD WAF policy object node (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies)>
permissions:
- Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write
conditions:
- deny_assignment
state_logic: "ACTIVE when no deny assignment exists for Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write\
\ at the relevant scope \u2014 the principal can modify/delete WAF rules immediately. CONDITIONAL(deny_assignment)\
\ when deny-assignment coverage cannot be confirmed."
derived_from:
- '<effective permission record: Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write>'
false_positive_note: This permission targets the WAF policy object itself (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies),
distinct from the AFD securityPolicies link (Microsoft.Cdn/profiles/securityPolicies/write). A principal
with FrontDoorWebApplicationFirewallPolicies/write can modify the WAF policy rules and detections
directly, even if they do not hold securityPolicies/write. A deny assignment covering this action
at the resource, RG, or subscription scope blocks this -> emit BLOCKED.
narrative: '{principal.name} can modify the WAF policy rules and detections (Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/write),
enabling them to disable managed rule sets or custom rules directly on the AFD WAF policy.'