azure-frontdoor-waf-policy-write
Write access to AFD security policies (Microsoft.Cdn/profiles/securityPolicies/write) lets an attacker detach or replace the WAF policy linked to an AFD endpoint, removing bot protection, rate limiting, and custom detection rules from the public entry point.
match (effective permission)
{
"action": "Microsoft.Cdn/profiles/securityPolicies/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal> |
| target | <AFD security policy node (Microsoft.Cdn/profiles/securityPolicies)> |
| permissions | Microsoft.Cdn/profiles/securityPolicies/write |
| conditions | deny_assignment |
| state logic | ACTIVE when no deny assignment exists for Microsoft.Cdn/profiles/securityPolicies/write at the relevant scope (resource, resource group, or subscription) — the principal can detach or replace the WAF policy on the linked AFD endpoint immediately. CONDITIONAL(deny_assignment) when deny-assignment coverage cannot be confirmed from collected data. Effect is realized when a new (permissive) WAF policy is linked or the security policy is deleted. |
Narrative
{principal.name} can write AFD security policies on profile {target.name} (Microsoft.Cdn/profiles/securityPolicies/write), enabling them to detach or replace the WAF policy and remove inbound request filtering from the AFD endpoint.
Raw rule rules/derived/azure/frontdoor.yaml
id: azure-frontdoor-waf-policy-write
emits: CanModifyConfiguration
description: Write access to AFD security policies (Microsoft.Cdn/profiles/securityPolicies/write) lets
an attacker detach or replace the WAF policy linked to an AFD endpoint, removing bot protection, rate
limiting, and custom detection rules from the public entry point.
match_effective_permission:
action: Microsoft.Cdn/profiles/securityPolicies/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Firewall
source: <principal>
target: <AFD security policy node (Microsoft.Cdn/profiles/securityPolicies)>
permissions:
- Microsoft.Cdn/profiles/securityPolicies/write
conditions:
- deny_assignment
state_logic: "ACTIVE when no deny assignment exists for Microsoft.Cdn/profiles/securityPolicies/write\
\ at the relevant scope (resource, resource group, or subscription) \u2014 the principal can detach\
\ or replace the WAF policy on the linked AFD endpoint immediately. CONDITIONAL(deny_assignment) when\
\ deny-assignment coverage cannot be confirmed from collected data. Effect is realized when a new\
\ (permissive) WAF policy is linked or the security policy is deleted."
derived_from:
- '<effective permission record: Microsoft.Cdn/profiles/securityPolicies/write>'
false_positive_note: "A deny assignment covering Microsoft.Cdn/profiles/securityPolicies/write at the\
\ profile, resource-group, or subscription scope blocks this capability -> emit BLOCKED. CDN Contributor\
\ (Microsoft.Cdn/profiles/*) includes securityPolicies/write. CDN Endpoint Contributor does NOT include\
\ securityPolicies/write \u2014 verify the effective role. Detaching the WAF policy weakens protections\
\ but does NOT grant the attacker data-plane access to the origin; it is a precondition for exploitation\
\ of the origin, not a direct escalation step. Do not conflate with CanModifyPolicy (this modifies\
\ network-layer WAF config, not an Azure RBAC/IAM policy)."
narrative: '{principal.name} can write AFD security policies on profile {target.name} (Microsoft.Cdn/profiles/securityPolicies/write),
enabling them to detach or replace the WAF policy and remove inbound request filtering from the AFD
endpoint.'