azure-func-anonymous-http
A Function app with a public hostname and an anonymous-auth HTTP trigger.
where
app default hostname is public (no access restrictions, publicNetworkAccess != Disabled, no private-endpoint-only)
at least one HTTP-triggered function has authLevel == anonymous
emit
| target type | AnonymousIdentity |
|---|---|
| source | <function app> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{app.name} exposes an anonymous HTTP-triggered function to the internet (public hostname + authLevel anonymous).
Raw rule rules/derived/azure/functions.yaml
id: azure-func-anonymous-http
emits: ExposedToInternet
description: A Function app with a public hostname and an anonymous-auth HTTP trigger.
where:
- app default hostname is public (no access restrictions, publicNetworkAccess != Disabled, no private-endpoint-only)
- at least one HTTP-triggered function has authLevel == anonymous
emit:
target_type: AnonymousIdentity
source: <function app>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Do not emit if access restrictions / private endpoint block public traffic, or
if all HTTP functions require a key. A key-only function is not anonymously exposed.
narrative: '{app.name} exposes an anonymous HTTP-triggered function to the internet (public hostname
+ authLevel anonymous).'