azure-edge-waf

Standard IDs

ID	Severity	What it checks
AFW-001	P1	Public API/SPA served with no edge WAF (Front Door or App Gateway WAF policy) in front
AFW-002	P1	WAF policy left in Detection mode — never switched to Prevention, so nothing is blocked
AFW-003	P2	No managed OWASP / Microsoft default rule set attached to the WAF policy
AFW-004	P2	No per-client rate-limit rule at the edge — L7 flooding / scraping exposure
AFW-005	P1	Origin (ACA / App Service) reachable directly, bypassing the edge — the WAF is optional, not enforced
AFW-006	P3	TLS below 1.2 at the edge, or no HTTP→HTTPS redirect

Name collision, read this: azure-waf-review is the Well-Architected Framework (reliability/security/cost/ops/performance) review and emits WAF-* IDs. This skill is the Web Application Firewall at the edge and emits AFW-* IDs. They are unrelated. Origin lockdown (AFW-005) pairs with azure-container-apps ACA-001 ingress restriction; edge rate limiting complements dotnet-rate-limiting at the app tier.

---

Check A — No edge WAF in front of a public app (AFW-001)

Detection

For a public-facing SPA/API, check that traffic enters through Azure Front Door or an Application Gateway carrying an attached Microsoft.Network/FrontDoorWebApplicationFirewallPolicies (or App Gateway firewallPolicy). A public origin with no WAF has no L7 filtering, rate limiting, or managed rule coverage at all.

BAD — App Service published straight to the internet, no WAF

// The Angular SPA + API are reachable directly on *.azurewebsites.net.
// No Front Door, no Application Gateway, no WAF policy anywhere in the template.

GOOD — Front Door with an attached WAF policy fronting the origin

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2024-02-01' = {
  name: 'afd-waf-prod'
  properties: {
    policySettings: { enabledState: 'Enabled', mode: 'Prevention' }
    managedRules: { managedRuleSets: [ { ruleSetType: 'Microsoft_DefaultRuleSet', ruleSetVersion: '2.1' } ] }
  }
}
// Front Door security policy associates wafPolicy with the endpoint fronting the app.