Description
If a Function App permits unencrypted FTP and uses it for deployment, publishing credentials and function files can be exposed in transit. Restrict publishing to FTPS, or disable FTP publishing when it is not needed. This setting is separate from HTTPS protection for function web requests.
Potential impact
- Publishing credentials sent over plaintext FTP can be exposed.
- Function code and configuration files may lack protection in transit.
- Stolen publishing credentials can be used to change deployed content.
Remediation
Set site_config.ftps_state to FtpsOnly when FTP publishing is needed, or Disabled when it is not. Use an approved encrypted deployment path and restrict publishing credentials and deployment permissions. Verify that deployment works and plaintext FTP connections are rejected.
Examples
These excerpts compare FTP settings on the legacy AzureRM 3.x azurerm_function_app resource. Required storage settings are omitted. Defaults can differ in current resources, so check the effective publishing configuration.
Before
resource "azurerm_function_app" "example" {
name = "test-azure-functions"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
app_service_plan_id = azurerm_app_service_plan.example.id
site_config {
http2_enabled = true
ftps_state = "AllAllowed"
}
}
After
resource "azurerm_function_app" "example" {
name = "test-azure-functions"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
app_service_plan_id = azurerm_app_service_plan.example.id
site_config {
ftps_state = "FtpsOnly"
}
}
The before value AllAllowed permits plaintext FTP. The after value FtpsOnly restricts file transfers to FTPS. Use Disabled if FTP publishing is unnecessary.