rules:
- id: functionapp-authentication-enabled
  message: >-
    Enabling authentication ensures that all communications in the application are authenticated.
    The `auth_settings` block needs to be filled out with the appropriate auth backend settings
  patterns:
  - pattern: resource
  - pattern-not-inside: |
      resource "azurerm_function_app" "..." {
      ...
        auth_settings {
          ...
          enabled = true
          ...
        }
      ...
      }
  - pattern-either:
    - pattern-inside: |
        resource "azurerm_function_app" "..." {
        ...
        }
    - pattern-inside: |
        resource "azurerm_function_app" "..." {
        ...
          auth_settings {
            ...
            enabled = false
            ...
          }
        ...
        }
  metadata:
    cwe:
    - 'CWE-287: Improper Authentication'
    category: security
    technology:
    - terraform
    - azure
    references:
    - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#enabled
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages: [hcl]
  severity: INFO