Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App

Risk Level: Low
Cloud Entity: Web Apps service
CloudGuard Rule ID: D9.AZU.CRY.41
Covered by Spectral: No
Category: Compute

GSL LOGIC

WebApp where config.linuxFxVersion regexMatch /PYTHON*/ should have config.linuxFxVersion='PYTHON|3.8'

REMEDIATION

From Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to 'App Services'.
3. Click on each Linux WebApp.
4. Under 'Settings' section, click on 'Configuration'.
5. Click on the 'General settings' pane, ensure that for a Stack of 'Python' and a Major version of Python 3, that the Minor version is set to the latest available stable release.
6. Click Save.

NOTE: No action is required If Python version is set to Off as Python is not used by your web app

From TF

Set the latest Python version as below:

resource "azurerm_linux_web_app" "example" {
	..
	site_config {
		..
		application_stack{
			current_stack = "Python"
			Python_version = "Latest-Python-Version"
		}
		..
	}
	..
}

From Command Line

To see the list of supported runtimes:

az webapp list-runtimes --os windows | grep Python

To set latest Python version for an existing app, run the following command:

az webapp config set --resource-group RESOURCEGROUP --name WEBAPP --linux-fx-version VERSION

References

1. https://docs.microsoft.com/en-us/azure/app-service/configure-language-Python?pivots=platform-windows
2. https://docs.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal
3. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#python_version

Web Apps service

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

Compliance Frameworks

• Azure CIS Foundations v. 1.2.0
• Azure CIS Foundations v. 1.3.0
• Azure CIS Foundations v. 1.3.1
• Azure CIS Foundations v. 1.4.0
• Azure CIS Foundations v. 1.5.0
• Azure CIS Foundations v.2.0
• Azure CloudGuard Best Practices
• Azure NIST 800-53 Rev 5
• CloudGuard Azure All Rules Ruleset