azfun_checklist.en.json

{
    "items": [
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Select the right Function hosting plan based on your business & SLO requirements",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b",
            "id": "A01.01",
            "cost": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "a9808100-d640-4f77-ac56-1ec0600f6752",
            "id": "A01.02",
            "cost": 1,
            "severity": "High",
            "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' and tolower(kind) !contains 'workflow' | extend aspResourceId = tostring(properties.serverFarmId), managedEnvId = tostring(properties.managedEnvironmentId), sku = tostring(properties.sku) | extend sku = iif(isnotempty(sku), sku, iif(isnotempty(managedEnvId), 'ContainerApps', '')) | where sku !in ('Dynamic', 'FlexConsumption', '') | extend aspName = tostring(split(aspResourceId, '/').[-1]), managedEnvName = tostring(split(managedEnvId, '/').[-1]) | extend HostingPlan = tostring(iif(isnotempty(aspName), aspName, managedEnvName)) | project functionAppName = name, functionAppId = id, HostingPlan, sku | join kind=inner ( resources | where type =~ 'Microsoft.Web/serverfarms' or type =~ 'Microsoft.App/managedEnvironments' | extend HostingPlan = tostring(name), zoneRedundant = tostring(properties.zoneRedundant), compliant = tobool(properties.zoneRedundant) | project HostingPlan, resourceId = id, zoneRedundant, compliant ) on HostingPlan | project functionAppName, functionAppId, sku, HostingPlan, resourceId, zoneRedundant, compliant",
            "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Consider a Cross-Region DR strategy for critical workloads",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "5969d03e-eacf-4042-b127-73c55e3575fa",
            "id": "A01.03",
            "cost": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c",
            "id": "A01.04",
            "cost": 1,
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5",
            "id": "A01.05",
            "cost": 1,
            "severity": "High",
            "query": "resources | where type =~ 'Microsoft.Web/sites' and kind has 'functionapp' | where tolower(kind) !contains 'workflow' | where isnotempty(properties.serverFarmId) | extend sku = tostring(properties.sku) | where isnotempty(sku) | where sku !in ('Dynamic', 'FlexConsumption', 'ElasticPremium') | extend alwaysOn = properties.siteConfig.alwaysOn | project functionAppName = name, functionAppId = id, serverFarmId = tostring(properties.serverFarmId), sku, alwaysOn, compliant = tobool(alwaysOn)",
            "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on"
        },
        {
            "category": "BC and DR",
            "subcategory": "High Availability",
            "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled",
            "waf": "Reliability",
            "service": "Azure Functions",
            "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba",
            "id": "A01.06",
            "cost": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts"
        },
        {
            "category": "Application Deployment",
            "subcategory": "CI/CD",
            "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code",
            "waf": "Operations",
            "service": "Azure Functions",
            "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0",
            "id": "B01.01",
            "cost": 1,
            "severity": "Medium",
            "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/"
        }
    ],
    "categories": [
        {
            "name": "Identity and Access Management"
        },
        {
            "name": "Network Topology and Connectivity"
        },
        {
            "name": "BC and DR"
        },
        {
            "name": "Governance and Security"
        },
        {
            "name": "Cost Governance"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Application Deployment"
        }
    ],
    "waf": [
        {
            "name": "Reliability"
        },
        {
            "name": "Security"
        },
        {
            "name": "Cost"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Performance"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "yesno": [
        {
            "name": "Yes"
        },
        {
            "name": "No"
        }
    ],
    "metadata": {
        "name": "Azure Function Review",
        "state": "Preview",
        "waf": "all",
        "timestamp": "April 09, 2024"
    }
}