Support setting minTlsCipherSuite on App Service

[camtittle]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Azure app service supports specifying the minimum TLS cipher suite to allow for incoming traffic. This can be set via the update config API's minTlsCipherSuite field.

See the Azure App Service blog for more details.

It would be great to be able specify this field in Terraform configuration.

New or Affected Resource(s)/Data Source(s)

azurerm_linux_web_app, azurerm_windows_web_app

Potential Terraform Configuration

resource "azurerm_linux_web_app" "example" {
  name                = "example"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_service_plan.example.location
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    minTlsCipherSuite = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
  }
}

References

No response

[xiaxyi]

Thanks @camtittle for raising this request, let me check and add it to our backlog once confirmed.

[xiaxyi]

The property is available in next api version 2023-01-01, may not be able to put it with high priority, need to check.

[joshfrias]

The above PR doesn't cover azurerm_windows_web_app. I hope this issue isn't closed before that.

[cleverer]

@xiaxyi it looks like the new properties got never implemented/dropped (even though the API version got upgraded to 2023-01-01) when #24447 got superseded by #24483. Is that correct?

Is there anything I can help to get those implemented?

[xiaxyi]

Hi all, the property is added in the mentioned pr. Feel free to track it for any progress.

[DempseySbaiz]

Any updates on this please, our client is asking for this feature.

[fabiostawinski]

Meanwhile you may use azapi (1.15.0) for that

resource "azapi_update_resource" "minTlsCipherSuite" {
  type        = "Microsoft.Web/sites@2023-01-01"
  resource_id = azurerm_linux_web_app.linux_web_app.id
  body = jsonencode({
    properties = {
      siteConfig = {
        minTlsCipherSuite = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
      }
    }
  })

  response_export_values = ["properties"]
}

[rmcolbert]

This capability officially went GA in Azure last month. Please revisit.

[man0s]

Any update on this one?