App Service - consider using latest TLS version

This FinOps policy requires Azure App Service to use TLS 1.2 or higher for all inbound connections. TLS 1.0 and 1.1 are deprecated protocols with documented vulnerabilities that expose workloads to downgrade attacks and compliance failures. Enforcing a minimum TLS version at the infrastructure level is a one-line Terraform change that reduces security risk without increasing cloud costs.

Infracost detects this misconfiguration automatically in CI/CD and surfaces it as a policy finding in the PR comment — before the code is merged. It is available in the free trial, with no admin setup required.

Why This Policy Matters

How It Helps Reduce Cloud Costs

TLS version enforcement does not directly reduce compute spend, but it prevents the indirect costs of a security incident. Misconfigured App Services running deprecated TLS versions can trigger compliance failures, which result in remediation work, audit overhead, and potential fines.

Retroactive remediation is more expensive than enforcement at deploy time. A platform engineer who catches a TLS misconfiguration in a PR spends minutes fixing it. The same misconfiguration caught in a production audit can take days to trace, document, and resolve.

Infracost catches this at the PR stage — before deployment — which is where runtime cost tools like Vantage, CloudZero, or Azure Cost Management cannot reach. This policy does not require changes to any existing runtime cost tooling. It runs alongside whatever is already in the stack.

This policy maps to the Security pillar of the Azure Well-Architected Framework and to the Cost Optimization pillarthrough reduced remediation overhead. Teams that reference WAF pillar alignment in architecture reviews will find this control already documented.

Potential Savings

Security remediation work commonly takes 4-8 hours of engineer time per finding. Across a platform team managing dozens of App Services, undetected TLS misconfigurations accumulate quickly.

Enforcing TLS 1.2 as a FinOps policy in Terraform eliminates this class of finding entirely. A platform team that adds this to their shared module and runs Infracost in CI can report zero TLS compliance findings across all new deployments — a concrete, trackable metric for engineering leadership.

Implementation Guide

Infrastructure-as-Code Example (Terraform)

The following examples show a non-compliant App Service configuration and the corrected version.

Non-compliant configuration — TLS version not specified or set too low:

This configuration defaults to TLS 1.0. This is a common source of compliance failures.

Compliant configuration — TLS 1.2 enforced:

Setting min_tls_version = "1.2" ensures the App Service rejects connections from clients using TLS 1.0 or 1.1.

Step-by-Step Fix Instructions

1. Open the Terraform configuration for the affected azurerm_app_service or azurerm_linux_web_app / azurerm_windows_web_app resource.

2. Locate the site_config block. If it does not exist, add it.

3. Set min_tls_version = "1.2" inside site_config.

4. Run terraform plan to confirm the change is non-destructive. Azure applies this setting without restarting the App Service.

5. Apply the change and verify in the Azure portal under Configuration > General settings > Minimum inbound TLS version.

6. Add Infracost to your CI/CD pipeline to catch this misconfiguration automatically on future PRs.

Best Practices

• Set min_tls_version = "1.2" as the org-wide default in shared Terraform modules. This removes the need for individual teams to remember the setting.

• Do not set min_tls_version = "1.0" or "1.1" in any environment, including development. Development environments with weak TLS are routinely used as stepping stones in lateral movement attacks.

• Review all existing App Services using Azure Policy or Infracost to identify resources that were deployed before this standard was enforced.

• Combine TLS enforcement with HTTPS-only mode (https_only = true) for full transport security coverage.

Tools and Scripts

Infracost supports this policy check in its free trial and paid plans. When Infracost runs in CI/CD, it evaluates the min_tls_version attribute on azurerm_app_service, azurerm_linux_web_app, and azurerm_windows_web_app resources. A violation surfaces as a warning in the PR comment before the code is merged. It does not block the pipeline by default — the finding is visible, not a hard gate, unless configured otherwise.

This gives platform engineers a pre-deploy signal rather than a post-deploy audit finding. Post-deploy runtime tools such as Azure Cost Management or third-party FinOps platforms do not surface TLS misconfigurations because they operate on live resource metadata, not IaC intent. Infracost fills this gap at the source.

Infracost enables teams to track policy violation rates over time, which supports the goal of burning down compliance debt incrementally. Developer support after rollout is handled by Infracost's own documentation and support channels — platform engineers are not responsible for triaging Infracost findings raised by their developers.

To scan existing infrastructure for this violation using the Azure CLI:

az webapp list --query "[].{Name:name, ResourceGroup:resourceGroup}" --output table
az webapp config show --name <app-name> --resource-group <rg-name> --query

az webapp list --query "[].{Name:name, ResourceGroup:resourceGroup}" --output table
az webapp config show --name <app-name> --resource-group <rg-name> --query

az webapp list --query "[].{Name:name, ResourceGroup:resourceGroup}" --output table
az webapp config show --name <app-name> --resource-group <rg-name> --query

Examples of Impact

Platform team enforcing policy via Terraform module:

A platform team at a mid-size SaaS company manages 40 App Services across three environments. Before enforcing this policy, TLS version was not specified in the base module, which meant every new App Service defaulted to TLS 1.0. After adding min_tls_version = "1.2" to the shared module and running Infracost in the CI pipeline, all new deployments are compliant by default. The team no longer receives compliance findings for TLS version on App Services.

Remediating existing resources at scale:

A DevOps engineer discovers that 15 production App Services are running with TLS 1.0 defaults after an internal security review. Using the Azure CLI and a Terraform state audit, the engineer updates all 15 resources in a single PR. Infracost validates the fix before merge. The compliance backlog for this control drops to zero.

Considerations and Caveats

• Client compatibility: Enforcing TLS 1.2 rejects connections from clients that only support TLS 1.0 or 1.1. Most modern browsers and HTTP clients support TLS 1.2, but legacy internal systems may not. Audit client software before enforcing this policy on externally-facing services.

• Applies to inbound connections only: min_tls_version controls inbound TLS. It does not affect outbound connections from the App Service to downstream dependencies.

• Azure resource type coverage: This setting applies to azurerm_app_service, azurerm_linux_web_app, and azurerm_windows_web_app. It does not apply to Azure Functions or Static Web Apps, which have separate TLS configuration surfaces.

• Non-destructive change: Updating min_tls_version does not require a restart and does not incur downtime. The change takes effect within a few seconds of apply.

• TLS 1.3 availability: Azure App Service supports TLS 1.3 on newer runtime stacks. Teams on current runtimes can consider setting min_tls_version = "1.3" for stronger security.

Frequently Asked Questions (FAQs)

Is this policy supported in Infracost?

Yes. Infracost detects missing or non-compliant min_tls_version settings on Azure App Service resources as part of its policy engine. This check is available in the free trial and all paid plans.

Can this policy be customized?

Yes. Teams that require TLS 1.3 can adjust the policy threshold in Infracost to flag any configuration below 1.3. The default threshold is TLS 1.2, which aligns with current industry and regulatory standards.

Does Infracost automatically fix violations?

Infracost identifies and reports violations in the PR stage, enabling engineers to fix the configuration before deployment. It does not apply fixes directly. The fix is a one-line Terraform change that takes under a minute to make.

Is this policy cloud-agnostic?

This specific policy targets Azure App Service and its Terraform provider (azurerm). AWS and GCP have equivalent TLS version controls on their respective web hosting and compute services, but the Terraform resource names and attribute paths differ.

How often should I review policy compliance?

Teams with Infracost in CI/CD get continuous enforcement on every PR. For existing infrastructure not covered by IaC, run a quarterly audit using the Azure CLI or Azure Policy to identify resources that fall outside the TLS 1.2 baseline.

Does this policy affect App Service cost?

No. Changing min_tls_version does not affect the pricing tier, compute allocation, or billing of an Azure App Service. It is a security configuration change with no cost impact.

What happens if a client connects using TLS 1.0 or 1.1?

Azure App Service rejects the connection and returns a handshake failure. The client receives an error and the request does not reach the application. This is the intended behavior.