Repository: bridgecrewio/checkov

Issue:
CKV_AZURE_72: Missing Function Apps, Function Apps Slots and Web App Slots
**Describe the issue**

It seems that the check CKV_AZURE_72 is not being checked on:

- azurerm_linux_function_app
- azurerm_linux_function_app_slot
- azurerm_linux_web_app_slot
- azurerm_windows_function_app
- azurerm_windows_function_app_slot
- azurerm_windows_web_app_slot


**Examples**

Same as 

**Version (please complete the following information):**
 - Current
 
**Additional context**




Discussion:

Patch:
diff --git a/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py b/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py
index 30d9014a16..be153cd626 100644
--- a/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py
+++ b/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py
@@ -8,7 +8,16 @@ class AppServiceRemoteDebuggingNotEnabled(BaseResourceValueCheck):
     def __init__(self) -> None:
         name = "Ensure that remote debugging is not enabled for app services"
         id = "CKV_AZURE_72"
-        supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app')
+        supported_resources = ('azurerm_app_service',
+                               'azurerm_linux_function_app',
+                               'azurerm_linux_function_app_slot',
+                               'azurerm_linux_web_app',
+                               'azurerm_linux_web_app_slot',
+                               'azurerm_windows_function_app',
+                               'azurerm_windows_function_app_slot',
+                               'azurerm_windows_web_app',
+                               'azurerm_windows_web_app_slot'
+                               )
         categories = (CheckCategories.GENERAL_SECURITY,)
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,
                          missing_block_result=CheckResult.PASSED)


Test patch:
diff --git a/tests/terraform/checks/resource/azure/example_AppServiceRemoteDebuggingNotEnabled/main.tf b/tests/terraform/checks/resource/azure/example_AppServiceRemoteDebuggingNotEnabled/main.tf
index 24c5642bd0..6ee8a40c39 100644
--- a/tests/terraform/checks/resource/azure/example_AppServiceRemoteDebuggingNotEnabled/main.tf
+++ b/tests/terraform/checks/resource/azure/example_AppServiceRemoteDebuggingNotEnabled/main.tf
@@ -1,72 +1,149 @@
 
-                resource "azurerm_app_service" "fail" {
-                  name                = "example-app-service"
-                  location            = azurerm_resource_group.example.location
-                  resource_group_name = azurerm_resource_group.example.name
-                  app_service_plan_id = azurerm_app_service_plan.example.id
-
-                  site_config {
-                    dotnet_framework_version = "v4.0"
-                    scm_type                 = "LocalGit"
-                    remote_debugging_enabled = true
-                  }
-
-                  app_settings = {
-                    "SOME_KEY" = "some-value"
-                  }
-
-                  connection_string {
-                    name  = "Database"
-                    type  = "SQLServer"
-                    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
-                  }
-                }
-
-                resource "azurerm_app_service" "pass" {
-                  name                = "example-app-service"
-                  location            = azurerm_resource_group.example.location
-                  resource_group_name = azurerm_resource_group.example.name
-                  app_service_plan_id = azurerm_app_service_plan.example.id
-
-                  site_config {
-                    dotnet_framework_version = "v4.0"
-                    scm_type                 = "LocalGit"
-                  }
-
-                  app_settings = {
-                    "SOME_KEY" = "some-value"
-                  }
-
-                  connection_string {
-                    name  = "Database"
-                    type  = "SQLServer"
-                    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
-                  }
-                }
-
-                resource "azurerm_app_service" "pass2" {
-                  name                = "example-app-service"
-                  location            = azurerm_resource_group.example.location
-                  resource_group_name = azurerm_resource_group.example.name
-                  app_service_plan_id = azurerm_app_service_plan.example.id
-
-                  site_config {
-                    dotnet_framework_version = "v4.0"
-                    scm_type                 = "LocalGit"
-                    remote_debugging_enabled = false
-                  }
-
-                  app_settings = {
-                    "SOME_KEY" = "some-value"
-                  }
-
-                  connection_string {
-                    name  = "Database"
-                    type  = "SQLServer"
-                    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
-                  }
-
-                }
+resource "azurerm_app_service" "fail" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+    remote_debugging_enabled = true
+  }
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+}
+
+resource "azurerm_app_service" "pass" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+  }
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+}
+
+resource "azurerm_app_service" "pass2" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+    remote_debugging_enabled = false
+  }
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+
+}
+
+
+resource "azurerm_linux_function_app" "fail" {
+  name                = "example-linux-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
+
+resource "azurerm_linux_function_app" "pass" {
+  name                = "example-linux-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_linux_function_app" "pass2" {
+  name                = "example-linux-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {
+  }
+}
+
+resource "azurerm_linux_web_app_slot" "fail" {
+  name           = "example-slot"
+  app_service_id = azurerm_linux_web_app.example.id
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
+
+resource "azurerm_linux_web_app_slot" "pass" {
+  name           = "example-slot"
+  app_service_id = azurerm_linux_web_app.example.id
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_linux_web_app_slot" "pass2" {
+  name           = "example-slot"
+  app_service_id = azurerm_linux_web_app.example.id
+
+  site_config {}
+}
+
+resource "azurerm_linux_web_app" "fail" {
+  name                = "example"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_service_plan.example.location
+  service_plan_id     = azurerm_service_plan.example.id
+
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
 
 resource "azurerm_linux_web_app" "pass" {
   name                = "example"
@@ -89,7 +166,103 @@ resource "azurerm_linux_web_app" "pass2" {
   }
 }
 
-                resource "azurerm_linux_web_app" "fail" {
+resource "azurerm_linux_function_app_slot" "fail" {
+  name                 = "example-linux-function-app-slot"
+  function_app_id      = azurerm_linux_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
+
+resource "azurerm_linux_function_app_slot" "pass" {
+  name                 = "example-linux-function-app-slot"
+  function_app_id      = azurerm_linux_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {}
+}
+
+resource "azurerm_linux_function_app_slot" "pass2" {
+  name                 = "example-linux-function-app-slot"
+  function_app_id      = azurerm_linux_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_windows_function_app" "fail" {
+  name                = "example-windows-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
+
+resource "azurerm_windows_function_app" "pass" {
+  name                = "example-windows-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_windows_function_app" "pass2" {
+  name                = "example-windows-function-app"
+  resource_group_name = azurerm_resource_group.example.name
+  location            = azurerm_resource_group.example.location
+
+  storage_account_name       = azurerm_storage_account.example.name
+  storage_account_access_key = azurerm_storage_account.example.primary_access_key
+  service_plan_id            = azurerm_service_plan.example.id
+
+  site_config {}
+}
+
+resource "azurerm_windows_function_app_slot" "fail" {
+  name                 = "example-slot"
+  function_app_id      = azurerm_windows_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {
+    remote_debugging_enabled = true
+  }
+}
+
+resource "azurerm_windows_function_app_slot" "pass" {
+  name                 = "example-slot"
+  function_app_id      = azurerm_windows_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {}
+}
+
+resource "azurerm_windows_function_app_slot" "pass2" {
+  name                 = "example-slot"
+  function_app_id      = azurerm_windows_function_app.example.id
+  storage_account_name = azurerm_storage_account.example.name
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_windows_web_app" "fail" {
   name                = "example"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_service_plan.example.location
@@ -100,7 +273,7 @@ resource "azurerm_linux_web_app" "pass2" {
   }
 }
 
-                resource "azurerm_windows_web_app" "pass" {
+resource "azurerm_windows_web_app" "pass" {
   name                = "example"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_service_plan.example.location
@@ -109,7 +282,7 @@ resource "azurerm_linux_web_app" "pass2" {
   site_config {}
 }
 
-                resource "azurerm_windows_web_app" "pass2" {
+resource "azurerm_windows_web_app" "pass2" {
   name                = "example"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_service_plan.example.location
@@ -120,13 +293,27 @@ resource "azurerm_linux_web_app" "pass2" {
   }
 }
 
-resource "azurerm_windows_web_app" "fail" {
-  name                = "example"
-  resource_group_name = azurerm_resource_group.example.name
-  location            = azurerm_service_plan.example.location
-  service_plan_id     = azurerm_service_plan.example.id
+resource "azurerm_windows_web_app_slot" "fail" {
+  name           = "example-slot"
+  app_service_id = azurerm_windows_web_app.example.id
 
   site_config {
     remote_debugging_enabled = true
   }
+}
+
+resource "azurerm_windows_web_app_slot" "pass" {
+  name           = "example-slot"
+  app_service_id = azurerm_windows_web_app.example.id
+
+  site_config {
+    remote_debugging_enabled = false
+  }
+}
+
+resource "azurerm_windows_web_app_slot" "pass2" {
+  name           = "example-slot"
+  app_service_id = azurerm_windows_web_app.example.id
+
+  site_config {}
 }
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/azure/test_AppServiceRemoteDebuggingNotEnabled.py b/tests/terraform/checks/resource/azure/test_AppServiceRemoteDebuggingNotEnabled.py
index 17b9134385..3fafc139fc 100644
--- a/tests/terraform/checks/resource/azure/test_AppServiceRemoteDebuggingNotEnabled.py
+++ b/tests/terraform/checks/resource/azure/test_AppServiceRemoteDebuggingNotEnabled.py
@@ -21,14 +21,32 @@ def test(self):
             'azurerm_app_service.pass',
             'azurerm_windows_web_app.pass',
             'azurerm_linux_web_app.pass',
+            'azurerm_linux_function_app.pass',
+            'azurerm_linux_function_app_slot.pass',
+            'azurerm_linux_web_app_slot.pass',
+            'azurerm_windows_function_app.pass',
+            'azurerm_windows_function_app_slot.pass',
+            'azurerm_windows_web_app_slot.pass',
             'azurerm_app_service.pass2',
             'azurerm_windows_web_app.pass2',
             'azurerm_linux_web_app.pass2',
+            'azurerm_linux_function_app.pass2',
+            'azurerm_linux_function_app_slot.pass2',
+            'azurerm_linux_web_app_slot.pass2',
+            'azurerm_windows_function_app.pass2',
+            'azurerm_windows_function_app_slot.pass2',
+            'azurerm_windows_web_app_slot.pass2',
         }
         failing_resources = {
             'azurerm_app_service.fail',
             'azurerm_windows_web_app.fail',
             'azurerm_linux_web_app.fail',
+            'azurerm_linux_function_app.fail',
+            'azurerm_linux_function_app_slot.fail',
+            'azurerm_linux_web_app_slot.fail',
+            'azurerm_windows_function_app.fail',
+            'azurerm_windows_function_app_slot.fail',
+            'azurerm_windows_web_app_slot.fail',
         }
         skipped_resources = {}
 
diff --git a/tests/terraform/image_referencer/test_runner_azure_resources.py b/tests/terraform/image_referencer/test_runner_azure_resources.py
index fab53e9b0a..853096a214 100644
--- a/tests/terraform/image_referencer/test_runner_azure_resources.py
+++ b/tests/terraform/image_referencer/test_runner_azure_resources.py
@@ -134,7 +134,7 @@ def test_app_service_linux_function_resources(mocker: MockerFixture, graph_frame
     sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE)
 
     assert len(tf_report.resources) == 2
-    assert len(tf_report.passed_checks) == 2
+    assert len(tf_report.passed_checks) == 4
     assert len(tf_report.failed_checks) == 4
     assert len(tf_report.skipped_checks) == 0
     assert len(tf_report.parsing_errors) == 0
@@ -181,7 +181,7 @@ def test_app_service_linux_web_resources(mocker: MockerFixture, graph_framework)
     sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE)
 
     assert len(tf_report.resources) == 2
-    assert len(tf_report.passed_checks) == 4
+    assert len(tf_report.passed_checks) == 5
     assert len(tf_report.failed_checks) == 14
     assert len(tf_report.skipped_checks) == 0
     assert len(tf_report.parsing_errors) == 0
@@ -270,7 +270,7 @@ def test_app_service_windows_web_resources(mocker: MockerFixture, graph_framewor
     sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE)
 
     assert len(tf_report.resources) == 2
-    assert len(tf_report.passed_checks) == 4
+    assert len(tf_report.passed_checks) == 5
     # Changed from 13 to 14 due to PR #5687
     assert len(tf_report.failed_checks) == 14
     assert len(tf_report.skipped_checks) == 0