{"id":18880444,"url":"https://github.com/moimhossain/azure-application-gateway","last_synced_at":"2025-08-11T23:06:25.171Z","repository":{"id":75024504,"uuid":"125100201","full_name":"MoimHossain/azure-application-gateway","owner":"MoimHossain","description":"Provision Azure Application Gateway to protect an existing Azure Web site","archived":false,"fork":false,"pushed_at":"2018-04-03T08:02:36.000Z","size":22,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-05-23T22:37:09.651Z","etag":null,"topics":["azure-application-gateway","azure-resource-group-deployment","azure-resource-manager","azure-resources","azure-webapp","azure-website","azure-websites","powershell","powershell-script","ssl","ssl-certificate","ssl-certificates","waf","web-application-firewall","web-application-security"],"latest_commit_sha":null,"homepage":null,"language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MoimHossain.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-03-13T18:56:26.000Z","updated_at":"2023-11-09T09:10:01.000Z","dependencies_parsed_at":null,"dependency_job_id":"5eebec3b-3999-4bfe-ba14-8b7bff82360a","html_url":"https://github.com/MoimHossain/azure-application-gateway","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/MoimHossain/azure-application-gateway","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MoimHossain%2Fazure-application-gateway","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MoimHossain%2Fazure-application-gateway/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MoimHossain%2Fazure-application-gateway/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MoimHossain%2Fazure-application-gateway/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MoimHossain","download_url":"https://codeload.github.com/MoimHossain/azure-application-gateway/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MoimHossain%2Fazure-application-gateway/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":269970120,"owners_count":24505466,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-11T02:00:10.019Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure-application-gateway","azure-resource-group-deployment","azure-resource-manager","azure-resources","azure-webapp","azure-website","azure-websites","powershell","powershell-script","ssl","ssl-certificate","ssl-certificates","waf","web-application-firewall","web-application-security"],"created_at":"2024-11-08T06:43:57.105Z","updated_at":"2025-08-11T23:06:25.148Z","avatar_url":"https://github.com/MoimHossain.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# What is this? \n\nThis repository contains Azure **Resource Manager Templates** that provisions an **Azure Application Gateway** to protect access to an **Azure web site** (Azure web apps). \n\n# Why?\n\nIn order to met higher compliance demands and often as **security best practices**, we want to put an Azure web site behind a **Web Application Firewall (aka WAF)**. The **WAF** provides known malitious security attack vectors mitigations defined in **OWASP top 10** security vulnerabilities. Azure Application Gateway is a layer 7 load balancer that provides WAF out of the box. However, restricting a Web App access with Application Gatway is not trivial. \n\nTo achieve the best isolation and hence protection, we need to provision Azure **Application Service Environment (aka ASE)** and put all the web apps inside the virtual network of the ASE. But ASE deployment has some other consequences, it is Costly, and also, because the web apps are now toally isolated and sitting in a private VNET, dev-team needs to adopt a unusual deployment pipeline to continuously deploy changes into the web apps. \n\nHowever, there's an intermidiate solution architecture that provdes WAF without gettting into the complexities that AES brings into the solution architecture. This repository will help addressing that architecture.\n\n# How to do that?\n\nThis repository contains a RM template that will provision the following:\n\n- Virtual network (Application Gateway needs a Virtual network).\n- Subnet for the Application Gateway into the virtual network.\n- Public IP address for the Application Gateway.\n- An Application Gateway that pre-configured to protect any Azure Web site.\n\n## How to provision?\n\nBefore you run the scripts you need the following: \n\n- Azure subscription\n- Azure web site to guard with WAF\n- SSL certificate to configure the Front-End listeners. (This is the Gateway Certificate which will be approached by the end-users of your apps). Typically a PFX file.\n-  The password of the PFX file.\n- SSL certificate that used to protect the Azure web sites, typically a *.cer file. This can be the *.azurewebsites.net for development purpose. \n\nYou need to fill out the ```parameters.json``` file with the appropriate values, some examples are given below:\n\n```\n        \"vnetName\": {\n            \"value\": \"vnetazuregatewaywilkin\"\n        },\n        \"appGatewayName\": {\n            \"value\": \"WilkinAppGateway\"\n        },\n        \"azureWebsiteFqdn\": {\n            \"value\": \"vulnerableapp.azurewebsites.net\"\n        },\n        \"frontendCertificateData\": {\n            \"value\": \"\"\n        },\n        \"frontendCertificatePassword\": {\n            \"value\": \"\"\n        },\n        \"backendCertificateData\": {\n            \"value\": \"\"\n        }\n```\n\nHere, ```frontendCertificateData``` needs to be **Base64 encoded** content of your __pfx__ file.\n\nOnce you have the pre-requisites, go to powershell and run:\n\n```\n    $\u003e ./deploy.ps1 `\n        -subscriptionId \"\u003c enter your subscription id \u003e\" `\n        -resourceGroupName \"\u003c enter your resource group name \u003e\"\n```\n\nThis will provision the **Application Gatway** in your resource group. \n\n# Important !\nThe final piece of work that you need to do, is to whitelist the IP address of the **Application Gatway** into your Azure Web App. This is to make sure, nobody can manage a direct access to your Azure web app, unless they come through the gateway only.\n\n# Contribute\n\nContribution is always appreciated.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoimhossain%2Fazure-application-gateway","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoimhossain%2Fazure-application-gateway","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoimhossain%2Fazure-application-gateway/lists"}