services / Azure / Application Gateway WAF policy

An Application Gateway Web Application Firewall (WAF) policy is the managed rule engine that inspects and filters HTTP/S traffic to internet-facing applications fronted by an Application Gateway, blocking common web attacks.

A WAF policy is the security control filtering traffic to public applications; weakening or removing it exposes the fronted apps to attack, so mutation of the policy is a defense/policy concern.

Microsoft.​Network/​ApplicationGatewayWebApplicationFirewallPolicies/​delete

Deleting the policy removes the WAF rule set entirely, tearing down the security control that inspects traffic to the fronted applications.

Risks

1. Policy destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links