Query: Ensure that 'Python version' is the latest, if used as a part of the Web app

Description

Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for web apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. Currently, this policy only applies to Linux web apps.

Query

Tables used in this query:

terraform_resource

Controls using this query:

Ensure that 'Python version' is the latest, if used as a part of the Web app

SQL

select
  address as resource,
  case
    when (attributes_std -> 'site_config') is null then 'alarm'
    when (
      attributes_std -> 'site_config' ->> 'linux_fx_version'
    ) :: text not like 'PYTHON%' then 'ok'
    when (
      attributes_std -> 'site_config' ->> 'linux_fx_version'
    ) :: text = 'PYTHON|3.9' then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'site_config') is null then ' ''site_config'' not defined'
    when (
      attributes_std -> 'site_config' ->> 'linux_fx_version'
    ) :: text not like 'PYTHON%' then ' not using python version'
    when (
      attributes_std -> 'site_config' ->> 'linux_fx_version'
    ) :: text = 'PYTHON|3.9' then ' using the latest python version'
    else ' not using latest python version'
  end || '.' reason,
  path || ':' || start_line
from
  terraform_resource
where
  type = 'azurerm_app_service';