App Service apps should not allow CORS access from every resource
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. The policy flags App Service apps with CORS configured to allow every resource.
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app.
What this control checks
App Service apps must not have allowedOrigins set to * in CORS configuration
Common pitfalls
Missing attribute passes the check
Checkov CKV_AZURE_57 passes when site_config/[0]/cors/[0]/allowed_origins is missing.
Function apps are not checked
The policy applies to Microsoft.Web/sites where the kind does not contain functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should not have CORS configured to allow every resource to access your apps" (5744710e-cc2f-4ee8-8809-3b11e89f4bc9); PowerPipe controls azure_compliance.control.appservice_api_app_cors_no_star and azure_compliance.control.appservice_web_app_cors_no_star.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_57.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement) and CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- CM-6 Configuration Settings
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
- 0901.09s1Organizational.1-09.s 09.08 Exchange of Information
- 0916.09s2Organizational.4-09.s 09.08 Exchange of Information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_cors_no_star - Checkov Check:
CKV_AZURE_57 - Powerpipe Controls:
azure_compliance.control.appservice_api_app_cors_no_star,azure_compliance.control.appservice_web_app_cors_no_star - Azure Policy Definition:
5744710e-cc2f-4ee8-8809-3b11e89f4bc9
Last reviewed: 2026-10-10