App Service apps should have FTP deployments disabled
Azure App Service web apps are evaluated for FTP exposure via the `ftpsState` setting. Values `FtpsOnly` or `Disabled` indicate FTP is not allowed. Function apps are evaluated for the `ftps_state` setting that controls FTP/FTPS deployment endpoints.
What this control checks
Checkov CKV_AZURE_78 inspects site_config/0/ftps_state on azurerm_app_service, azurerm_linux_web_app and azurerm_windows_web_app, and expects Disabled or FtpsOnly. Prowler app_ftp_deployment_disabled says FtpsOnly or Disabled indicate FTP is not allowed, while AllAllowed means both FTP and FTPS are accepted. Prowler app_function_ftps_deployment_disabled says AllAllowed or FtpsOnly indicate deployment over FTP/FTPS is enabled, while Disabled indicates both endpoints are turned off.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are disabled
- 9.10 Ensure FTP deployments are Disabled
- 9.9 Ensure FTP deployments are Disabled
- 9.3 Ensure 'FTP State' is set to 'FTPS Only' or 'Disabled'
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_ftp_deployment_disabled - Checkov Check:
CKV_AZURE_78 - Powerpipe Control:
azure_compliance.control.appservice_ftp_deployment_disabled - Prowler Checks:
app_ftp_deployment_disabled,app_function_ftps_deployment_disabled
Last reviewed: 2026-10-10