MEDIUM
Source
Trivy
ID
AVD-AZU-0070

App Service Using Unsupported Python Version

Using an unsupported Python runtime in Azure App Service may expose applications to security vulnerabilities as these versions no longer receive security patches. This check ensures Python versions are still supported by the Python Foundation.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Update to a supported Python version (3.9 or higher). Consider migrating from azurerm_app_service to azurerm_linux_web_app for access to modern Python versions.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# Supported Python version (3.9 or higher)
resource "azurerm_app_service" "good_example_supported" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    python_version = "3.9"
  }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# Current stable version
resource "azurerm_app_service" "good_example_current" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    python_version = "3.12"
  }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# No Python version specified - not using Python
resource "azurerm_app_service" "good_example_no_python" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    # No Python version specified - not using Python
  }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
# Modern Linux Web App with latest Python (recommended approach)
resource "azurerm_linux_web_app" "good_example_modern" {
  name                = "example-linux-webapp"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  service_plan_id     = azurerm_service_plan.example.id

  site_config {
    application_stack {
      python_version = "3.12"
    }
  }
}