Virtual networks should have Azure DDoS Protection Standard enabled

Virtual Network should have DDoS Protection Plan enabled. DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP. Azure Virtual Networks are evaluated for DDoS Network Protection.

Without DDoS protection, Azure resources are only covered by DDoS Infrastructure Protection (basic), which may not mitigate sophisticated or large-scale attacks. Successful DDoS attacks cause service unavailability and potential data exposure during failover.

What this control checks

Virtual networks must have Azure DDoS Protection enabled; a disabled DDoS protection plan fails.

Common pitfalls

DDoS Network Protection has a monthly charge

Consider cost implications, because DDoS Network Protection has a monthly charge per plan.

A plan can be referenced with enable set to false

The ddos_protection_plan block in azurerm_virtual_network can reference a plan with enable set to false.

Audit evidence

Evidence that deployed resources meet this control: Prowler check network_vnet_ddos_protection_enabled (prowler azure --checks network_vnet_ddos_protection_enabled); PowerPipe control azure_compliance.control.network_ddos_enabled.

Scans of the Terraform code that flag the same setting before deployment: KICS query "Virtual Network with DDoS Protection Plan disabled" (b4cc2c52-34a6-4b43-b57c-4bdeb4514a5a).