Profile Applicability:

  • Level 1

Description:

This check ensures that the web app hosted in Azure App Service is using a supported version of Python. Python is a widely used programming language, and ensuring that the version used by your app is currently supported helps mitigate security risks, ensures compatibility with libraries, and provides access to the latest features.

Rationale:

Using an unsupported Python version can expose your application to security vulnerabilities, as older versions do not receive security patches or updates. Additionally, outdated Python versions may not be compatible with modern libraries, frameworks, or features. Ensuring that the app uses a supported version of Python helps keep the application secure and functional.

Impact:

Pros:

  • Ensures the app runs on a secure and stable version of Python.

  • Reduces the risk of security vulnerabilities associated with outdated Python versions.

  • Improves compatibility with modern libraries, tools, and frameworks.

Cons:

  • Updating Python versions may require code adjustments or testing to ensure compatibility with new language features or changes in deprecated functionality.

  • Some older Python-based applications may require modifications to work with newer Python versions.

Default Value:

By default, Azure App Service supports several versions of Python. However, it is up to the app owner to ensure that the latest version or a compatible version is used.

Pre-requisites:

Ensure that the app's code and dependencies are compatible with the Python version configured in Azure App Service. Verify that the app supports modern Python versions if you are upgrading from an older one.

Test Plan:

Using Azure Console:

  1. Log in to the Azure portal at https://portal.azure.com.

  2. Go to the App Services blade.

  3. Select the app you want to review.

  4. Under the Settings section, click on Configuration.

  5. In the General Settings section, check the Python version used for the app.

  6. Verify that the Python version displayed is one of the currently supported versions (e.g., Python 3.7 or higher).

Using Azure CLI:

To check the Python version used by the app, run the following command:

az webapp config show --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --query pythonVersion

  1. The output should return the Python version in use by the app. Verify that the version is supported by the Python community and Azure App Service.

Implementation Plan:

Using Azure Console:

  1. Log in to the Azure portal at https://portal.azure.com.

  2. Go to App Services.

  3. Select the app for which you want to configure the Python version.

  4. Under the Settings section, click on Configuration.

  5. In the General Settings section, select the latest supported Python version (e.g., Python 3.9, Python 3.8).

  6. Click Save to apply the changes.

Using Azure CLI:

To set the Python version for an app, run the following command:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --python-version <PYTHON_VERSION>

 Example:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --python-version 3.8

Backout Plan:

Using Azure Console:

  1. Log in to the Azure portal at https://portal.azure.com.

  2. Go to App Services.

  3. Select the app for which you want to revert the Python version.

  4. Under the Settings section, click on Configuration.

  5. In the General Settings section, change the Python version to the previous version.

  6. Click Save to apply the changes.

Using Azure CLI:

To revert the Python version, run the following command:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --python-version <PREVIOUS_PYTHON_VERSION>

 Example:

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --python-version 3.7

References: