In the typical architecture the security harden is achieved by allowing only Azure FrontDoor Service tag Inbound Traffic from the AKS Subnet NSG. AzureFrontDoor.Backend Service Tag Any Azure Front Door Profile can make requests to the Kubernetes Nginx Ingress Controller since AzureFrontDoor.Backend Service Tag is allowed. The WAF can be bypassed when requests are initiated from another Azure Front Door profiles. Azure Front Door runs…