Skip to content

Commit

Permalink
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
Browse files Browse the repository at this point in the history
…icep into patch-policy-library
  • Loading branch information
oZakari committed Oct 19, 2024
2 parents 553d7f4 + 49ba8cb commit 331063e
Show file tree
Hide file tree
Showing 28 changed files with 856 additions and 41 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,7 @@ var varPolicyAssignmentDeployVMChangeTrack = {
libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json')
}

var varPolicyAssignmentDeployVMMonitoring = {
var varPolicyAssignmentDeployVMMonitor24 = {
definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/924bfe3a-762f-40e7-86dd-5c8b95eb09e6'
libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json')
}
Expand All @@ -263,7 +263,7 @@ var varPolicyAssignmentDeployVMSSChangeTrack = {
libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json')
}

var varPolicyAssignmentDeployVMSSMonitoring = {
var varPolicyAssignmentDeployVMSSMonitor24 = {
definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/f5bf694c-cca7-4033-b883-3a23327d5485'
libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json')
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "AppService append sites with minimum TLS version to enforce.",
"description": "Append the AppService sites object to ensure that min Tls version is set to required minimum TLS version. Please note Append does not enforce compliance use then deny.",
"metadata": {
"version": "1.1.0",
"version": "1.2.0",
"category": "App Service",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand All @@ -35,6 +35,7 @@
"type": "String",
"defaultValue": "1.2",
"allowedValues": [
"1.3",
"1.2",
"1.0",
"1.1"
Expand All @@ -54,7 +55,7 @@
},
{
"field": "Microsoft.Web/sites/config/minTlsVersion",
"notEquals": "[parameters('minTlsVersion')]"
"less": "[parameters('minTlsVersion')]"
}
]
},
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure Cache for Redis Append a specific min TLS version requirement and enforce TLS.",
"description": "Append a specific min TLS version requirement and enforce SSL on Azure Cache for Redis. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "Cache",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -56,7 +56,7 @@
"anyOf": [
{
"field": "Microsoft.Cache/Redis/minimumTlsVersion",
"notequals": "[parameters('minimumTlsVersion')]"
"less": "[parameters('minimumTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Event Hub namespaces should use a valid TLS version",
"description": "Event Hub namespaces should use a valid TLS version.",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "Event Hub",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -52,7 +52,7 @@
"anyOf": [
{
"field": "Microsoft.EventHub/namespaces/minimumTlsVersion",
"notEquals": "[parameters('minTlsVersion')]"
"less": "[parameters('minTlsVersion')]"
},
{
"field": "Microsoft.EventHub/namespaces/minimumTlsVersion",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "MySQL database servers enforce SSL connections.",
"description": "Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -66,7 +66,7 @@
},
{
"field": "Microsoft.DBforMySQL/servers/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure Cache for Redis only secure connections should be enabled",
"description": "Audit enabling of only connections via SSL to Azure Cache for Redis. Validate both minimum TLS version and enableNonSslPort is disabled. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "Cache",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -41,7 +41,7 @@
"1.0"
],
"metadata": {
"displayName": "Select minumum TLS version for Azure Cache for Redis.",
"displayName": "Select minimum TLS version for Azure Cache for Redis.",
"description": "Select minimum TLS version for Azure Cache for Redis."
}
}
Expand All @@ -61,7 +61,7 @@
},
{
"field": "Microsoft.Cache/Redis/minimumTlsVersion",
"notequals": "[parameters('minimumTlsVersion')]"
"less": "[parameters('minimumTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure SQL Database should have the minimal TLS version set to the highest version",
"description": "Setting minimal TLS version to 1.2 improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not reccomended since they have well documented security vunerabilities.",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -61,7 +61,7 @@
},
{
"field": "Microsoft.Sql/servers/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@
"policyType": "Custom",
"mode": "Indexed",
"displayName": "SQL Managed Instance should have the minimal TLS version set to the highest version",
"description": "Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not reccomended since they have well documented security vunerabilities.",
"description": "Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not recommended since they have well documented security vulnerabilities.",
"metadata": {
"version": "1.0.0",
"version": "1.1.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -61,7 +61,7 @@
},
{
"field": "Microsoft.Sql/managedInstances/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Deny vNet peering cross subscription.",
"description": "This policy denies the creation of vNet Peerings outside of the same subscriptions under the assigned scope.",
"metadata": {
"version": "1.0.1",
"version": "1.1.0",
"category": "Network",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand All @@ -31,6 +31,14 @@
"Disabled"
],
"defaultValue": "Deny"
},
"allowedVnets": {
"type": "Array",
"metadata": {
"displayName": "Allowed vNets to peer with",
"description": "Array of allowed vNets that can be peered with. Must be entered using their resource ID. Example: /subscriptions/{subId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}"
},
"defaultValue": []
}
},
"policyRule": {
Expand All @@ -41,8 +49,16 @@
"equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings"
},
{
"field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetwork.id",
"notcontains": "[subscription().id]"
"allOf": [
{
"field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetwork.id",
"notIn": "[parameters('allowedVnets')]"
},
{
"field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetwork.id",
"notLike": "[concat(subscription().id, '/*')]"
}
]
}
]
},
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure Database for MySQL server deploy a specific min TLS version and enforce SSL.",
"description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for MySQL server. Enforce the Server to client applications using minimum version of Tls to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.1.0",
"version": "1.2.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -61,7 +61,7 @@
},
{
"field": "Microsoft.DBforMySQL/servers/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure Database for PostgreSQL server deploy a specific min TLS version requirement and enforce SSL ",
"description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for PostgreSQL server. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.1.0",
"version": "1.2.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -61,7 +61,7 @@
},
{
"field": "Microsoft.DBforPostgreSQL/servers/minimalTlsVersion",
"notEquals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Deploy-Private-DNS-Generic",
"description": "Configure private DNS zone group to override the DNS resolution for PaaS services private endpoint. See https://aka.ms/pepdnszones for information on values to provide to parameters in this policy.",
"metadata": {
"version": "1.0.0",
"version": "2.0.0",
"category": "Networking",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand All @@ -34,8 +34,8 @@
"privateDnsZoneId": {
"type": "String",
"metadata": {
"displayName": "Private DNS Zone ID for Paas services",
"description": "The private DNS zone name required for specific Paas Services to resolve a private DNS Zone.",
"displayName": "Private DNS Zone ID for PaaS services",
"description": "The private DNS zone name required for specific PaaS Services to resolve a private DNS Zone.",
"strongType": "Microsoft.Network/privateDnsZones",
"assignPermissions": true
}
Expand All @@ -61,11 +61,24 @@
"description": "The delay in evaluation of the policy. Review delay options at https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-deploy-if-not-exists"
},
"defaultValue": "PT10M"
},
"location": {
"type": "String",
"metadata": {
"displayName": "Location (Specify the Private Endpoint location)",
"description": "Specify the Private Endpoint location",
"strongType": "location"
},
"defaultValue": "northeurope"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"equals": "[parameters('location')]"
},
{
"field": "type",
"equals": "Microsoft.Network/privateEndpoints"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "SQL servers deploys a specific min TLS version requirement.",
"description": "Deploys a specific min TLS version requirement and enforce SSL on SQL servers. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.1.0",
"version": "1.2.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -54,7 +54,7 @@
},
{
"field": "Microsoft.Sql/servers/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
},
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "SQL managed instances deploy a specific min TLS version requirement.",
"description": "Deploy a specific min TLS version requirement and enforce SSL on SQL managed instances. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server.",
"metadata": {
"version": "1.2.0",
"version": "1.3.0",
"category": "SQL",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -54,7 +54,7 @@
},
{
"field": "Microsoft.Sql/managedInstances/minimalTlsVersion",
"notequals": "[parameters('minimalTlsVersion')]"
"less": "[parameters('minimalTlsVersion')]"
}
]
},
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"displayName": "Azure Storage deploy a specific min TLS version requirement and enforce SSL/HTTPS ",
"description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Storage. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your Azure Storage.",
"metadata": {
"version": "1.2.0",
"version": "1.3.0",
"category": "Storage",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
Expand Down Expand Up @@ -60,7 +60,7 @@
},
{
"field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
"notEquals": "[parameters('minimumTlsVersion')]"
"less": "[parameters('minimumTlsVersion')]"
}
]
}
Expand Down
Loading

0 comments on commit 331063e

Please sign in to comment.