diff --git a/accelerator/.config/ALZ-Powershell.config.json b/accelerator/.config/ALZ-Powershell.config.json index 476d26b86..190d35579 100644 --- a/accelerator/.config/ALZ-Powershell.config.json +++ b/accelerator/.config/ALZ-Powershell.config.json @@ -457,6 +457,46 @@ } ] }, + "DataCollectionRuleVMInsightsResourceId": { + "Type": "Computed", + "Value": "/subscriptions/{%ManagementSubscriptionId%}/resourcegroups/rg-{%Prefix%}-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-vmi-dcr", + "Targets": [ + { + "Name": "parDataCollectionRuleVMInsightsResourceId.value", + "Destination": "Parameters" + } + ] + }, + "DataCollectionRuleChangeTrackingResourceId": { + "Type": "Computed", + "Value": "/subscriptions/{%ManagementSubscriptionId%}/resourcegroups/rg-{%Prefix%}-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-ct-dcr", + "Targets": [ + { + "Name": "parDataCollectionRuleChangeTrackingResourceId.value", + "Destination": "Parameters" + } + ] + }, + "DataCollectionRuleMDFCSQLResourceId": { + "Type": "Computed", + "Value": "/subscriptions/{%ManagementSubscriptionId%}/resourcegroups/rg-{%Prefix%}-logging/providers/Microsoft.Insights/dataCollectionRules/ama-mdfcsql-default-dcr", + "Targets": [ + { + "Name": "parDataCollectionRuleMDFCSQLResourceId.value", + "Destination": "Parameters" + } + ] + }, + "UserAssignedManagedIdentityResourceId": { + "Type": "Computed", + "Value": "/subscriptions/{%ManagementSubscriptionId%}/resourcegroups/rg-{%Prefix%}-logging/providers/Microsoft.ManagedIdentity/userAssignedIdentities/alz-umi-identity", + "Targets": [ + { + "Name": "parUserAssignedManagedIdentityResourceId.value", + "Destination": "Parameters" + } + ] + }, "DdosPretectionPlanId": { "Type": "Computed", "Value": "/subscriptions/{%ConnectivitySubscriptionId%}/resourceGroups/rg-{%Prefix%}-connectivity/providers/Microsoft.Network/ddosProtectionPlans/alz-ddos-plan", diff --git a/infra-as-code/bicep/modules/logging/README.md b/infra-as-code/bicep/modules/logging/README.md index 5ba38b7a9..0f4f24d11 100644 --- a/infra-as-code/bicep/modules/logging/README.md +++ b/infra-as-code/bicep/modules/logging/README.md @@ -4,18 +4,11 @@ Deploys Azure Log Analytics Workspace, Automation Account (linked together) & mu Automation Account will be linked to Log Analytics Workspace to provide integration for Update Management, Change Tracking and Inventory, and Start/Stop VMs during off-hours for your servers and virtual machines. Only one mapping can exist between Log Analytics Workspace and Automation Account. +We provision several data collection rules (VM Insights, Change Tracking, and Defender for SQL) as well as a user-assigned managed identity (UAMI). These resources are utilized in tandem with various policies as part of deploying the Azure Monitor Agent (AMA). + The module will deploy the following Log Analytics Workspace solutions by default. Solutions can be customized as required: -- AgentHealthAssessment -- AntiMalware -- ChangeTracking -- Security - SecurityInsights (Azure Sentinel) -- SQLAdvancedThreatProtection -- SQLVulnerabilityAssessment -- SQLAssessment -- Updates -- VMInsights > Only certain regions are supported to link Log Analytics Workspace & Automation Account together (linked workspaces). Reference: [Supported regions for linked Log Analytics workspace](https://learn.microsoft.com/azure/automation/how-to/region-mappings) @@ -115,7 +108,9 @@ New-AzResourceGroup ` New-AzResourceGroupDeployment @inputObject ``` + OR + ```powershell # For Azure China regions # Set Platform management subscripion ID as the the current subscription diff --git a/infra-as-code/bicep/modules/logging/generateddocs/logging.bicep.md b/infra-as-code/bicep/modules/logging/generateddocs/logging.bicep.md index abe480451..150aa0551 100644 --- a/infra-as-code/bicep/modules/logging/generateddocs/logging.bicep.md +++ b/infra-as-code/bicep/modules/logging/generateddocs/logging.bicep.md @@ -9,12 +9,20 @@ Parameter name | Required | Description parGlobalResourceLock | No | Global Resource Lock Configuration used for all resources deployed in this module. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. parLogAnalyticsWorkspaceName | No | Log Analytics Workspace name. parLogAnalyticsWorkspaceLocation | No | Log Analytics region name - Ensure the regions selected is a supported mapping as per: https://docs.microsoft.com/azure/automation/how-to/region-mappings. +parDataCollectionRuleVMInsightsName | No | VM Insights Data Collection Rule name for AMA integration. +parDataCollectionRuleVMInsightsLock | No | Resource Lock Configuration for VM Insights Data Collection Rule. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. +parDataCollectionRuleChangeTrackingName | No | Change Tracking Data Collection Rule name for AMA integration. +parDataCollectionRuleChangeTrackingLock | No | Resource Lock Configuration for Change Tracking Data Collection Rule. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. +parDataCollectionRuleMDFCSQLName | No | MDFC for SQL Data Collection Rule name for AMA integration. +parDataCollectionRuleMDFCSQLLock | No | Resource Lock Configuration for MDFC Defender for SQL Data Collection Rule. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. parLogAnalyticsWorkspaceSkuName | No | Log Analytics Workspace sku name. parLogAnalyticsWorkspaceCapacityReservationLevel | No | Log Analytics Workspace Capacity Reservation Level. Only used if parLogAnalyticsWorkspaceSkuName is set to CapacityReservation. parLogAnalyticsWorkspaceLogRetentionInDays | No | Number of days of log retention for Log Analytics Workspace. parLogAnalyticsWorkspaceLock | No | Resource Lock Configuration for Log Analytics Workspace. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. parLogAnalyticsWorkspaceSolutions | No | Solutions that will be added to the Log Analytics Workspace. parLogAnalyticsWorkspaceSolutionsLock | No | Resource Lock Configuration for Log Analytics Workspace Solutions. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock. +parUserAssignedManagedIdentityName | No | Name of the User Assigned Managed Identity required for authenticating Azure Monitoring Agent to Azure. +parUserAssignedManagedIdentityLocation | No | User Assigned Managed Identity location. parLogAnalyticsWorkspaceLinkAutomationAccount | No | Log Analytics Workspace should be linked with the automation account. parAutomationAccountName | No | Automation account name. parAutomationAccountLocation | No | Automation Account region name. - Ensure the regions selected is a supported mapping as per: https://docs.microsoft.com/azure/automation/how-to/region-mappings. @@ -57,6 +65,69 @@ Log Analytics region name - Ensure the regions selected is a supported mapping a - Default value: `[resourceGroup().location]` +### parDataCollectionRuleVMInsightsName + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +VM Insights Data Collection Rule name for AMA integration. + +- Default value: `alz-ama-vmi-dcr` + +### parDataCollectionRuleVMInsightsLock + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Resource Lock Configuration for VM Insights Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + + + +- Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}` + +### parDataCollectionRuleChangeTrackingName + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Change Tracking Data Collection Rule name for AMA integration. + +- Default value: `alz-ama-ct-dcr` + +### parDataCollectionRuleChangeTrackingLock + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Resource Lock Configuration for Change Tracking Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + + + +- Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}` + +### parDataCollectionRuleMDFCSQLName + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +MDFC for SQL Data Collection Rule name for AMA integration. + +- Default value: `alz-ama-mdfcsql-dcr` + +### parDataCollectionRuleMDFCSQLLock + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Resource Lock Configuration for MDFC Defender for SQL Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + + + +- Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}` + ### parLogAnalyticsWorkspaceSkuName ![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) @@ -104,9 +175,9 @@ Resource Lock Configuration for Log Analytics Workspace. Solutions that will be added to the Log Analytics Workspace. -- Default value: `AgentHealthAssessment AntiMalware ChangeTracking Security SecurityInsights SQLAdvancedThreatProtection SQLVulnerabilityAssessment SQLAssessment Updates VMInsights` +- Default value: `SecurityInsights` -- Allowed values: `AgentHealthAssessment`, `AntiMalware`, `ChangeTracking`, `Security`, `SecurityInsights`, `ServiceMap`, `SQLAdvancedThreatProtection`, `SQLVulnerabilityAssessment`, `SQLAssessment`, `Updates`, `VMInsights` +- Allowed values: `SecurityInsights` ### parLogAnalyticsWorkspaceSolutionsLock @@ -121,6 +192,22 @@ Resource Lock Configuration for Log Analytics Workspace Solutions. - Default value: `@{kind=None; notes=This lock was created by the ALZ Bicep Logging Module.}` +### parUserAssignedManagedIdentityName + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Name of the User Assigned Managed Identity required for authenticating Azure Monitoring Agent to Azure. + +- Default value: `alz-logging-mi` + +### parUserAssignedManagedIdentityLocation + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +User Assigned Managed Identity location. + +- Default value: `[resourceGroup().location]` + ### parLogAnalyticsWorkspaceLinkAutomationAccount ![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) @@ -224,6 +311,14 @@ Set Parameter to true to Opt-out of deployment telemetry Name | Type | Description ---- | ---- | ----------- +outUserAssignedManagedIdentityId | string | +outUserAssignedManagedIdentityPrincipalId | string | +outDataCollectionRuleVMInsightsName | string | +outDataCollectionRuleVMInsightsId | string | +outDataCollectionRuleChangeTrackingName | string | +outDataCollectionRuleChangeTrackingId | string | +outDataCollectionRuleMDFCSQLName | string | +outDataCollectionRuleMDFCSQLId | string | outLogAnalyticsWorkspaceName | string | outLogAnalyticsWorkspaceId | string | outLogAnalyticsCustomerId | string | @@ -255,6 +350,33 @@ outAutomationAccountId | string | "parLogAnalyticsWorkspaceLocation": { "value": "[resourceGroup().location]" }, + "parDataCollectionRuleVMInsightsName": { + "value": "alz-ama-vmi-dcr" + }, + "parDataCollectionRuleVMInsightsLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleChangeTrackingName": { + "value": "alz-ama-ct-dcr" + }, + "parDataCollectionRuleChangeTrackingLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleMDFCSQLName": { + "value": "alz-ama-mdfcsql-dcr" + }, + "parDataCollectionRuleMDFCSQLLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, "parLogAnalyticsWorkspaceSkuName": { "value": "PerGB2018" }, @@ -272,16 +394,7 @@ outAutomationAccountId | string | }, "parLogAnalyticsWorkspaceSolutions": { "value": [ - "AgentHealthAssessment", - "AntiMalware", - "ChangeTracking", - "Security", - "SecurityInsights", - "SQLAdvancedThreatProtection", - "SQLVulnerabilityAssessment", - "SQLAssessment", - "Updates", - "VMInsights" + "SecurityInsights" ] }, "parLogAnalyticsWorkspaceSolutionsLock": { @@ -290,6 +403,12 @@ outAutomationAccountId | string | "notes": "This lock was created by the ALZ Bicep Logging Module." } }, + "parUserAssignedManagedIdentityName": { + "value": "alz-logging-mi" + }, + "parUserAssignedManagedIdentityLocation": { + "value": "[resourceGroup().location]" + }, "parLogAnalyticsWorkspaceLinkAutomationAccount": { "value": true }, diff --git a/infra-as-code/bicep/modules/logging/logging.bicep b/infra-as-code/bicep/modules/logging/logging.bicep index 9dcc8a530..640dd0a96 100644 --- a/infra-as-code/bicep/modules/logging/logging.bicep +++ b/infra-as-code/bicep/modules/logging/logging.bicep @@ -29,6 +29,48 @@ param parLogAnalyticsWorkspaceName string = 'alz-log-analytics' @sys.description('Log Analytics region name - Ensure the regions selected is a supported mapping as per: https://docs.microsoft.com/azure/automation/how-to/region-mappings.') param parLogAnalyticsWorkspaceLocation string = resourceGroup().location +@sys.description('VM Insights Data Collection Rule name for AMA integration.') +param parDataCollectionRuleVMInsightsName string = 'alz-ama-vmi-dcr' + +@sys.description('''Resource Lock Configuration for VM Insights Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + +''') +param parDataCollectionRuleVMInsightsLock lockType = { + kind: 'None' + notes: 'This lock was created by the ALZ Bicep Logging Module.' +} + +@sys.description('Change Tracking Data Collection Rule name for AMA integration.') +param parDataCollectionRuleChangeTrackingName string = 'alz-ama-ct-dcr' + +@sys.description('''Resource Lock Configuration for Change Tracking Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + +''') +param parDataCollectionRuleChangeTrackingLock lockType = { + kind: 'None' + notes: 'This lock was created by the ALZ Bicep Logging Module.' +} + +@sys.description('MDFC for SQL Data Collection Rule name for AMA integration.') +param parDataCollectionRuleMDFCSQLName string = 'alz-ama-mdfcsql-dcr' + +@sys.description('''Resource Lock Configuration for MDFC Defender for SQL Data Collection Rule. + +- `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. +- `notes` - Notes about this lock. + +''') +param parDataCollectionRuleMDFCSQLLock lockType = { + kind: 'None' + notes: 'This lock was created by the ALZ Bicep Logging Module.' +} + @allowed([ 'CapacityReservation' 'Free' @@ -72,30 +114,11 @@ param parLogAnalyticsWorkspaceLock lockType = { } @allowed([ - 'AgentHealthAssessment' - 'AntiMalware' - 'ChangeTracking' - 'Security' 'SecurityInsights' - 'ServiceMap' - 'SQLAdvancedThreatProtection' - 'SQLVulnerabilityAssessment' - 'SQLAssessment' - 'Updates' - 'VMInsights' ]) @sys.description('Solutions that will be added to the Log Analytics Workspace.') param parLogAnalyticsWorkspaceSolutions array = [ - 'AgentHealthAssessment' - 'AntiMalware' - 'ChangeTracking' - 'Security' 'SecurityInsights' - 'SQLAdvancedThreatProtection' - 'SQLVulnerabilityAssessment' - 'SQLAssessment' - 'Updates' - 'VMInsights' ] @sys.description('''Resource Lock Configuration for Log Analytics Workspace Solutions. @@ -109,12 +132,17 @@ param parLogAnalyticsWorkspaceSolutionsLock lockType = { notes: 'This lock was created by the ALZ Bicep Logging Module.' } +@sys.description('Name of the User Assigned Managed Identity required for authenticating Azure Monitoring Agent to Azure.') +param parUserAssignedManagedIdentityName string = 'alz-logging-mi' + +@sys.description('User Assigned Managed Identity location.') +param parUserAssignedManagedIdentityLocation string = resourceGroup().location + @sys.description('Log Analytics Workspace should be linked with the automation account.') param parLogAnalyticsWorkspaceLinkAutomationAccount bool = true @sys.description('Automation account name.') param parAutomationAccountName string = 'alz-automation-account' - @sys.description('Automation Account region name. - Ensure the regions selected is a supported mapping as per: https://docs.microsoft.com/azure/automation/how-to/region-mappings.') param parAutomationAccountLocation string = resourceGroup().location @@ -156,6 +184,11 @@ param parTelemetryOptOut bool = false // Customer Usage Attribution Id var varCuaid = 'f8087c67-cc41-46b2-994d-66e4b661860d' +resource resUserAssignedManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { + name: parUserAssignedManagedIdentityName + location: parUserAssignedManagedIdentityLocation +} + resource resAutomationAccount 'Microsoft.Automation/automationAccounts@2022-08-08' = { name: parAutomationAccountName location: parAutomationAccountLocation @@ -207,6 +240,403 @@ resource resLogAnalyticsWorkspaceLock 'Microsoft.Authorization/locks@2020-05-01' } } +resource resDataCollectionRuleVMInsights 'Microsoft.Insights/dataCollectionRules@2021-04-01' = { + name: parDataCollectionRuleVMInsightsName + location: parLogAnalyticsWorkspaceLocation + properties: { + description: 'Data collection rule for VM Insights' + dataSources: { + performanceCounters: [ + { + name: 'VMInsightsPerfCounters' + streams: [ + 'Microsoft-InsightsMetrics' + ] + counterSpecifiers: [ + '\\VMInsights\\DetailedMetrics' + ] + samplingFrequencyInSeconds: 60 + } + ] + extensions: [ + { + streams: [ + 'Microsoft-ServiceMap' + ] + extensionName: 'DependencyAgent' + extensionSettings: {} + name: 'DependencyAgentDataSource' + } + ] + } + destinations: { + logAnalytics: [ + { + workspaceResourceId: resLogAnalyticsWorkspace.id + name: 'VMInsightsPerf-Logs-Dest' + } + ] + } + dataFlows: [ + { + streams: [ + 'Microsoft-InsightsMetrics' + ] + destinations: [ + 'VMInsightsPerf-Logs-Dest' + ] + } + { + streams: [ + 'Microsoft-ServiceMap' + ] + destinations: [ + 'VMInsightsPerf-Logs-Dest' + ] + } + ] + } +} + +// Create a resource lock for the Data Collection Rule if parGlobalResourceLock.kind != 'None' or if parDataCollectionRuleVMInsightsLock.kind != 'None' +resource resDataCollectionRuleVMInsightsLock 'Microsoft.Authorization/locks@2020-05-01' = if (parDataCollectionRuleVMInsightsLock.kind != 'None' || parGlobalResourceLock.kind != 'None') { + scope: resDataCollectionRuleVMInsights + name: parDataCollectionRuleVMInsightsLock.?name ?? '${resDataCollectionRuleVMInsights.name}-lock' + properties: { + level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parDataCollectionRuleVMInsightsLock.kind + notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parDataCollectionRuleVMInsightsLock.?notes + } +} + +resource resDataCollectionRuleChangeTracking 'Microsoft.Insights/dataCollectionRules@2021-04-01' = { + name: parDataCollectionRuleChangeTrackingName + location: parLogAnalyticsWorkspaceLocation + properties: { + description: 'Data collection rule for CT.' + dataSources: { + extensions: [ + { + streams: [ + 'Microsoft-ConfigurationChange' + 'Microsoft-ConfigurationChangeV2' + 'Microsoft-ConfigurationData' + ] + extensionName: 'ChangeTracking-Windows' + extensionSettings: { + enableFiles: true + enableSoftware: true + enableRegistry: true + enableServices: true + enableInventory: true + registrySettings: { + registryCollectionFrequency: 3000 + registryInfo: [ + { + name: 'Registry_1' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Scripts\\Startup' + valueName: '' + } + { + name: 'Registry_2' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Scripts\\Shutdown' + valueName: '' + } + { + name: 'Registry_3' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run' + valueName: '' + } + { + name: 'Registry_4' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components' + valueName: '' + } + { + name: 'Registry_5' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\ContextMenuHandlers' + valueName: '' + } + { + name: 'Registry_6' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Background\\ShellEx\\ContextMenuHandlers' + valueName: '' + } + { + name: 'Registry_7' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\Shellex\\CopyHookHandlers' + valueName: '' + } + { + name: 'Registry_8' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers' + valueName: '' + } + { + name: 'Registry_9' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellIconOverlayIdentifiers' + valueName: '' + } + { + name: 'Registry_10' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects' + valueName: '' + } + { + name: 'Registry_11' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects' + valueName: '' + } + { + name: 'Registry_12' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Extensions' + valueName: '' + } + { + name: 'Registry_13' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Internet Explorer\\Extensions' + valueName: '' + } + { + name: 'Registry_14' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32' + valueName: '' + } + { + name: 'Registry_15' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32' + valueName: '' + } + { + name: 'Registry_16' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\KnownDlls' + valueName: '' + } + { + name: 'Registry_17' + groupTag: 'Recommended' + enabled: false + recurse: true + description: '' + keyName: 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify' + valueName: '' + } + ] + } + fileSettings: { + fileCollectionFrequency: 2700 + } + softwareSettings: { + softwareCollectionFrequency: 1800 + } + inventorySettings: { + inventoryCollectionFrequency: 36000 + } + serviceSettings: { + serviceCollectionFrequency: 1800 + } + } + name: 'CTDataSource-Windows' + } + { + streams: [ + 'Microsoft-ConfigurationChange' + 'Microsoft-ConfigurationChangeV2' + 'Microsoft-ConfigurationData' + ] + extensionName: 'ChangeTracking-Linux' + extensionSettings: { + enableFiles: true + enableSoftware: true + enableRegistry: false + enableServices: true + enableInventory: true + fileSettings: { + fileCollectionFrequency: 900 + fileInfo: [ + { + name: 'ChangeTrackingLinuxPath_default' + enabled: true + destinationPath: '/etc/.*.conf' + useSudo: true + recurse: true + maxContentsReturnable: 5000000 + pathType: 'File' + type: 'File' + links: 'Follow' + maxOutputSize: 500000 + groupTag: 'Recommended' + } + ] + } + softwareSettings: { + softwareCollectionFrequency: 300 + } + inventorySettings: { + inventoryCollectionFrequency: 36000 + } + serviceSettings: { + serviceCollectionFrequency: 300 + } + } + name: 'CTDataSource-Linux' + } + ] + } + destinations: { + logAnalytics: [ + { + workspaceResourceId: resLogAnalyticsWorkspace.id + name: 'Microsoft-CT-Dest' + } + ] + } + dataFlows: [ + { + streams: [ + 'Microsoft-ConfigurationChange' + 'Microsoft-ConfigurationChangeV2' + 'Microsoft-ConfigurationData' + ] + destinations: [ + 'Microsoft-CT-Dest' + ] + } + ] + } +} + +// Create a resource lock for the Data Collection Rule if parGlobalResourceLock.kind != 'None' or if parDataCollectionRuleChangeTrackingLock.kind != 'None' +resource resDataCollectionRuleChangeTrackingLock 'Microsoft.Authorization/locks@2020-05-01' = if (parDataCollectionRuleChangeTrackingLock.kind != 'None' || parGlobalResourceLock.kind != 'None') { + scope: resDataCollectionRuleChangeTracking + name: parDataCollectionRuleChangeTrackingLock.?name ?? '${resDataCollectionRuleChangeTracking.name}-lock' + properties: { + level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parDataCollectionRuleChangeTrackingLock.kind + notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parDataCollectionRuleChangeTrackingLock.?notes + } +} + +resource resDataCollectionRuleMDFCSQL'Microsoft.Insights/dataCollectionRules@2021-04-01' = { + name: parDataCollectionRuleMDFCSQLName + location: parLogAnalyticsWorkspaceLocation + properties: { + description: 'Data collection rule for Defender for SQL.' + dataSources: { + extensions: [ + { + extensionName: 'MicrosoftDefenderForSQL' + name: 'MicrosoftDefenderForSQL' + streams: [ + 'Microsoft-DefenderForSqlAlerts' + 'Microsoft-DefenderForSqlLogins' + 'Microsoft-DefenderForSqlTelemetry' + 'Microsoft-DefenderForSqlScanEvents' + 'Microsoft-DefenderForSqlScanResults' + ] + extensionSettings: { + enableCollectionOfSqlQueriesForSecurityResearch: true + } + } + ] + } + destinations: { + logAnalytics: [ + { + workspaceResourceId: resLogAnalyticsWorkspace.id + name: 'Microsoft-DefenderForSQL-Dest' + } + ] + } + dataFlows: [ + { + streams: [ + 'Microsoft-DefenderForSqlAlerts' + 'Microsoft-DefenderForSqlLogins' + 'Microsoft-DefenderForSqlTelemetry' + 'Microsoft-DefenderForSqlScanEvents' + 'Microsoft-DefenderForSqlScanResults' + ] + destinations: [ + 'Microsoft-DefenderForSQL-Dest' + ] + } + ] + } +} + +// Create a resource lock for the Data Collection Rule if parGlobalResourceLock.kind != 'None' or if parDataCollectionRuleMDFCSQLLock.kind != 'None' +resource resDataCollectionRuleMDFCSQLLock 'Microsoft.Authorization/locks@2020-05-01' = if (parDataCollectionRuleMDFCSQLLock.kind != 'None' || parGlobalResourceLock.kind != 'None') { + scope: resDataCollectionRuleMDFCSQL + name: parDataCollectionRuleMDFCSQLLock.?name ?? '${resDataCollectionRuleMDFCSQL.name}-lock' + properties: { + level: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.kind : parDataCollectionRuleMDFCSQLLock.kind + notes: (parGlobalResourceLock.kind != 'None') ? parGlobalResourceLock.?notes : parDataCollectionRuleMDFCSQLLock.?notes + } +} + resource resLogAnalyticsWorkspaceSolutions 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = [for solution in parLogAnalyticsWorkspaceSolutions: { name: '${solution}(${resLogAnalyticsWorkspace.name})' location: parLogAnalyticsWorkspaceLocation @@ -252,6 +682,18 @@ module modCustomerUsageAttribution '../../CRML/customerUsageAttribution/cuaIdRes params: {} } +output outUserAssignedManagedIdentityId string = resUserAssignedManagedIdentity.id +output outUserAssignedManagedIdentityPrincipalId string = resUserAssignedManagedIdentity.properties.principalId + +output outDataCollectionRuleVMInsightsName string = resDataCollectionRuleVMInsights.name +output outDataCollectionRuleVMInsightsId string = resDataCollectionRuleVMInsights.id + +output outDataCollectionRuleChangeTrackingName string = resDataCollectionRuleChangeTracking.name +output outDataCollectionRuleChangeTrackingId string = resDataCollectionRuleChangeTracking.id + +output outDataCollectionRuleMDFCSQLName string = resDataCollectionRuleMDFCSQL.name +output outDataCollectionRuleMDFCSQLId string = resDataCollectionRuleMDFCSQL.id + output outLogAnalyticsWorkspaceName string = resLogAnalyticsWorkspace.name output outLogAnalyticsWorkspaceId string = resLogAnalyticsWorkspace.id output outLogAnalyticsCustomerId string = resLogAnalyticsWorkspace.properties.customerId diff --git a/infra-as-code/bicep/modules/logging/media/bicepVisualizer.png b/infra-as-code/bicep/modules/logging/media/bicepVisualizer.png index 8de531299..b5be21232 100644 Binary files a/infra-as-code/bicep/modules/logging/media/bicepVisualizer.png and b/infra-as-code/bicep/modules/logging/media/bicepVisualizer.png differ diff --git a/infra-as-code/bicep/modules/logging/parameters/logging.parameters.all.json b/infra-as-code/bicep/modules/logging/parameters/logging.parameters.all.json index 73fe7eb16..a4a4b9a3f 100644 --- a/infra-as-code/bicep/modules/logging/parameters/logging.parameters.all.json +++ b/infra-as-code/bicep/modules/logging/parameters/logging.parameters.all.json @@ -19,18 +19,21 @@ }, "parLogAnalyticsWorkspaceSolutions": { "value": [ - "AgentHealthAssessment", - "AntiMalware", - "ChangeTracking", - "Security", - "SecurityInsights", - "SQLAdvancedThreatProtection", - "SQLVulnerabilityAssessment", - "SQLAssessment", - "Updates", - "VMInsights" + "SecurityInsights" ] }, + "parDataCollectionRuleVMInsightsName": { + "value": "alz-ama-vmi-dcr" + }, + "parDataCollectionRuleChangeTrackingName": { + "value": "alz-ama-ct-dcr" + }, + "parDataCollectionRuleMDFCSQLName": { + "value": "alz-ama-mdfcsql-dcr" + }, + "parUserAssignedManagedIdentityName": { + "value": "alz-umi-identity" + }, "parLogAnalyticsWorkspaceLinkAutomationAccount": { "value": true }, @@ -83,6 +86,24 @@ "kind": "None", "notes": "This lock was created by the ALZ Bicep Logging Module." } + }, + "parDataCollectionRuleVMInsightsLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleChangeTrackingLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleMDFCSQLLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } } } } diff --git a/infra-as-code/bicep/modules/logging/parameters/logging.parameters.min.json b/infra-as-code/bicep/modules/logging/parameters/logging.parameters.min.json index a962c9a3f..e74df2a7e 100644 --- a/infra-as-code/bicep/modules/logging/parameters/logging.parameters.min.json +++ b/infra-as-code/bicep/modules/logging/parameters/logging.parameters.min.json @@ -10,16 +10,7 @@ }, "parLogAnalyticsWorkspaceSolutions": { "value": [ - "AgentHealthAssessment", - "AntiMalware", - "ChangeTracking", - "Security", - "SecurityInsights", - "SQLAdvancedThreatProtection", - "SQLVulnerabilityAssessment", - "SQLAssessment", - "Updates", - "VMInsights" + "SecurityInsights" ] }, "parAutomationAccountLocation": { diff --git a/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.all.json b/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.all.json index 360454db1..30868a880 100644 --- a/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.all.json +++ b/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.all.json @@ -16,18 +16,21 @@ }, "parLogAnalyticsWorkspaceSolutions": { "value": [ - "AgentHealthAssessment", - "AntiMalware", - "ChangeTracking", - "Security", - "SecurityInsights", - "SQLAdvancedThreatProtection", - "SQLVulnerabilityAssessment", - "SQLAssessment", - "Updates", - "VMInsights" + "SecurityInsights" ] }, + "parDataCollectionRuleVMInsightsName": { + "value": "ama-vmi-default-perfAndda-dcr" + }, + "parDataCollectionRuleChangeTrackingName": { + "value": "ama-ct-default-dcr" + }, + "parDataCollectionRuleMDFCSQLName": { + "value": "ama-mdfcsql-default-dcr" + }, + "parUserAssignedManagedIdentityName": { + "value": "alz-umi-identity" + }, "parLogAnalyticsWorkspaceLinkAutomationAccount": { "value": true }, @@ -77,6 +80,24 @@ "kind": "None", "notes": "This lock was created by the ALZ Bicep Logging Module." } + }, + "parDataCollectionRuleVMInsightsLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleChangeTrackingLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } + }, + "parDataCollectionRuleMDFCSQLLock": { + "value": { + "kind": "None", + "notes": "This lock was created by the ALZ Bicep Logging Module." + } } } } diff --git a/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.min.json b/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.min.json index 04d9b40d4..dad0948b4 100644 --- a/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.min.json +++ b/infra-as-code/bicep/modules/logging/parameters/mc-logging.parameters.min.json @@ -10,16 +10,7 @@ }, "parLogAnalyticsWorkspaceSolutions": { "value": [ - "AgentHealthAssessment", - "AntiMalware", - "ChangeTracking", - "Security", - "SecurityInsights", - "SQLAdvancedThreatProtection", - "SQLVulnerabilityAssessment", - "SQLAssessment", - "Updates", - "VMInsights" + "SecurityInsights" ] }, "parAutomationAccountLocation": { diff --git a/infra-as-code/bicep/modules/logging/samples/baseline.sample.bicep b/infra-as-code/bicep/modules/logging/samples/baseline.sample.bicep index 11612fdc2..904574aae 100644 --- a/infra-as-code/bicep/modules/logging/samples/baseline.sample.bicep +++ b/infra-as-code/bicep/modules/logging/samples/baseline.sample.bicep @@ -26,17 +26,9 @@ module baseline_logging '../logging.bicep' = { parLogAnalyticsWorkspaceName: 'alz-log-analytics' parLogAnalyticsWorkspaceSkuName: 'PerGB2018' parLogAnalyticsWorkspaceSolutions: [ - 'AgentHealthAssessment' - 'AntiMalware' - 'ChangeTracking' - 'Security' 'SecurityInsights' - 'SQLAdvancedThreatProtection' - 'SQLVulnerabilityAssessment' - 'SQLAssessment' - 'Updates' - 'VMInsights' ] + parUserAssignedManagedIdentityName: 'alz-umi-identity' parAutomationAccountName: 'alz-automation-account' parAutomationAccountUseManagedIdentity: true parTelemetryOptOut: false diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep index 382517bdb..b3398e619 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep @@ -78,6 +78,18 @@ param parLogAnalyticsWorkSpaceAndAutomationAccountLocation string = 'eastus' @sys.description('Log Analytics Workspace Resource ID.') param parLogAnalyticsWorkspaceResourceId string = '' +@sys.description('Data Collection Rule VM Insights Resource ID.') +param parDataCollectionRuleVMInsightsResourceId string = '' + +@sys.description('Data Collection Rule Change Tracking Resource ID.') +param parDataCollectionRuleChangeTrackingResourceId string = '' + +@sys.description('Data Collection Rule MDFC SQL Resource ID.') +param parDataCollectionRuleMDFCSQLResourceId string = '' + +@sys.description('User Assigned Managed Identity Resource ID.') +param parUserAssignedManagedIdentityResourceId string = '' + @sys.description('Number of days of log retention for Log Analytics Workspace.') param parLogAnalyticsWorkspaceLogRetentionInDays string = '365' @@ -120,6 +132,8 @@ var varLogAnalyticsWorkspaceResourceGroupName = split(parLogAnalyticsWorkspaceRe var varLogAnalyticsWorkspaceSubscription = split(parLogAnalyticsWorkspaceResourceId, '/')[2] +var varUserAssignedManagedIdentityResourceName = split(parUserAssignedManagedIdentityResourceId, '/')[8] + // Customer Usage Attribution Id Telemetry var varCuaid = '98cef979-5a6b-403b-83c7-10c8f04ac9a2' @@ -140,19 +154,29 @@ var varModuleDeploymentNames = { modPolicyAssignmentIntRootDeployMdfcConfig: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMDFCConfig-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDeployAzActivityLog: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployAzActivityLog-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDeployAscMonitoring: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployASCMonitoring-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) - modPolicyAssignmentIntRootDeployResourceDiag: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployResoruceDiag-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) - modPolicyAssignmentIntRootDeployVmMonitoring: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVMMonitoring-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) - modPolicyAssignmentIntRootDeployVmssMonitoring: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVMSSMonitoring-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentIntRootDeployResourceDiag: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployResourceDiag-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDeployMDEnpoints: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMDEndpoints-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentIntRootDeployMDEnpointsAma: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMDEndpointsAma-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootEnforceAcsb: take('${varDeploymentNameWrappers.basePrefix}-polAssi-enforceAcsb-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDeployMdfcOssDb: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMdfcOssDb-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDeployMdfcSqlAtp: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMdfcSqlAtp-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootAuditLocationMatch: take('${varDeploymentNameWrappers.basePrefix}-polAssi-auditLocationMatch-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootAuditZoneResiliency: take('${varDeploymentNameWrappers.basePrefix}-polAssi-auditZoneResiliency-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootAuditUnusedRes: take('${varDeploymentNameWrappers.basePrefix}-polAssi-auditUnusedRes-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentIntRootAuditTrustedLaunch: take('${varDeploymentNameWrappers.basePrefix}-polAssi-auditTrustedLaunch-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDenyClassicRes: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyClassicRes-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIntRootDenyUnmanagedDisks: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyUnmanagedDisks-intRoot-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmArcTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmArcChangeTrack-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmChangeTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmChangeTrack-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmssChangeTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmssChangeTrack-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmArcMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmArcMonitor-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmMonitor-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployVmssMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmssMonitor-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDeployMdfcDefSqlAma: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyDeleteUamiAma-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformDenyDeleteUAMIAMA: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deny-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentPlatformEnforceGrKeyVault: take('${varDeploymentNameWrappers.basePrefix}-polAssi-enforceGrKeyVault-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformEnforceAsr: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployEnforceBackup-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentPlatformEnforceAumCheckUpdates: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployEnforceAumCheckUpdates-platform-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentConnEnableDdosVnet: take('${varDeploymentNameWrappers.basePrefix}-polAssi-enableDDoSVNET-conn-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIdentDenyPublicIp: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyPublicIP-ident-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentIdentDenyMgmtPortsFromInternet: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyMgmtFromInet-ident-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) @@ -174,7 +198,16 @@ var varModuleDeploymentNames = { modPolicyAssignmentLzsDeployAzSqlDbAuditing: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployAzSQLDBAudit-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsDeploySqlThreat: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deploySQLThreat-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsDeploySqlTde: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deploySQLTde-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmArcTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmArcChangeTrack-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmChangeTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmChangeTrack-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmssChangeTrack: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmssChangeTrack-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmArcMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmArcMonitor-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmMonitor-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployVmssMonitor: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployVmssMonitor-Lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsDeployMdfcDefSqlAma: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployMdfcDefSqlAma-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsEnforceGrKeyVault: take('${varDeploymentNameWrappers.basePrefix}-polAssi-enforceGrKeyVault-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsEnforceAsr: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployEnforceBackup-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) + modPolicyAssignmentLzsAumCheckUpdates: take('${varDeploymentNameWrappers.basePrefix}-polAssi-deployEnforceAumCheckUpdates-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsAuditAppGwWaf: take('${varDeploymentNameWrappers.basePrefix}-polAssi-auditAppGwWaf-lz-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsConfidentialOnlineEnforceSovereigntyConf: take('${varDeploymentNameWrappers.basePrefix}-polAssi-enforceSovereigntyConf-confidential-online-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) modPolicyAssignmentLzsCorpDenyPublicEndpoints: take('${varDeploymentNameWrappers.basePrefix}-polAssi-denyPublicEndpoints-corp-${varDeploymentNameWrappers.baseSuffixTenantAndManagementGroup}', 64) @@ -214,6 +247,11 @@ var varPolicyAssignmentAuditUnusedResources = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json') } +var varPolicyAssignmentAuditTrustedLaunch = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Audit-TrustedLaunch' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_trustedlaunch.tmpl.json') +} + var varPolicyAssignmentAuditZoneResiliency = { definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/130fb88f-0fc9-4678-bfe1-31022d71c7d5' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json') @@ -279,6 +317,11 @@ var varPolicyAssignmentEnforceSovereignGlobal = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json') } +var varPolicyAssignmentEnforceAumCheckUpdates= { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-AUM-CheckUpdates' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_aum_checkupdates.tmpl.json') +} + var varPolicyAssignmentDenyStoragehttp = { definitionId: '/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json') @@ -324,8 +367,13 @@ var varPolicyAssignmentDeployMDEndpoints = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json') } +var varPolicyAssignmentDeployMDEndpointsAma = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/77b391e3-2d5d-40c3-83bf-65c846b3c6a3' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json') +} + var varPolicyAssignmentDeployMDFCConfig = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config' + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config_20240319' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json') } @@ -345,7 +393,7 @@ var varPolicyAssignmentDeployPrivateDNSZones = { } var varPolicyAssignmentDeployResourceDiag = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/0884adba-2312-4468-abeb-5422caed1038' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json') } @@ -364,14 +412,44 @@ var varPolicyAssignmentDeployVMBackup = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json') } +var varPolicyAssignmentDeployVmArcChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/53448c70-089b-4f52-8f38-89196d7f2de1' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json') +} + +var varPolicyAssignmentDeployVmChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/92a36f05-ebc9-4bba-9128-b47ad2ea3354' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json') +} + +var varPolicyAssignmentDeployVmssChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/c4a70814-96be-461c-889f-2b27429120dc' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json') +} + +var varPolicyAssignmentDeployvmHybrMonitoring = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/2b00397d-c309-49c4-aa5a-f0b2c5bc6321' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json') +} + var varPolicyAssignmentDeployVMMonitoring = { - definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/55f3eceb-5573-4f18-9695-226972c6d74a' - libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json') + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/924bfe3a-762f-40e7-86dd-5c8b95eb09e6' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json') } var varPolicyAssignmentDeployVMSSMonitoring = { - definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/75714362-cae7-409e-9b99-a8e5075b7fad' - libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitoring.tmpl.json') + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/f5bf694c-cca7-4033-b883-3a23327d5485' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json') +} + +var varPolicyAssignmentDeployMdfcDefSqlAma = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/de01d381-bae9-4670-8870-786f89f49e26' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json') +} + +var varPolicyAssignmentDenyActionDeleteUAMIAMA = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-DeleteResources' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_deleteuamiama.tmlp.json') } var varPolicyAssignmentEnableDDoSVNET = { @@ -384,6 +462,11 @@ var varPolicyAssignmentEnforceACSB = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_acsb.tmpl.json') } +var varPolicyAssignmentEnforceAsr = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Backup' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_backup.json') +} + var varPolicyAssignmentEnforceALZDecomm = { definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-ALZ-Decomm' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_decomm.tmpl.json') @@ -400,7 +483,7 @@ var varPolicyAssignmentEnforceGRKeyVault = { } var varPolicyAssignmentEnforceTLSSSL = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit' + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit_20240509' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json') } @@ -417,6 +500,10 @@ var varRbacRoleDefinitionIds = { aksPolicyAddon: '18ed5180-3e48-46fd-8541-4ea054d57064' sqlDbContributor: '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec' backupContributor: '5e467623-bb1f-42f4-a55d-6e525e11384b' + rbacSecurityAdmin: 'fb1c8493-542b-48eb-b624-b4c8fea62acd' + reader: 'acdd72a7-3385-48ef-bd42-f606fba81ae7' + managedIdentityOperator: 'f1a07417-d97a-45cb-824c-7a7467783830' + connectedMachineResourceAdministrator: 'cd570a14-e51a-42ad-bac8-bafd67325302' } // Management Groups Variables - Used For Policy Assignments @@ -501,6 +588,7 @@ var varPrivateDnsZonesFinalResourceIds = { azureAcrPrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.azurecr.io' azureEventHubNamespacePrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.servicebus.windows.net' azureMachineLearningWorkspacePrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.api.azureml.ms' + azureMachineLearningWorkspaceSecondPrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.notebooks.azure.net' azureServiceBusNamespacePrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.servicebus.windows.net' azureCognitiveSearchPrivateDnsZoneId: '${varPrivateDnsZonesBaseResourceId}privatelink.search.windows.net' } @@ -547,7 +635,7 @@ module modPolicyAssignmentIntRootEnforceSovereigntyGlobal '../../../policy/assig } } -// Module - Policy Assignment - Deploy-MDFC-Config +// Module - Policy Assignment - Deploy-MDFC-Config-H224 module modPolicyAssignmentIntRootDeployMdfcConfig '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMDFCConfig.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployMdfcConfig @@ -578,7 +666,7 @@ module modPolicyAssignmentIntRootDeployMdfcConfig '../../../policy/assignments/p } // Module - Policy Assignment - Deploy-MDEndpoints -module modPolicyAssignmentIntRootDeployMDEnpoints '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMDEndpoints.libDefinition.name)) { +module modPolicyAssignmentIntRootDeployMDEndpoints '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMDEndpoints.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployMDEnpoints params: { @@ -596,6 +684,25 @@ module modPolicyAssignmentIntRootDeployMDEnpoints '../../../policy/assignments/p } } +// Module - Policy Assignment - Deploy-MDEndpointsAMA +module modPolicyAssignmentIntRootDeployMDEndpointsAMA '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMDEndpointsAma.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.intRoot) + name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployMDEnpointsAma + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployMDEndpointsAma.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployMDEndpointsAma.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployMDEndpointsAma.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployMDEndpointsAma.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployMDEndpointsAma.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployMDEndpointsAma.libDefinition.identity.type + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.rbacSecurityAdmin + ] + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployMDEndpointsAma.libDefinition.properties.enforcementMode + parTelemetryOptOut: parTelemetryOptOut + } +} + // Module - Policy Assignment - Deploy-AzActivity-Log module modPolicyAssignmentIntRootDeployAzActivityLog '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployAzActivityLog.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) @@ -637,7 +744,7 @@ module modPolicyAssignmentIntRootDeployAscMonitoring '../../../policy/assignment } } -// Module - Policy Assignment - Deploy-Resource-Diag +// Module - Policy Assignment - Deploy-Diag-Logs module modPolicyAssignmentIntRootDeployResourceDiag '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployResourceDiag.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployResourceDiag @@ -662,54 +769,6 @@ module modPolicyAssignmentIntRootDeployResourceDiag '../../../policy/assignments } } -// Module - Policy Assignment - Deploy-VM-Monitoring -module modPolicyAssignmentIntRootDeployVmMonitoring '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMMonitoring.libDefinition.name)) { - scope: managementGroup(varManagementGroupIds.intRoot) - name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployVmMonitoring - params: { - parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMMonitoring.definitionId - parPolicyAssignmentName: varPolicyAssignmentDeployVMMonitoring.libDefinition.name - parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.displayName - parPolicyAssignmentDescription: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.description - parPolicyAssignmentParameters: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.parameters - parPolicyAssignmentParameterOverrides: { - logAnalytics_1: { - value: parLogAnalyticsWorkspaceResourceId - } - } - parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMMonitoring.libDefinition.identity.type - parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.enforcementMode - parPolicyAssignmentIdentityRoleDefinitionIds: [ - varRbacRoleDefinitionIds.logAnalyticsContributor - ] - parTelemetryOptOut: parTelemetryOptOut - } -} - -// Module - Policy Assignment - Deploy-VMSS-Monitoring -module modPolicyAssignmentIntRootDeployVmssMonitoring '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name)) { - scope: managementGroup(varManagementGroupIds.intRoot) - name: varModuleDeploymentNames.modPolicyAssignmentIntRootDeployVmssMonitoring - params: { - parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMSSMonitoring.definitionId - parPolicyAssignmentName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name - parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.displayName - parPolicyAssignmentDescription: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.description - parPolicyAssignmentParameters: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.parameters - parPolicyAssignmentParameterOverrides: { - logAnalytics_1: { - value: parLogAnalyticsWorkspaceResourceId - } - } - parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.identity.type - parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.enforcementMode - parPolicyAssignmentIdentityRoleDefinitionIds: [ - varRbacRoleDefinitionIds.logAnalyticsContributor - ] - parTelemetryOptOut: parTelemetryOptOut - } -} - // Module - Policy Assignment - Enforce-ACSB module modPolicyAssignmentIntRootEnforceAcsb '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceACSB.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) @@ -815,6 +874,22 @@ module modPolicyAssignmentIntRootAuditUnusedRes '../../../policy/assignments/pol } } +// Module - Policy Assignment - Audit Trusted Launch +module modPolicyAssignmentIntRootAuditTrustedLaunch '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentAuditTrustedLaunch.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.intRoot) + name: varModuleDeploymentNames.modPolicyAssignmentIntRootAuditTrustedLaunch + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentAuditTrustedLaunch.definitionId + parPolicyAssignmentName: varPolicyAssignmentAuditTrustedLaunch.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentAuditTrustedLaunch.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentAuditTrustedLaunch.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentAuditTrustedLaunch.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentAuditTrustedLaunch.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentAuditTrustedLaunch.libDefinition.properties.enforcementMode + parTelemetryOptOut: parTelemetryOptOut + } +} + // Module - Policy Assignment - Deny-UnmanagedDisk module modPolicyAssignmentIntRootDenyUnmanagedDisks '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDenyUnmanagedDisk.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.intRoot) @@ -849,6 +924,236 @@ module modPolicyAssignmentIntRootDenyClassicRes '../../../policy/assignments/pol } // Modules - Policy Assignments - Platform Management Group +// Module - Policy Assignment - Deploy-vmArc-ChangeTrack +module modPolicyAssignmentPlatformDeployVmArcChangeTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmArcTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmArcChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VM-ChangeTrack +module modPolicyAssignmentPlatformDeployVmChangeTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmChangeTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VMSS-ChangeTrack +module modPolicyAssignmentPlatformDeployVmssChangeTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmssChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmssChangeTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmssChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-vmHybr-Monitoring +module modPolicyAssignmentPlatformDeployVmArcMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmArcMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployvmHybrMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleVMInsightsResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VM-Monitor-24 +module modPolicyAssignmentPlatformDeployVmMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVMMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleVMInsightsResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-MDFC-DefSQL-AMA +module modPolicyAssignmentPlatformDeployMdfcDefSqlAma '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployMdfcDefSqlAma + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployMdfcDefSqlAma.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + userWorkspaceResourceId: { + value: parLogAnalyticsWorkspaceResourceId + } + dcrResourceId: { + value: parDataCollectionRuleMDFCSQLResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +module modPolicyAssignmentPlatformDenyDeleteUAMIAMA '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDenyDeleteUAMIAMA + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDenyActionDeleteUAMIAMA.definitionId + parPolicyAssignmentName: varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDenyActionDeleteUAMIAMA.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + resourceName: { + value: varUserAssignedManagedIdentityResourceName + } + } + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VMSS-Monitor-24 +module modPolicyAssignmentPlatformDeployVmssMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformDeployVmssMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMSSMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + // Module - Policy Assignment - Enforce-GR-KeyVault module modPolicyAssignmentPlatformEnforceGrKeyVault '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceGRKeyVault.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.platform) @@ -865,6 +1170,46 @@ module modPolicyAssignmentPlatformEnforceGrKeyVault '../../../policy/assignments } } +// Module - Policy Assignment - Enforce-ASR +module modPolicyAssignmentPlatformEnforceAsr '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceAsr.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformEnforceAsr + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentEnforceAsr.definitionId + parPolicyAssignmentName: varPolicyAssignmentEnforceAsr.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentEnforceAsr.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentEnforceAsr.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentEnforceAsr.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentEnforceAsr.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentEnforceAsr.libDefinition.properties.enforcementMode + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.contributor + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Enable-AUM-CheckUpdates +module modPolicyAssignmentPlatformEnforceAumCheckUpdates '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.platform) + name: varModuleDeploymentNames.modPolicyAssignmentPlatformEnforceAumCheckUpdates + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentEnforceAumCheckUpdates.definitionId + parPolicyAssignmentName: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.enforcementMode + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.connectedMachineResourceAdministrator + varRbacRoleDefinitionIds.managedIdentityOperator + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + // Modules - Policy Assignments - Connectivity Management Group // Module - Policy Assignment - Enable-DDoS-VNET module modPolicyAssignmentConnEnableDdosVnet '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if ((!empty(parDdosProtectionPlanId)) && (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnableDDoSVNET.libDefinition.name))) { @@ -1273,6 +1618,213 @@ module modPolicyAssignmentLzsDeploySqlTde '../../../policy/assignments/policyAss } } +// Module - Policy Assignment - Deploy-vmArc-ChangeTrack +module modPolicyAssignmentLzsDeployVmArcTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmArcTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmArcChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmArcChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VM-ChangeTrack +module modPolicyAssignmentLzsDeployVmChangeTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmChangeTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VMSS-ChangeTrack +module modPolicyAssignmentLzsDeployVmssChangeTrack '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVmssChangeTrack.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmssChangeTrack + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVmssChangeTrack.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVmssChangeTrack.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVmssChangeTrack.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-vmHybr-Monitoring +module modPolicyAssignmentLzsDeployVmArcMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmArcMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployvmHybrMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployvmHybrMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleVMInsightsResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VM-Monitor-24 +module modPolicyAssignmentLzsDeployVmMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVMMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleVMInsightsResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-VMSS-Monitor-24 +module modPolicyAssignmentLzsDeployVmssMonitor '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployVmssMonitor + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployVMSSMonitoring.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployVMSSMonitoring.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployVMSSMonitoring.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleChangeTrackingResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Deploy-MDFC-DefSQL-AMA +module modPolicyAssignmentLzsmDeployMdfcDefSqlAma '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsDeployMdfcDefSqlAma + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentDeployMdfcDefSqlAma.definitionId + parPolicyAssignmentName: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentDeployMdfcDefSqlAma.libDefinition.properties.enforcementMode + parPolicyAssignmentParameterOverrides: { + dcrResourceId: { + value: parDataCollectionRuleMDFCSQLResourceId + } + userAssignedIdentityResourceId: { + value: parUserAssignedManagedIdentityResourceId + } + } + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.logAnalyticsContributor + varRbacRoleDefinitionIds.monitoringContributor + varRbacRoleDefinitionIds.managedIdentityOperator + varRbacRoleDefinitionIds.reader + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + // Module - Policy Assignment - Enforce-GR-KeyVault module modPolicyAssignmentLzsEnforceGrKeyVault '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceGRKeyVault.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.landingZones) @@ -1289,6 +1841,46 @@ module modPolicyAssignmentLzsEnforceGrKeyVault '../../../policy/assignments/poli } } +// Module - Policy Assignment - Enforce-ASR +module modPolicyAssignmentLzsEnforceAsr '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceAsr.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsEnforceAsr + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentEnforceAsr.definitionId + parPolicyAssignmentName: varPolicyAssignmentEnforceAsr.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentEnforceAsr.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentEnforceAsr.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentEnforceAsr.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentEnforceAsr.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentEnforceAsr.libDefinition.properties.enforcementMode + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.contributor + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + +// Module - Policy Assignment - Enable-AUM-CheckUpdates +module modPolicyAssignmentLzsAumCheckUpdates '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.name)) { + scope: managementGroup(varManagementGroupIds.landingZones) + name: varModuleDeploymentNames.modPolicyAssignmentLzsAumCheckUpdates + params: { + parPolicyAssignmentDefinitionId: varPolicyAssignmentEnforceAumCheckUpdates.definitionId + parPolicyAssignmentName: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.name + parPolicyAssignmentDisplayName: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.displayName + parPolicyAssignmentDescription: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.description + parPolicyAssignmentParameters: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.parameters + parPolicyAssignmentIdentityType: varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.identity.type + parPolicyAssignmentEnforcementMode: parDisableAlzDefaultPolicies ? 'DoNotEnforce' : varPolicyAssignmentEnforceAumCheckUpdates.libDefinition.properties.enforcementMode + parPolicyAssignmentIdentityRoleDefinitionIds: [ + varRbacRoleDefinitionIds.vmContributor + varRbacRoleDefinitionIds.connectedMachineResourceAdministrator + varRbacRoleDefinitionIds.managedIdentityOperator + ] + parTelemetryOptOut: parTelemetryOptOut + } +} + // Module - Policy Assignment - Audit-AppGW-WAF module modPolicyAssignmentLzsAuditAppGwWaf '../../../policy/assignments/policyAssignmentManagementGroup.bicep' = if (!contains(parExcludedPolicyAssignments, varPolicyAssignmentAuditAppGWWAF.libDefinition.name)) { scope: managementGroup(varManagementGroupIds.landingZones) @@ -1483,6 +2075,9 @@ module modPolicyAssignmentConnDeployPrivateDnsZones '../../../policy/assignments azureMachineLearningWorkspacePrivateDnsZoneId: { value: varPrivateDnsZonesFinalResourceIds.azureMachineLearningWorkspacePrivateDnsZoneId } + azureMachineLearningWorkspaceSecondPrivateDnsZoneId: { + value: varPrivateDnsZonesFinalResourceIds.azureMachineLearningWorkspaceSecondPrivateDnsZoneId + } azureServiceBusNamespacePrivateDnsZoneId: { value: varPrivateDnsZonesFinalResourceIds.azureServiceBusNamespacePrivateDnsZoneId } diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md index b0981255b..ab6793c95 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/generateddocs/alzDefaultPolicyAssignments.bicep.md @@ -15,6 +15,10 @@ parLandingZoneChildrenMgAlzDefaultsEnable | No | Corp & Online Management parLandingZoneMgConfidentialEnable | No | Confidential Corp & Confidential Online Management Groups beneath Landing Zones Management Group have been deployed. If set to false, policies will not try to be assigned to Confidential Corp & Confidential Online Management Groups parLogAnalyticsWorkSpaceAndAutomationAccountLocation | No | The region where the Log Analytics Workspace & Automation Account are deployed. parLogAnalyticsWorkspaceResourceId | No | Log Analytics Workspace Resource ID. +parDataCollectionRuleVMInsightsResourceId | No | Data Collection Rule VM Insights Resource ID. +parDataCollectionRuleChangeTrackingResourceId | No | Data Collection Rule Change Tracking Resource ID. +parDataCollectionRuleMDFCSQLResourceId | No | Data Collection Rule MDFC SQL Resource ID. +parUserAssignedManagedIdentityResourceId | No | User Assigned Managed Identity Resource ID. parLogAnalyticsWorkspaceLogRetentionInDays | No | Number of days of log retention for Log Analytics Workspace. parAutomationAccountName | No | Automation account name. parMsDefenderForCloudEmailSecurityContact | No | An e-mail address that you want Microsoft Defender for Cloud alerts to be sent to. @@ -109,6 +113,30 @@ The region where the Log Analytics Workspace & Automation Account are deployed. Log Analytics Workspace Resource ID. +### parDataCollectionRuleVMInsightsResourceId + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Data Collection Rule VM Insights Resource ID. + +### parDataCollectionRuleChangeTrackingResourceId + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Data Collection Rule Change Tracking Resource ID. + +### parDataCollectionRuleMDFCSQLResourceId + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +Data Collection Rule MDFC SQL Resource ID. + +### parUserAssignedManagedIdentityResourceId + +![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) + +User Assigned Managed Identity Resource ID. + ### parLogAnalyticsWorkspaceLogRetentionInDays ![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square) @@ -241,6 +269,18 @@ Set Parameter to true to Opt-out of deployment telemetry "parLogAnalyticsWorkspaceResourceId": { "value": "" }, + "parDataCollectionRuleVMInsightsResourceId": { + "value": "" + }, + "parDataCollectionRuleChangeTrackingResourceId": { + "value": "" + }, + "parDataCollectionRuleMDFCSQLResourceId": { + "value": "" + }, + "parUserAssignedManagedIdentityResourceId": { + "value": "" + }, "parLogAnalyticsWorkspaceLogRetentionInDays": { "value": "365" }, diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json index 6f500b846..880a4b147 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json @@ -41,6 +41,18 @@ "parLogAnalyticsWorkspaceLogRetentionInDays": { "value": "365" }, + "parDataCollectionRuleVMInsightsResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-vmi-dcr" + }, + "parDataCollectionRuleChangeTrackingResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-ct-dcr" + }, + "parDataCollectionRuleMDFCSQLResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/ama-mdfcsql-default-dcr" + }, + "parUserAssignedManagedIdentityResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/alz-logging/providers/Microsoft.ManagedIdentity/userAssignedIdentities/alz-umi-identity" + }, "parAutomationAccountName": { "value": "alz-automation-account" }, diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.min.json b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.min.json index 515ac1130..0bdbd8bce 100644 --- a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.min.json +++ b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.min.json @@ -11,6 +11,18 @@ "parLogAnalyticsWorkspaceResourceId": { "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.OperationalInsights/workspaces/alz-log-analytics" }, + "parDataCollectionRuleVMInsightsResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-vmi-dcr" + }, + "parDataCollectionRuleChangeTrackingResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/alz-ama-ct-dcr" + }, + "parDataCollectionRuleMDFCSQLResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/alz-logging/providers/Microsoft.Insights/dataCollectionRules/ama-mdfcsql-default-dcr" + }, + "parUserAssignedManagedIdentityResourceId": { + "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/alz-logging/providers/Microsoft.ManagedIdentity/userAssignedIdentities/alz-umi-identity" + }, "parLogAnalyticsWorkspaceLogRetentionInDays": { "value": "365" }, diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt index c166547a6..266c9a91b 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt @@ -13,6 +13,11 @@ var varPolicyAssignmentAuditLocationMatch = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json') } +var varPolicyAssignmentAuditTrustedLaunch = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Audit-TrustedLaunch' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_trustedlaunch.tmpl.json') +} + var varPolicyAssignmentAuditUnusedResources = { definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Audit-UnusedResourcesCostOptimization' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json') @@ -48,6 +53,11 @@ var varPolicyAssignmentDenyDataBVnet = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json') } +var varPolicyAssignmentDenyActionDeleteUAMIAMA = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-DeleteResources' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_deleteuamiama.tmlp.json') +} + var varPolicyAssignmentEnforceAKSHTTPS = { definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json') @@ -163,13 +173,18 @@ var varPolicyAssignmentDeployLXArcMonitoring = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json') } +var varPolicyAssignmentDeployMDEndpointsAMA = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/77b391e3-2d5d-40c3-83bf-65c846b3c6a3' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json') +} + var varPolicyAssignmentDeployMDEndpoints = { definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/e20d08c5-6d64-656d-6465-ce9e37fd0ebc' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json') } -var varPolicyAssignmentDeployMDFCConfig = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config' +var varPolicyAssignmentDeployMDFCConfigH224 = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config_20240319' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json') } @@ -178,6 +193,11 @@ var varPolicyAssignmentDeployMDFCOssDb = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json') } +var varPolicyAssignmentDeployMDFCDefSQLAMA = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/de01d381-bae9-4670-8870-786f89f49e26' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json') +} + var varPolicyAssignmentDeployMDFCSqlAtp = { definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/9cb3cc7a-b39b-4b82-bc89-e5a5d9ff7b97' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json') @@ -188,8 +208,8 @@ var varPolicyAssignmentDeployPrivateDNSZones = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json') } -var varPolicyAssignmentDeployResourceDiag = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics' +var varPolicyAssignmentDeployDiagLogs = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/0884adba-2312-4468-abeb-5422caed1038' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json') } @@ -213,19 +233,39 @@ var varPolicyAssignmentDeploySQLThreat = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json') } +var varPolicyAssignmentDeployvmArcChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/53448c70-089b-4f52-8f38-89196d7f2de1' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json') +} + +var varPolicyAssignmentDeployvmHybrMonitoring = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/2b00397d-c309-49c4-aa5a-f0b2c5bc6321' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json') +} + var varPolicyAssignmentDeployVMBackup = { definitionId: '/providers/Microsoft.Authorization/policyDefinitions/98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json') } +var varPolicyAssignmentDeployVMChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/92a36f05-ebc9-4bba-9128-b47ad2ea3354' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json') +} + var varPolicyAssignmentDeployVMMonitoring = { - definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/55f3eceb-5573-4f18-9695-226972c6d74a' - libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json') + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/924bfe3a-762f-40e7-86dd-5c8b95eb09e6' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json') +} + +var varPolicyAssignmentDeployVMSSChangeTrack = { + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/c4a70814-96be-461c-889f-2b27429120dc' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json') } var varPolicyAssignmentDeployVMSSMonitoring = { - definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/75714362-cae7-409e-9b99-a8e5075b7fad' - libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitoring.tmpl.json') + definitionId: '/providers/Microsoft.Authorization/policySetDefinitions/f5bf694c-cca7-4033-b883-3a23327d5485' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json') } var varPolicyAssignmentDeployWSArcMonitoring = { @@ -253,6 +293,16 @@ var varPolicyAssignmentEnforceALZSandbox = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_sandbox.tmpl.json') } +var varPolicyAssignmentEnableAUMCheckUpdates = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-AUM-CheckUpdates' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_aum_checkupdates.tmpl.json') +} + +var varPolicyAssignmentEnforceASR = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Backup' + libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_backup.json') +} + var varPolicyAssignmentEnforceGRKeyVault = { definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-KeyVault' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json') @@ -268,8 +318,8 @@ var varPolicyAssignmentEnforceSovereignGlobal = { libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json') } -var varPolicyAssignmentEnforceTLSSSL = { - definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit' +var varPolicyAssignmentEnforceTLSSSLH224 = { + definitionId: '${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit_20240509' libDefinition: loadJsonContent('../../../policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json') } diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_appgw_waf.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_appgw_waf.tmpl.json index 18e58bcaf..e86da45c8 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_appgw_waf.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_appgw_waf.tmpl.json @@ -1,7 +1,7 @@ { "name": "Audit-AppGW-WAF", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Assign the WAF should be enabled for Application Gateway audit policy.", "displayName": "Web Application Firewall (WAF) should be enabled for Application Gateway", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_pednszones.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_pednszones.tmpl.json index cbb601958..ebd1a9053 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_pednszones.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_pednszones.tmpl.json @@ -1,7 +1,7 @@ { "name": "Audit-PeDnsZones", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Audits the deployment of Private Link Private DNS Zone resources in the Corp landing zone.", "displayName": "Audit Private Link Private DNS Zone resources", @@ -87,4 +87,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json index 422e544ef..0db5b7a6f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json @@ -1,7 +1,7 @@ { "name": "Audit-Location-Match", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Audit resource location matches resource group location", "displayName": "Audit that the resource location matches its resource group location", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_trustedlaunch.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_trustedlaunch.tmpl.json new file mode 100644 index 000000000..e4baa6c5c --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_trustedlaunch.tmpl.json @@ -0,0 +1,18 @@ +{ + "name": "Audit-TrustedLaunch", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Trusted Launch improves security of a Virtual Machine which requires VM SKU, OS Disk & OS Image to support it (Gen 2). To learn more about Trusted Launch, visit https://aka.ms/trustedlaunch.", + "displayName": "Audit virtual machines for Trusted Launch support", + "notScopes": [], + "parameters": {}, + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Audit-TrustedLaunch", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "None" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json index a7403f5cc..7279c745e 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_unusedresources.tmpl.json @@ -1,7 +1,7 @@ { "name": "Audit-UnusedResources", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This Policy initiative is a group of Policy definitions that help optimize cost by detecting unused but chargeable resources. Leverage this Policy initiative as a cost control to reveal orphaned resources that are driving cost.", "displayName": "Unused resources driving cost should be avoided", @@ -25,4 +25,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json index 4bb302c61..75a93c8c9 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json @@ -1,7 +1,7 @@ { "name": "Audit-ZoneResiliency", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Resources should be Zone Resilient.", "displayName": "Resources should be Zone Resilient", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_appgw_without_waf.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_appgw_without_waf.tmpl.json index 9f1b873b7..75fc32187 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_appgw_without_waf.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_appgw_without_waf.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-AppGW-Without-WAF", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deny creation of App Gateway without WAF.", "displayName": "Deny-AppGW-Without-WAF", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_classic-resources.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_classic-resources.tmpl.json index 34d0de81b..384fa2ab4 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_classic-resources.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_classic-resources.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Classic-Resources", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Denies deployment of classic resource types under the assigned scope.", "displayName": "Deny the deployment of classic resources", @@ -80,4 +80,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_public_ip.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_public_ip.tmpl.json index 220c4ef3c..5293a3879 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_public_ip.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_public_ip.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-DataB-Pip", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Prevent the deployment of Databricks workspaces that do not use the noPublicIp feature to host Databricks clusters without public IPs.", "displayName": "Prevent usage of Databricks with public IP", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_sku.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_sku.tmpl.json index 51efaeb27..1b4ad0232 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_sku.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_sku.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-DataB-Sku", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enforces the use of Premium Databricks workspaces to make sure appropriate security features are available including Databricks Access Controls, Credential Passthrough and SCIM provisioning for Microsoft Entra ID.", "displayName": "Enforces the use of Premium Databricks workspaces", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json index 0b531c958..6be1fe5bf 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_databricks_vnet.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-DataB-Vnet", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enforces the use of vnet injection for Databricks workspaces.", "displayName": "Enforces the use of vnet injection for Databricks", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_deleteuamiama.tmlp.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_deleteuamiama.tmlp.json new file mode 100644 index 000000000..a6f64536e --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_deleteuamiama.tmlp.json @@ -0,0 +1,29 @@ +{ + "name": "DenyAction-DeleteUAMIAMA", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "This policy provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA by blocking delete calls using deny action effect.", + "displayName": "Do not allow deletion of the User Assigned Managed Identity used by AMA", + "notScopes": [], + "parameters": { + "effect": { + "value": "DenyAction" + }, + "resourceName": { + "value": "alz-umi-identity" + }, + "resourceType": { + "value": "Microsoft.ManagedIdentity/userAssignedIdentities" + } + }, + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-DeleteResources", + "scope": "${current_scope_resource_id}", + "enforcementMode": "Default" + + }, + "location": "${default_location}", + "identity": { + "type": "None" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json index bc0fa7bce..85e3d44a3 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-AKS-HTTPS", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. For more info, visit https://aka.ms/kubepolicydoc.", "displayName": "Kubernetes clusters should be accessible only over HTTPS", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_hybridnetworking.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_hybridnetworking.tmpl.json index da636ae71..c572d0c9f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_hybridnetworking.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_hybridnetworking.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-HybridNetworking", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Denies deployment of vWAN/ER/VPN gateway resources in the Corp landing zone.", "displayName": "Deny the deployment of vWAN/ER/VPN gateway resources", @@ -31,4 +31,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_ip_forwarding.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_ip_forwarding.tmpl.json index 4cae9a5ba..12d17c23f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_ip_forwarding.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_ip_forwarding.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-IP-Forwarding", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies the network interfaces which enabled IP forwarding. The setting of IP forwarding disables Azure's check of the source and destination for a network interface. This should be reviewed by the network security team.", "displayName": "Network interfaces should disable IP forwarding", @@ -15,4 +15,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_mgmtports_internet.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_mgmtports_internet.tmpl.json index 148623cd6..384148a38 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_mgmtports_internet.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_mgmtports_internet.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-MgmtPorts-Internet", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies any network security rule that allows management port access from the Internet", "displayName": "Management port access from the Internet should be blocked", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_containers_aks.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_containers_aks.tmpl.json index 439b716c0..08d13ce2d 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_containers_aks.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_containers_aks.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Priv-Containers-AKS", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Do not allow privileged containers creation in a Kubernetes cluster. This recommendation is part of CIS 5.2.1 which is intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.", "displayName": "Kubernetes cluster should not allow privileged containers", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_escalation_aks.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_escalation_aks.tmpl.json index 5aeff9c94..cfb11ecf6 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_escalation_aks.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_escalation_aks.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Priv-Escalation-AKS", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Do not allow containers to run with privilege escalation to root in a Kubernetes cluster. This recommendation is part of CIS 5.2.5 which is intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.", "displayName": "Kubernetes clusters should not allow container privilege escalation", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_endpoints.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_endpoints.tmpl.json index 5fc9b2e34..bca7284c9 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_endpoints.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_endpoints.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Public-Endpoints", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy initiative is a group of policies that prevents creation of Azure PaaS services with exposed public endpoints.", "displayName": "Public network access should be disabled for PaaS services", @@ -15,4 +15,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip.tmpl.json index af5e2e66c..07a0b68e9 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Public-IP", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies creation of Public IPs under the assigned scope.", "displayName": "Deny the creation of public IP", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip_on_nic.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip_on_nic.tmpl.json index 0bc870339..f871785fe 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip_on_nic.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip_on_nic.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Public-IP-On-NIC", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies network interfaces from having a public IP associated to it under the assigned scope.", "displayName": "Deny network interfaces having a public IP associated", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rdp_from_internet.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rdp_from_internet.tmpl.json index 22eb65471..d9cacb333 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rdp_from_internet.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rdp_from_internet.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-RDP-From-Internet", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies any network security rule that allows RDP access from Internet.", "displayName": "RDP access from the Internet should be blocked", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_locations.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_locations.tmpl.json index ce36f684c..498ddea28 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_locations.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_locations.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Resource-Locations", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Specifies the allowed locations (regions) where Resources can be deployed.", "displayName": "Limit allowed locations for Resources", @@ -22,4 +22,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_types.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_types.tmpl.json index 83077e3f5..16fcc9008 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_types.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_resource_types.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Resource-Types", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Specifies the Resource Types to deny deployment by policy.", "displayName": "Deny-Resource-Types", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rsg_locations.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rsg_locations.tmpl.json index bf27cdbbf..aa8bd7095 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rsg_locations.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_rsg_locations.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-RSG-Locations", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Specifies the allowed locations (regions) where Resource Groups can be deployed.", "displayName": "Limit allowed locations for Resource Groups", @@ -22,4 +22,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json index 7b7666cc7..e9e0964df 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Storage-http", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking.", "displayName": "Secure transfer to storage accounts should be enabled", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_nsg.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_nsg.tmpl.json index f9dae08e4..77114ced3 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_nsg.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_nsg.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Subnet-Without-Nsg", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies the creation of a subnet without a Network Security Group to protect traffic across subnets.", "displayName": "Subnets should have a Network Security Group", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_udr.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_udr.tmpl.json index d00523458..2f39a7200 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_udr.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_subnet_without_udr.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-Subnet-Without-Udr", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy denies the creation of a subnet without a User-Defined Route to control traffic flow.", "displayName": "Subnets should have a User-Defined Route", @@ -19,4 +19,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_unmanageddisk.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_unmanageddisk.tmpl.json index 3a14cf900..8bc740f1a 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_unmanageddisk.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_unmanageddisk.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deny-UnmanagedDisk", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2022-06-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deny virtual machines that do not use managed disk. It checks the managed disk property on virtual machine OS Disk fields.", "displayName": "Deny virtual machines and virtual machine scale sets that do not use managed disk", @@ -21,4 +21,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_aks_policy.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_aks_policy.tmpl.json index ce3dadeb7..6855d8a9b 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_aks_policy.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_aks_policy.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-AKS-Policy", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Use Azure Policy Add-on to manage and report on the compliance state of your Azure Kubernetes Service (AKS) clusters. For more information, see https://aka.ms/akspolicydoc.", "displayName": "Deploy Azure Policy Add-on to Azure Kubernetes Service clusters", @@ -19,4 +19,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json index 65e82db1b..cdadc945b 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-ASC-Monitoring", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enable Monitoring in Microsoft Defender for Cloud.", "displayName": "Enable Monitoring in Microsoft Defender for Cloud", @@ -15,4 +15,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json index 31c874395..1ba7a583e 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-AzActivity-Log", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Ensures that Activity Log Diagnostics settings are set to push logs into Log Analytics workspace.", "displayName": "Deploy Diagnostic Settings for Activity Log to Log Analytics workspace", @@ -22,4 +22,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azsql_db_auditing.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azsql_db_auditing.tmpl.json index e2c9c5ee5..9758b3efc 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azsql_db_auditing.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azsql_db_auditing.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-AzSqlDb-Auditing", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "To ensure the operations performed against your SQL assets are captured, SQL servers should have auditing enabled. If auditing is not enabled, this policy will configure auditing events to flow to the specified Log Analytics workspace.", "displayName": "Configure SQL servers to have auditing enabled to Log Analytics workspace", @@ -22,4 +22,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_log_analytics.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_log_analytics.tmpl.json index b10cfbe91..42fe2e9f8 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_log_analytics.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_log_analytics.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-Log-Analytics", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploy-Log-Analytics.", "displayName": "Deploy-Log-Analytics", @@ -40,4 +40,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json index 5694a3e3f..6380846f4 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-LX-Arc-Monitoring", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploy-Linux-Arc-Monitoring.", "displayName": "Deploy-Linux-Arc-Monitoring", @@ -22,4 +22,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json new file mode 100644 index 000000000..852fd9380 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json @@ -0,0 +1,18 @@ +{ + "name": "Deploy-MDEndpointsAMA", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Configure the multiple Microsoft Defender for Endpoint integration settings with Microsoft Defender for Cloud (WDATP, WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW, WDATP_UNIFIED_SOLUTION etc.). See: https://learn.microsoft.com/azure/defender-for-cloud/integration-defender-for-endpoint for more information.", + "displayName": "Configure multiple Microsoft Defender for Endpoint integration settings with Microsoft Defender for Cloud", + "notScopes": [], + "parameters": {}, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/77b391e3-2d5d-40c3-83bf-65c846b3c6a3", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json index a26342b20..2189151d0 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-MDEndpoints", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploy Microsoft Defender for Endpoint agent on applicable images.", "displayName": "[Preview]: Deploy Microsoft Defender for Endpoint agent", @@ -28,4 +28,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json index 238f73683..f676e4b6b 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json @@ -1,7 +1,7 @@ { - "name": "Deploy-MDFC-Config", + "name": "Deploy-MDFC-Config-H224", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploy Microsoft Defender for Cloud configuration and Security Contacts", "displayName": "Deploy Microsoft Defender for Cloud configuration", @@ -25,9 +25,6 @@ "enableAscForServersVulnerabilityAssessments": { "value": "DeployIfNotExists" }, - "vulnerabilityAssessmentProvider": { - "value": "mdeTvm" - }, "enableAscForSql": { "value": "DeployIfNotExists" }, @@ -49,23 +46,17 @@ "enableAscForArm": { "value": "DeployIfNotExists" }, - "enableAscForDns": { - "value": "DeployIfNotExists" - }, "enableAscForOssDb": { "value": "DeployIfNotExists" }, "enableAscForCosmosDbs": { "value": "DeployIfNotExists" }, - "enableAscForApis": { - "value": "DeployIfNotExists" - }, "enableAscForCspm": { "value": "DeployIfNotExists" } }, - "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config", + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config_20240319", "scope": null, "enforcementMode": "Default" }, @@ -73,4 +64,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json index 75df01f29..8b5480f3e 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-MDFC-OssDb", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enable Advanced Threat Protection on your non-Basic tier open-source relational databases to detect anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. See https://aka.ms/AzDforOpenSourceDBsDocu.", "displayName": "Configure Advanced Threat Protection to be enabled on open-source relational databases", @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json new file mode 100644 index 000000000..fbb632fc6 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json @@ -0,0 +1,34 @@ +{ + "name": "Deploy-MDFC-DefSQL-AMA", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations).", + "displayName": "Enable Defender for SQL on SQL VMs and Arc-enabled SQL Servers", + "notScopes": [], + "parameters": { + "userWorkspaceResourceId": { + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/alz-logging/providers/Microsoft.OperationalInsights/workspaces/${parTopLevelManagementGroupPrefix}-la" + }, + "dcrResourceId": { + "value": "${parDataCollectionRuleMDFCSQLResourceId}" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": true + }, + "bringYourOwnDcr": { + "value": true + }, + "userAssignedIdentityResourceId": { + "value": "${parDataCollectionRuleMDFCSQLResourceId}" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/de01d381-bae9-4670-8870-786f89f49e26", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json index 7672cf866..41ab7530f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-MDFC-SqlAtp", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enable Azure Defender on your SQL Servers and SQL Managed Instances to detect anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases.", "displayName": "Configure Azure Defender to be enabled on SQL Servers and SQL Managed Instances", @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json index 63a0cd415..4c76928f3 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-Private-DNS-Zones", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy initiative is a group of policies that ensures private endpoints to Azure PaaS services are integrated with Azure Private DNS zones.", "displayName": "Configure Azure PaaS services to use private DNS zones", @@ -163,6 +163,9 @@ "azureMachineLearningWorkspacePrivateDnsZoneId": { "value": "${varPrivateDnsZonesFinalResourceIds}.azureMachineLearningWorkspacePrivateDnsZoneId]" }, + "azureMachineLearningWorkspaceSecondPrivateDnsZoneId": { + "value": "${varPrivateDnsZonesFinalResourceIds}.azureMachineLearningWorkspaceSecondPrivateDnsZoneId]" + }, "azureServiceBusNamespacePrivateDnsZoneId": { "value": "${varPrivateDnsZonesFinalResourceIds}.azureServiceBusNamespacePrivateDnsZoneId]" }, @@ -178,4 +181,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json index 5ba310082..d46b9ce3c 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json @@ -1,17 +1,17 @@ { - "name": "Deploy-Resource-Diag", + "name": "Deploy-Diag-Logs", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { - "description": "Ensures that Azure resources are configured to forward diagnostic logs and metrics to an Azure Log Analytics workspace.", - "displayName": "Deploy-Resource-Diag", + "description": "Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This initiative deploys diagnostic setting using the allLogs category group to route logs to an Event Hub for all supported resources.", + "displayName": "Enable allLogs category group resource logging for supported resources to Log Analytics", "notScopes": [], "parameters": { "logAnalytics": { "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/${parTopLevelManagementGroupPrefix}-mgmt/providers/Microsoft.OperationalInsights/workspaces/${parTopLevelManagementGroupPrefix}-la" } }, - "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics", + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/0884adba-2312-4468-abeb-5422caed1038", "scope": null, "enforcementMode": "Default" }, @@ -19,4 +19,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_db_auditing.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_db_auditing.tmpl.json index 2ada69535..673df975b 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_db_auditing.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_db_auditing.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-SQL-DB-Auditing", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.", "displayName": "Auditing on SQL server should be enabled", @@ -19,4 +19,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_security.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_security.tmpl.json index fb7ca3e43..af7d707ca 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_security.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_security.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-SQL-Security", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploy-SQL-Security.", "displayName": "Deploy-SQL-Security", @@ -19,4 +19,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_tde.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_tde.tmpl.json index fdf235a5a..8ff9da856 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_tde.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_tde.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-SQL-TDE", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy ensures that Transparent Data Encryption is enabled on SQL Servers.", "displayName": "Deploy TDE on SQL servers", @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json index b290550f1..7a8f35a33 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-SQL-Threat", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This policy ensures that Threat Detection is enabled on SQL Servers.", "displayName": "Deploy Threat Detection on SQL servers", @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json new file mode 100644 index 000000000..e89c15042 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json @@ -0,0 +1,25 @@ +{ + "name": "Deploy-vmArc-ChangeTrack", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Enable ChangeTracking and Inventory for Arc-enabled virtual machines. Takes Data Collection Rule ID as parameter and asks for an option to input applicable locations.", + "displayName": "Enable ChangeTracking and Inventory for Arc-enabled virtual machines", + "notScopes": [], + "parameters": { + "dcrResourceId": { + "value": "${parDataCollectionRuleChangeTrackingResourceId}" + }, + "effect": { + "value": "DeployIfNotExists" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/53448c70-089b-4f52-8f38-89196d7f2de1", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json new file mode 100644 index 000000000..9248147cc --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json @@ -0,0 +1,28 @@ +{ + "name": "Deploy-vmHybr-Monitoring", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Enable Azure Monitor for Hybrid Virtual Machines in the specified scope (Management group, Subscription or resource group).", + "displayName": "Enable Azure Monitor for Hybrid Virtual Machines", + "notScopes": [], + "parameters": { + "dcrResourceId": { + "value": "${parDataCollectionRuleVMInsightsResourceId}" + }, + "enableProcessesAndDependencies": { + "value": true + }, + "effect": { + "value": "DeployIfNotExists" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/2b00397d-c309-49c4-aa5a-f0b2c5bc6321", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json index fb2f29562..d147583a3 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-VM-Backup", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.", "displayName": "Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy", @@ -19,4 +19,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json new file mode 100644 index 000000000..33723114f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json @@ -0,0 +1,34 @@ +{ + "name": "Deploy-VM-ChangeTrack", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Enable ChangeTracking and Inventory for virtual machines. Takes Data Collection Rule ID as parameter and asks for an option to input applicable locations and user-assigned identity for Azure Monitor Agent.", + "displayName": "Enable ChangeTracking and Inventory for virtual machines", + "notScopes": [], + "parameters": { + "dcrResourceId": { + "value": "${parDataCollectionRuleChangeTrackingResourceId}" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": true + }, + "restrictBringYourOwnUserAssignedIdentityToSubscription": { + "value": false + }, + "userAssignedIdentityResourceId": { + "value": "${parUserAssignedManagedIdentityResourceId}" + }, + "effect": { + "value": "DeployIfNotExists" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/92a36f05-ebc9-4bba-9128-b47ad2ea3354", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json new file mode 100644 index 000000000..bafa57058 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json @@ -0,0 +1,40 @@ +{ + "name": "Deploy-VM-Monitoring", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Enable Azure Monitor for the virtual machines (VMs) in the specified scope (management group, subscription or resource group). Takes Log Analytics workspace as parameter.", + "displayName": "Enable Azure Monitor for VMs", + "notScopes": [], + "parameters": { + "dcrResourceId": { + "value": "${parDataCollectionRuleVMInsightsResourceId}" + }, + "enableProcessesAndDependencies": { + "value": true + }, + "scopeToSupportedImages": { + "value": false + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": true + }, + "restrictBringYourOwnUserAssignedIdentityToSubscription": { + "value": false + }, + "userAssignedIdentityResourceId": { + "value": "${parUserAssignedManagedIdentityResourceId}" + }, + "effect": { + "value": "DeployIfNotExists" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/924bfe3a-762f-40e7-86dd-5c8b95eb09e6", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json deleted file mode 100644 index 738007b0b..000000000 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "name": "Deploy-VM-Monitoring", - "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", - "properties": { - "description": "Enable Azure Monitor for the virtual machines (VMs) in the specified scope (management group, subscription or resource group). Takes Log Analytics workspace as parameter.", - "displayName": "Enable Azure Monitor for VMs", - "notScopes": [], - "parameters": { - "logAnalytics_1": { - "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/${parTopLevelManagementGroupPrefix}-mgmt/providers/Microsoft.OperationalInsights/workspaces/${parTopLevelManagementGroupPrefix}-la" - } - }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/55f3eceb-5573-4f18-9695-226972c6d74a", - "scope": null, - "enforcementMode": "Default" - }, - "location": null, - "identity": { - "type": "SystemAssigned" - } -} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json new file mode 100644 index 000000000..55869e744 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json @@ -0,0 +1,34 @@ +{ + "name": "Deploy-VMSS-ChangeTrack", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Enable ChangeTracking and Inventory for virtual machine scale sets. Takes Data Collection Rule ID as parameter and asks for an option to input applicable locations and user-assigned identity for Azure Monitor Agent.", + "displayName": "Enable ChangeTracking and Inventory for virtual machine scale sets", + "notScopes": [], + "parameters": { + "dcrResourceId": { + "value": "${parDataCollectionRuleChangeTrackingResourceId}" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": true + }, + "restrictBringYourOwnUserAssignedIdentityToSubscription": { + "value": false + }, + "userAssignedIdentityResourceId": { + "value": "${parUserAssignedManagedIdentityResourceId}" + }, + "effect": { + "value": "DeployIfNotExists" + } + }, + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/c4a70814-96be-461c-889f-2b27429120dc", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitoring.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json similarity index 54% rename from infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitoring.tmpl.json rename to infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json index a6e144263..d3e97457f 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitoring.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json @@ -1,17 +1,35 @@ { "name": "Deploy-VMSS-Monitoring", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Enable Azure Monitor for the Virtual Machine Scale Sets in the specified scope (Management group, Subscription or resource group). Takes Log Analytics workspace as parameter. Note: if your scale set upgradePolicy is set to Manual, you need to apply the extension to the all VMs in the set by calling upgrade on them. In CLI this would be az vmss update-instances.", "displayName": "Enable Azure Monitor for Virtual Machine Scale Sets", "notScopes": [], "parameters": { - "logAnalytics_1": { - "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/${parTopLevelManagementGroupPrefix}-mgmt/providers/Microsoft.OperationalInsights/workspaces/${parTopLevelManagementGroupPrefix}-la" + "dcrResourceId": { + "value": "${parDataCollectionRuleVMInsightsResourceId}" + }, + "enableProcessesAndDependencies": { + "value": true + }, + "scopeToSupportedImages": { + "value": false + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": true + }, + "restrictBringYourOwnUserAssignedIdentityToSubscription": { + "value": false + }, + "userAssignedIdentityResourceId": { + "value": "${parUserAssignedManagedIdentityResourceId}" + }, + "effect": { + "value": "DeployIfNotExists" } }, - "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/75714362-cae7-409e-9b99-a8e5075b7fad", + "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/f5bf694c-cca7-4033-b883-3a23327d5485", "scope": null, "enforcementMode": "Default" }, @@ -19,4 +37,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_ws_arc_monitoring.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_ws_arc_monitoring.tmpl.json index 5ee6284d2..07cbcd4a6 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_ws_arc_monitoring.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_ws_arc_monitoring.tmpl.json @@ -1,7 +1,7 @@ { "name": "Deploy-WS-Arc-Monitoring", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Deploys the Log Analytics agent to Windows Azure Arc machines if the agent isn't installed.", "displayName": "Deploy-Windows-Arc-Monitoring", @@ -22,4 +22,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enable_ddos_vnet.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enable_ddos_vnet.tmpl.json index 631e91477..3a2ad5f82 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enable_ddos_vnet.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enable_ddos_vnet.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enable-DDoS-VNET", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Protect your virtual networks against volumetric and protocol attacks with Azure DDoS Protection Standard. For more information, visit https://aka.ms/ddosprotectiondocs.", "displayName": "Virtual networks should be protected by Azure DDoS Protection Standard", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_acsb.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_acsb.tmpl.json index 1143ba51f..53f5a8b5a 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_acsb.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_acsb.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-ACSB", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This initiative assignment enables Azure Compute Security Baseline compliance auditing for Windows and Linux virtual machines.", "displayName": "Enforce Azure Compute Security Baseline compliance auditing", @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_decomm.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_decomm.tmpl.json index af4b88795..f46e9249a 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_decomm.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_decomm.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-ALZ-Decomm", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This initiative will help enforce and govern subscriptions that are placed within the decommissioned Management Group as part of your Subscription decommissioning process. See https://aka.ms/alz/policies for more information.", "displayName": "Enforce ALZ Decommissioned Guardrails", @@ -32,4 +32,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_sandbox.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_sandbox.tmpl.json index 856c5ec26..f06a5aeb8 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_sandbox.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_alz_sandbox.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-ALZ-Sandbox", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This initiative will help enforce and govern subscriptions that are placed within the Sandobx Management Group. See https://aka.ms/alz/policies for more information.", "displayName": "Enforce ALZ Sandbox Guardrails", @@ -11,11 +11,11 @@ "value": [ "microsoft.network/expressroutecircuits", "microsoft.network/expressroutegateways", - "microsoft.network/expressrouteports", + "microsoft.network/expressrouteports", "microsoft.network/virtualwans", "microsoft.network/virtualhubs", "microsoft.network/vpngateways", - "microsoft.network/p2svpngateways", + "microsoft.network/p2svpngateways", "microsoft.network/vpnsites", "microsoft.network/virtualnetworkgateways" ] diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_aum_checkupdates.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_aum_checkupdates.tmpl.json new file mode 100644 index 000000000..1cb233bd1 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_aum_checkupdates.tmpl.json @@ -0,0 +1,22 @@ +{ + "name": "Enable-AUM-CheckUpdates", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "Configure auto-assessment (every 24 hours) for OS updates. You can control the scope of assignment according to machine subscription, resource group, location or tag. Learn more about this for Windows: https://aka.ms/computevm-windowspatchassessmentmode, for Linux: https://aka.ms/computevm-linuxpatchassessmentmode.", + "displayName": "Configure periodic checking for missing system updates on azure virtual machines and Arc-enabled virtual machines.", + "notScopes": [], + "parameters": { + "assessmentMode": { + "value": "AutomaticByPlatform" + } + }, + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-AUM-CheckUpdates", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_backup.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_backup.json new file mode 100644 index 000000000..18544ebdd --- /dev/null +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_backup.json @@ -0,0 +1,18 @@ +{ + "name": "Enforce-ASR", + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2024-04-01", + "properties": { + "description": "This initiative assignment enables recommended ALZ guardrails for Azure Recovery Services.", + "displayName": "Enforce enhanced recovery and backup policies", + "notScopes": [], + "parameters": {}, + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-Backup", + "scope": null, + "enforcementMode": "Default" + }, + "location": null, + "identity": { + "type": "SystemAssigned" + } +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json index 6017ba4a6..6efe25d36 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_gr_keyvault.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-GR-KeyVault", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "This initiative assignment enables recommended ALZ guardrails for Azure Key Vault.", "displayName": "Enforce recommended guardrails for Azure Key Vault", @@ -15,4 +15,4 @@ "identity": { "type": "None" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_conf.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_conf.tmpl.json index 946ec701e..5d7525e22 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_conf.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_conf.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-Sovereign-Conf", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "The Microsoft Cloud for Sovereignty recommends confidential policies to help organizations achieve their sovereignty goals by default denying the creation of resources outside of approved regions, denying resources that are not backed by Azure Confidential Computing, and denying data storage resources that are not using Customer-Managed Keys. More details can be found here: https://aka.ms/SovereigntyBaselinePolicies", "displayName": "[Preview]: Sovereignty Baseline - Confidential Policies", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json index 260d95197..b37cd9a34 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_sovereignty_baseline_global.tmpl.json @@ -1,7 +1,7 @@ { "name": "Enforce-Sovereign-Global", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "The Microsoft Cloud for Sovereignty recommends global policies to help organizations achieve their sovereignty goals by default denying the creation of resources outside of approved regions. More details can be found here: https://aka.ms/SovereigntyBaselinePolicies", "displayName": "[Preview]: Sovereignty Baseline - Global Policies", diff --git a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json index 96ff96fba..8f5504450 100644 --- a/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json +++ b/infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json @@ -1,13 +1,13 @@ { - "name": "Enforce-TLS-SSL", + "name": "Enforce-TLS-SSL-H224", "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2019-09-01", + "apiVersion": "2024-04-01", "properties": { "description": "Choose either Deploy if not exist and append in combination with audit or Select Deny in the Policy effect. Deny polices shift left. Deploy if not exist and append enforce but can be changed, and because missing exsistense condition require then the combination of Audit.", "displayName": "Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit", "notScopes": [], "parameters": {}, - "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit", + "policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit_20240509", "scope": null, "enforcementMode": "Default" }, @@ -15,4 +15,4 @@ "identity": { "type": "SystemAssigned" } -} \ No newline at end of file +} diff --git a/infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.bicep b/infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.bicep index b9ac25532..99a1a91f7 100644 --- a/infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.bicep +++ b/infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.bicep @@ -81,7 +81,7 @@ var varPolicyAssignmentIdentityRoleAssignmentsMgsConverged = parPolicyAssignment // Customer Usage Attribution Id var varCuaid = '78001e36-9738-429c-a343-45cc84e8a527' -resource resPolicyAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = { +resource resPolicyAssignment 'Microsoft.Authorization/policyAssignments@2024-04-01' = { name: parPolicyAssignmentName properties: { displayName: parPolicyAssignmentDisplayName diff --git a/infra-as-code/bicep/modules/policy/definitions/customPolicyDefinitions.bicep b/infra-as-code/bicep/modules/policy/definitions/customPolicyDefinitions.bicep index 5643d3401..a05faadfd 100644 --- a/infra-as-code/bicep/modules/policy/definitions/customPolicyDefinitions.bicep +++ b/infra-as-code/bicep/modules/policy/definitions/customPolicyDefinitions.bicep @@ -61,10 +61,22 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-AA-child-resources' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AA-child-resources.json') } + { + name: 'Deny-APIM-TLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-APIM-TLS.json') + } + { + name: 'Deny-AppGw-Without-Tls' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppGw-Without-Tls.json') + } { name: 'Deny-AppGW-Without-WAF' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppGW-Without-WAF.json') } + { + name: 'Deny-AppService-without-BYOC' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppService-without-BYOC.json') + } { name: 'Deny-AppServiceApiApp-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppServiceApiApp-http.json') @@ -77,6 +89,22 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-AppServiceWebApp-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppServiceWebApp-http.json') } + { + name: 'Deny-AzFw-Without-Policy' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AzFw-Without-Policy.json') + } + { + name: 'Deny-CognitiveServices-NetworkAcls' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-NetworkAcls.json') + } + { + name: 'Deny-CognitiveServices-Resource-Kinds' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-Resource-Kinds.json') + } + { + name: 'Deny-CognitiveServices-RestrictOutboundNetworkAccess' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-RestrictOutboundNetworkAccess.json') + } { name: 'Deny-Databricks-NoPublicIp' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Databricks-NoPublicIp.json') @@ -89,6 +117,14 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-Databricks-VirtualNetwork' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Databricks-VirtualNetwork.json') } + { + name: 'Deny-EH-minTLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-EH-minTLS.json') + } + { + name: 'Deny-EH-Premium-CMK' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-EH-Premium-CMK.json') + } { name: 'Deny-FileServices-InsecureAuth' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-FileServices-InsecureAuth.json') @@ -105,6 +141,14 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-FileServices-InsecureSmbVersions' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-FileServices-InsecureSmbVersions.json') } + { + name: 'Deny-LogicApp-Public-Network' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-LogicApp-Public-Network.json') + } + { + name: 'Deny-LogicApps-Without-Https' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-LogicApps-Without-Https.json') + } { name: 'Deny-MachineLearning-Aks' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-MachineLearning-Aks.json') @@ -169,6 +213,10 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-Redis-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Redis-http.json') } + { + name: 'Deny-Service-Endpoints' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Service-Endpoints.json') + } { name: 'Deny-Sql-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Sql-minTLS.json') @@ -177,10 +225,46 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deny-SqlMi-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-SqlMi-minTLS.json') } + { + name: 'Deny-Storage-ContainerDeleteRetentionPolicy' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ContainerDeleteRetentionPolicy.json') + } + { + name: 'Deny-Storage-CopyScope' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-CopyScope.json') + } + { + name: 'Deny-Storage-CorsRules' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-CorsRules.json') + } + { + name: 'Deny-Storage-LocalUser' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-LocalUser.json') + } { name: 'Deny-Storage-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json') } + { + name: 'Deny-Storage-NetworkAclsBypass' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsBypass.json') + } + { + name: 'Deny-Storage-NetworkAclsVirtualNetworkRules' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsVirtualNetworkRules.json') + } + { + name: 'Deny-Storage-ResourceAccessRulesResourceId' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesResourceId.json') + } + { + name: 'Deny-Storage-ResourceAccessRulesTenantId' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesTenantId.json') + } + { + name: 'Deny-Storage-ServicesEncryption' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ServicesEncryption.json') + } { name: 'Deny-Storage-SFTP' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-SFTP.json') @@ -221,6 +305,10 @@ var varCustomPolicyDefinitionsArray = [ name: 'DenyAction-ActivityLogs' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json') } + { + name: 'DenyAction-DeleteResources' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json') + } { name: 'DenyAction-DiagnosticLogs' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json') @@ -457,6 +545,10 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deploy-FirewallPolicy' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-FirewallPolicy.json') } + { + name: 'Deploy-LogicApp-TLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-LogicApp-TLS.json') + } { name: 'Deploy-MDFC-Arc-SQL-DCR-Association' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json') @@ -493,6 +585,10 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deploy-PostgreSQL-sslEnforcement' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-PostgreSQL-sslEnforcement.json') } + { + name: 'Deploy-Private-DNS-Generic' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Private-DNS-Generic.json') + } { name: 'Deploy-Sql-AuditingSettings' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Sql-AuditingSettings.json') @@ -541,1508 +637,3601 @@ var varCustomPolicyDefinitionsArray = [ name: 'Deploy-Windows-DomainJoin' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Windows-DomainJoin.json') } -] - -// This variable contains a number of objects that load in the custom Azure Policy Set/Initiative Defintions that are provided as part of the ESLZ/ALZ reference implementation - this is automatically created in the file 'infra-as-code\bicep\modules\policy\lib\policy_set_definitions\_policySetDefinitionsBicepInput.txt' via a GitHub action, that runs on a daily schedule, and is then manually copied into this variable. -var varCustomPolicySetDefinitionsArray = [ { - name: 'Audit-UnusedResourcesCostOptimization' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'AuditAzureHybridBenefitUnusedResourcesCostOptimization' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-AzureHybridBenefit' - definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditAzureHybridBenefitUnusedResourcesCostOptimization.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AuditDisksUnusedResourcesCostOptimization' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-Disks-UnusedResourcesCostOptimization' - definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditDisksUnusedResourcesCostOptimization.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AuditPublicIpAddressesUnusedResourcesCostOptimization' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-PublicIpAddresses-UnusedResourcesCostOptimization' - definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditPublicIpAddressesUnusedResourcesCostOptimization.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AuditServerFarmsUnusedResourcesCostOptimization' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-ServerFarms-UnusedResourcesCostOptimization' - definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditServerFarmsUnusedResourcesCostOptimization.parameters - definitionGroups: [] - } - ] - } - { - name: 'Deny-PublicPaaSEndpoints' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'ACRDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0fdf0491-d080-4575-b627-ad0e843cba0f' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ACRDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AFSDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/21a8cd35-125e-4d13-b82d-2e19b7208bb7' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AFSDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AKSDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AKSDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ApiManDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/df73bd95-24da-4a4f-96b9-4e8b94b402bd' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ApiManDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AppConfigDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3d9f5e4c-9947-4579-9539-2a7695fbc187' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AppConfigDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AsDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b5ef780-c53c-4a64-87f3-bb9c8c8094ba' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AsDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AseDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2d048aca-6479-4923-88f5-e2ac295d9af3' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AseDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AutomationDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/955a914f-bf86-4f0e-acd5-e0766b0efcb6' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AutomationDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'BatchDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/74c5a0ae-5e48-4738-b093-65e23a060488' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.BatchDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'BotServiceDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e8168db-69e3-4beb-9822-57cb59202a9d' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.BotServiceDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ContainerAppsEnvironmentDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d074ddf8-01a5-4b5e-a2b8-964aed452c0a' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ContainerAppsEnvironmentDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CosmosDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.CosmosDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FunctionDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/969ac98b-88a8-449f-883c-2e9adb123127' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.FunctionDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KeyVaultDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/405c5871-3e91-4644-8a63-58e19d68ff5b' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.KeyVaultDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MariaDbDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fdccbe47-f3e3-4213-ad5d-ea459b2fa077' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MariaDbDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MlDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/438c38d2-3772-465a-a9cc-7a6666a275ce' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MlDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MySQLFlexDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9299215-ae47-4f50-9c54-8a392f68a052' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MySQLFlexDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PostgreSQLFlexDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e1de0e3-42cb-4ebc-a86d-61d0c619ca48' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.PostgreSQLFlexDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RedisCacheDenyPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/470baccb-7e51-4549-8b1a-3e5be069f663' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.RedisCacheDenyPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SqlServerDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b8ca024-1d5c-4dec-8995-b1a932b41780' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.SqlServerDenyPaasPublicIP.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageDenyPaasPublicIP' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-283140c09693' - definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.StorageDenyPaasPublicIP.parameters - definitionGroups: [] - } - ] - } - { - name: 'DenyAction-DeleteProtection' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_DenyAction-DeleteProtection.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'DenyActionDelete-ActivityLogSettings' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-ActivityLogs' - definitionParameters: varPolicySetDefinitionEsDenyActionDeleteProtectionParameters['DenyActionDelete-ActivityLogSettings'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DenyActionDelete-DiagnosticSettings' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-DiagnosticLogs' - definitionParameters: varPolicySetDefinitionEsDenyActionDeleteProtectionParameters['DenyActionDelete-DiagnosticSettings'].parameters - definitionGroups: [] - } - ] - } - { - name: 'Deploy-AUM-CheckUpdates' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-AUM-CheckUpdates.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateLinux' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46' - definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateLinux.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateWindows' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46' - definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateWindows.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'azureUpdateManagerVmCheckUpdateLinux' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15' - definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateLinux.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'azureUpdateManagerVmCheckUpdateWindows' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15' - definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateWindows.parameters - definitionGroups: [] - } - ] + name: 'Modify-NSG' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Modify-NSG.json') } { - name: 'Deploy-Diagnostics-LogAnalytics' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'ACIDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ACI' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ACIDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ACRDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ACR' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ACRDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AKSDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6c66c325-74c8-42fd-a286-a74b0e2939d8' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AKSDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AnalysisServiceDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AnalysisService' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AnalysisServiceDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'APIforFHIRDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ApiForFHIR' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.APIforFHIRDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'APIMgmtDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-APIMgmt' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.APIMgmtDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ApplicationGatewayDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ApplicationGateway' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ApplicationGatewayDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AppServiceDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WebServerFarm' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AppServiceDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AppServiceWebappDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Website' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AppServiceWebappDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AutomationDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AA' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AutomationDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AVDScalingPlansDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AVDScalingPlans' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AVDScalingPlansDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'BastionDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Bastion' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.BastionDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'BatchDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c84e5349-db6d-4769-805e-e14037dab9b5' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.BatchDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CDNEndpointsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CDNEndpoints' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CDNEndpointsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CognitiveServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CognitiveServices' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CognitiveServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CosmosDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CosmosDB' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CosmosDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DatabricksDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Databricks' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DatabricksDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DataExplorerClusterDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DataExplorerCluster' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataExplorerClusterDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DataFactoryDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DataFactory' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataFactoryDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DataLakeAnalyticsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DLAnalytics' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataLakeAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DataLakeStoreDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d56a5a7c-72d7-42bc-8ceb-3baf4c0eae03' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataLakeStoreDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'EventGridSubDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridSub' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventGridSubDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'EventGridTopicDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridTopic' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventGridTopicDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'EventHubDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f6e93e8-6b31-41b1-83f6-36e449a42579' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventHubDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'EventSystemTopicDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridSystemTopic' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventSystemTopicDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ExpressRouteDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ExpressRoute' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ExpressRouteDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FirewallDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Firewall' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FirewallDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FrontDoorDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-FrontDoor' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FrontDoorDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FunctionAppDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Function' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FunctionAppDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'HDInsightDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-HDInsight' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.HDInsightDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'IotHubDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-iotHub' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.IotHubDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KeyVaultDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bef3f64c-5290-43b7-85b0-9b254eef4c47' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.KeyVaultDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'LoadBalancerDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LoadBalancer' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LoadBalancerDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'LogAnalyticsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LogAnalytics' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'LogicAppsISEDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LogicAppsISE' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogicAppsISEDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'LogicAppsWFDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b889a06c-ec72-4b03-910a-cb169ee18721' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogicAppsWFDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MariaDBDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MariaDB' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MariaDBDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MediaServiceDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MediaService' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MediaServiceDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MlWorkspaceDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MlWorkspace' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MlWorkspaceDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MySQLDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MySQL' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MySQLDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'NetworkNICDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-NIC' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkNICDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'NetworkPublicIPNicDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/752154a7-1e0f-45c6-a880-ac75a7e4f648' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkPublicIPNicDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'NetworkSecurityGroupsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-NetworkSecurityGroups' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkSecurityGroupsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PostgreSQLDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-PostgreSQL' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.PostgreSQLDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PowerBIEmbeddedDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-PowerBIEmbedded' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.PowerBIEmbeddedDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RecoveryVaultDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c717fb0c-d118-4c43-ab3d-ece30ac81fb3' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RecoveryVaultDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RedisCacheDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-RedisCache' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RedisCacheDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RelayDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Relay' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RelayDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SearchServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08ba64b8-738f-4918-9686-730d2ed79c7d' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SearchServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ServiceBusDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/04d53d87-841c-4f23-8a5b-21564380b55e' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ServiceBusDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SignalRDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SignalR' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SignalRDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLDatabaseDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b79fa14e-238a-4c2d-b376-442ce508fc84' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLDatabaseDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLElasticPoolsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SQLElasticPools' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLElasticPoolsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLMDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SQLMI' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLMDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageAccountBlobServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountBlobServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageAccountDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59759c62-9a22-4cdf-ae64-074495983fef' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageAccountFileServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/25a70cc8-2bd4-47f1-90b6-1478e4662c96' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountFileServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageAccountQueueServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7bd000e3-37c7-4928-9f31-86c4b77c5c45' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountQueueServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageAccountTableServicesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2fb86bf3-d221-43d1-96d1-2434af34eaa0' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountTableServicesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StreamAnalyticsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/237e0f7e-b0e8-4ec4-ad46-8c12cb66d673' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StreamAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'TimeSeriesInsightsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-TimeSeriesInsights' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.TimeSeriesInsightsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'TrafficManagerDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-TrafficManager' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.TrafficManagerDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'VirtualMachinesDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VM' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VirtualMachinesDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'VirtualNetworkDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VirtualNetwork' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VirtualNetworkDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'VMSSDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VMSS' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VMSSDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'VNetGWDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VNetGW' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VNetGWDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'VWanS2SVPNGWDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VWanS2SVPNGW' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VWanS2SVPNGWDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WVDAppGroupDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDAppGroup' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDAppGroupDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WVDHostPoolsDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDHostPools' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDHostPoolsDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WVDWorkspaceDeployDiagnosticLogDeployLogAnalytics' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDWorkspace' - definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDWorkspaceDeployDiagnosticLogDeployLogAnalytics.parameters - definitionGroups: [] - } - ] - } - { - name: 'Deploy-MDFC-Config' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'ascExport' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.ascExport.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'azurePolicyForKubernetes' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.azurePolicyForKubernetes.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForApis' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e54d2be9-5f2e-4d65-98e4-4f0e670b23d6' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForApis.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForAppServices' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForAppServices.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForArm' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForArm.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderforContainers' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderforContainers.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForCosmosDbs' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82bf5b87-728b-4a74-ba4d-6123845cf542' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForCosmosDbs.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForCspm' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/689f7782-ef2c-4270-a6d0-7664869076bd' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForCspm.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForDns' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2370a3c1-4a25-4283-a91a-c9c1a145fb2f' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForDns.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForKeyVaults' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForKeyVaults.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderforKubernetes' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/64def556-fbad-4622-930e-72d1d5589bf5' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderforKubernetes.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForOssDb' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForOssDb.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlPaas' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForSqlPaas.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlServerVirtualMachines' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForSqlServerVirtualMachines.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForStorageAccountsV2' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForStorageAccountsV2.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForVM' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForVM.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForVMVulnerabilityAssessment' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForVMVulnerabilityAssessment.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'migrateToMdeTvm' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.migrateToMdeTvm.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'securityEmailContact' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts' - definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.securityEmailContact.parameters - definitionGroups: [] - } - ] - } - { - name: 'Deploy-MDFC-DefenderSQL-AMA' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'defenderForSqlAma' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-AMA' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlAma.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlArcAma' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3592ff98-9787-443a-af59-4505d0fe0786' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcAma.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlArcDcrAssociation' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-SQL-DCR-Association' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcDcrAssociation.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlArcMdsql' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/65503269-6a54-4553-8a28-0065a8e6d929' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsql.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlArcMdsqlDcr' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-Sql-DefenderSQL-DCR' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsqlDcr.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlMdsql' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsql.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'defenderForSqlMdsqlDcr' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL-DCR' - definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsqlDcr.parameters - definitionGroups: [] - } - ] - } - { - name: 'Deploy-Private-DNS-Zones' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'DINE-Private-DNS-Azure-ACR' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e9585a95-5b8c-4d03-b193-dc7eb5ac4c32' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ACR'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-App' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7a860e27-9ca2-4fc6-822d-c2d248c300df' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-App'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-AppServices' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b318f84a-b872-429b-ac6d-a01b96814452' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-AppServices'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Automation-DSCHybrid' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6dd01e4f-1be1-4e80-9d0b-d109e04cb064' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Automation-DSCHybrid'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Automation-Webhook' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6dd01e4f-1be1-4e80-9d0b-d109e04cb064' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Automation-Webhook'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Batch' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4ec38ebc-381f-45ee-81a4-acbc4be878f8' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Batch'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-CognitiveSearch' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fbc14a67-53e4-4932-abcc-2049c6706009' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-CognitiveSearch'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-CognitiveServices' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c4bc6f10-cb41-49eb-b000-d5ab82e2a091' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-CognitiveServices'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Cassandra' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Cassandra'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Gremlin' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Gremlin'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-MongoDB' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-MongoDB'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-SQL' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-SQL'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Table' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Table'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-Browser-AuthN' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-Browser-AuthN'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-UI-Api' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-UI-Api'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-DataFactory' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86cd96e1-1745-420d-94d4-d3f2fe415aa4' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DataFactory'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-DataFactory-Portal' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86cd96e1-1745-420d-94d4-d3f2fe415aa4' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DataFactory-Portal'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-DiskAccess' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bc05b96c-0b36-4ca9-82f0-5c53f96ce05a' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DiskAccess'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-EventGridDomains' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d389df0a-e0d7-4607-833c-75a6fdac2c2d' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventGridDomains'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-EventGridTopics' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/baf19753-7502-405f-8745-370519b20483' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventGridTopics'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-EventHubNamespace' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ed66d4f5-8220-45dc-ab4a-20d1749c74e6' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventHubNamespace'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-File-Sync' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/06695360-db88-47f6-b976-7500d4297475' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-File-Sync'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-HDInsight' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/43d6e3bd-fc6a-4b44-8b4d-2151d8736a11' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-HDInsight'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-IoT' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/aaa64d2d-2fa3-45e5-b332-0b031b9b30e8' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoT'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-IoTHubs' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c99ce9c1-ced7-4c3e-aca0-10e69ce0cb02' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTHubs'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-KeyVault' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac673a9a-f77d-4846-b2d8-a57f8e1c01d4' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-KeyVault'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-MachineLearningWorkspace' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee40564d-486e-4f68-a5ca-7a621edae0fb' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MachineLearningWorkspace'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Key' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Key'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Live' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Live'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Stream' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Stream'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Migrate' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7590a335-57cf-4c95-babd-ecbc8fafeb1f' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Migrate'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Monitor' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/437914ee-c176-4fff-8986-7e05eb971365' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Monitor'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-RedisCache' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e016b22b-e0eb-436d-8fd7-160c4eaed6e2' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-RedisCache'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-ServiceBusNamespace' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0fcf93c-c063-4071-9668-c47474bd3564' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ServiceBusNamespace'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-SignalR' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0e86710-7fb7-4a6c-a064-32e9b829509e' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-SignalR'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Site-Recovery' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/942bd215-1a66-44be-af65-6a1c0318dbe2' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Site-Recovery'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Blob' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75973700-529f-4de2-b794-fb9b6781b6b0' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Blob'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Blob-Sec' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d847d34b-9337-4e2d-99a5-767e5ac9c582' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Blob-Sec'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-DFS' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83c6fe0f-2316-444a-99a1-1ecd8a7872ca' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-DFS'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-DFS-Sec' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/90bd4cb3-9f59-45f7-a6ca-f69db2726671' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-DFS-Sec'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-File' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6df98d03-368a-4438-8730-a93c4d7693d6' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-File'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Queue' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bcff79fb-2b0d-47c9-97e5-3023479b00d1' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Queue'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Queue-Sec' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/da9b4ae8-5ddc-48c5-b9c0-25f8abf7a3d6' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Queue-Sec'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-StaticWeb' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9adab2a5-05ba-4fbd-831a-5bf958d04218' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-StaticWeb'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-StaticWeb-Sec' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d19ae5f1-b303-4b82-9ca8-7682749faf0c' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-StaticWeb-Sec'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-Dev' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-Dev'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-SQL' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-SQL'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-SQL-OnDemand' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-SQL-OnDemand'].parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DINE-Private-DNS-Azure-Web' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b026355-49cb-467b-8ac4-f777874e175a' - definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Web'].parameters - definitionGroups: [] - } - ] - } - { - name: 'Deploy-Sql-Security' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'SqlDbAuditingSettingsDeploySqlSecurity' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-AuditingSettings' - definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbAuditingSettingsDeploySqlSecurity.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SqlDbSecurityAlertPoliciesDeploySqlSecurity' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-SecurityAlertPolicies' - definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbSecurityAlertPoliciesDeploySqlSecurity.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SqlDbTdeDeploySqlSecurity' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f' - definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbTdeDeploySqlSecurity.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SqlDbVulnerabilityAssessmentsDeploySqlSecurity' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-vulnerabilityAssessments' - definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbVulnerabilityAssessmentsDeploySqlSecurity.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-ACSB' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ACSB.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'GcIdentity' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3cf2ab00-13f1-4d0c-8971-2ac904541a7e' - definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcIdentity.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'GcLinux' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/331e8ea8-378a-410f-a2e5-ae22f38bb0da' - definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcLinux.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'GcWindows' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/385f5831-96d4-41db-9a3c-cd3af78aaae6' - definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcWindows.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'LinAcsb' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fc9b3da7-8347-4380-8e70-0a0361d8dedd' - definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.LinAcsb.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WinAcsb' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/72650e9f-97bc-4b2a-ab5f-9781a9fcecbc' - definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.WinAcsb.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-ALZ-Decomm' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Decomm.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'DecomDenyResources' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a08ec900-254a-4555-9bf5-e42af04b5c5c' - definitionParameters: varPolicySetDefinitionEsEnforceALZDecommParameters.DecomDenyResources.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DecomShutdownMachines' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Vm-autoShutdown' - definitionParameters: varPolicySetDefinitionEsEnforceALZDecommParameters.DecomShutdownMachines.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-ALZ-Sandbox' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Sandbox.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'SandboxDenyVnetPeering' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-VNET-Peer-Cross-Sub' - definitionParameters: varPolicySetDefinitionEsEnforceALZSandboxParameters.SandboxDenyVnetPeering.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SandboxNotAllowed' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749' - definitionParameters: varPolicySetDefinitionEsEnforceALZSandboxParameters.SandboxNotAllowed.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-Encryption-CMK' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'ACRCmkDeny' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.ACRCmkDeny.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AksCmkDeny' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7d7be79c-23ba-4033-84dd-45e2a5ccdd67' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.AksCmkDeny.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AzureBatchCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/99e9ccd8-3db9-4592-b0d1-14b1715a4d8a' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.AzureBatchCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CognitiveServicesCMK' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/67121cc7-ff39-4ab8-b7e3-95b84dab487d' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.CognitiveServicesCMK.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'CosmosCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f905d99-2ab7-462c-a6b0-f709acca6c8f' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.CosmosCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'DataBoxCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86efb160-8de7-451d-bc08-5d475b0aadae' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.DataBoxCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'EncryptedVMDisksEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.EncryptedVMDisksEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'HealthcareAPIsCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.HealthcareAPIsCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MySQLCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83cef61d-dbd1-4b20-a4fc-5fbc7da10833' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.MySQLCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PostgreSQLCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/18adea5e-f416-4d0f-8aa8-d24321e3e274' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.PostgreSQLCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SqlServerTDECMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a370ff3-6cab-4e85-8995-295fd854c5b8' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.SqlServerTDECMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6fac406b-40ca-413b-bf8e-0bf964659c25' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.StorageCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StreamAnalyticsCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/87ba29ef-1ab3-4d82-b763-87fcd4f531f7' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.StreamAnalyticsCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SynapseWorkspaceCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f7d52b2d-e161-4dfa-a82b-55e564167385' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.SynapseWorkspaceCMKEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WorkspaceCMK' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ba769a63-b8cc-4b2d-abf6-ac33c7204be8' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.WorkspaceCMK.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-EncryptTransit' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'AKSIngressHttpsOnlyEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AKSIngressHttpsOnlyEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'APIAppServiceHttpsEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceApiApp-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.APIAppServiceHttpsEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AppServiceHttpEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-httpsonly' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AppServiceHttpEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'AppServiceminTlsVersion' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AppServiceminTlsVersion.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'ContainerAppsHttpsOnlyEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.ContainerAppsHttpsOnlyEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FunctionLatestTlsEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.FunctionLatestTlsEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'FunctionServiceHttpsEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceFunctionApp-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.FunctionServiceHttpsEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MySQLEnableSSLDeployEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.MySQLEnableSSLDeployEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'MySQLEnableSSLEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MySql-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.MySQLEnableSSLEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PostgreSQLEnableSSLDeployEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.PostgreSQLEnableSSLDeployEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'PostgreSQLEnableSSLEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-PostgreSql-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.PostgreSQLEnableSSLEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RedisDenyhttps' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Redis-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisDenyhttps.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RedisdisableNonSslPort' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-disableNonSslPort' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisdisableNonSslPort.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'RedisTLSDeployEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisTLSDeployEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLManagedInstanceTLSDeployEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLManagedInstanceTLSDeployEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLManagedInstanceTLSEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLManagedInstanceTLSEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLServerTLSDeployEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLServerTLSDeployEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'SQLServerTLSEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLServerTLSEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageDeployHttpsEnabledEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.StorageDeployHttpsEnabledEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'StorageHttpsEnabledEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-minTLS' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.StorageHttpsEnabledEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WebAppServiceHttpsEffect' - definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceWebApp-http' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.WebAppServiceHttpsEffect.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'WebAppServiceLatestTlsEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.WebAppServiceLatestTlsEffect.parameters - definitionGroups: [] - } - ] - } - { - name: 'Enforce-Guardrails-KeyVault' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json') - libSetChildDefinitions: [ - { - definitionReferenceId: 'KvCertLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12ef42cb-9903-4e39-9c26-422d29570417' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvCertLifetime.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvFirewallEnabled' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55615ac9-af46-4a59-874e-391cc3dfb490' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvFirewallEnabled.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvKeysExpire' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysExpire.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvKeysLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5ff38825-c5d8-47c5-b70e-069a21955146' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysLifetime.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvPurgeProtection' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvPurgeProtection.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvSecretsExpire' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsExpire.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvSecretsLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0eb591a-5e70-4534-a8bf-04b9c489584a' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsLifetime.parameters - definitionGroups: [] - } - { - definitionReferenceId: 'KvSoftDelete' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSoftDelete.parameters - definitionGroups: [] - } - ] + name: 'Modify-UDR' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Modify-UDR.json') } ] +// This variable contains a number of objects that load in the custom Azure Policy Set/Initiative Defintions that are provided as part of the ESLZ/ALZ reference implementation - this is automatically created in the file 'infra-as-code\bicep\modules\policy\lib\policy_set_definitions\_policySetDefinitionsBicepInput.txt' via a GitHub action, that runs on a daily schedule, and is then manually copied into this variable. +var varCustomPolicySetDefinitionsArray = [ + { + name: 'Audit-TrustedLaunch' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AuditDisksOsTrustedLaunch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b03bb370-5249-4ea4-9fce-2552e87e45fa' + definitionParameters: varPolicySetDefinitionEsAuditTrustedLaunchParameters.AuditDisksOsTrustedLaunch.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AuditTrustedLaunchEnabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c95b54ad-0614-4633-ab29-104b01235cbf' + definitionParameters: varPolicySetDefinitionEsAuditTrustedLaunchParameters.AuditTrustedLaunchEnabled.parameters + definitionGroups: [] + } + ] + } + { + name: 'Audit-UnusedResourcesCostOptimization' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AuditAzureHybridBenefitUnusedResourcesCostOptimization' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-AzureHybridBenefit' + definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditAzureHybridBenefitUnusedResourcesCostOptimization.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AuditDisksUnusedResourcesCostOptimization' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-Disks-UnusedResourcesCostOptimization' + definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditDisksUnusedResourcesCostOptimization.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AuditPublicIpAddressesUnusedResourcesCostOptimization' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-PublicIpAddresses-UnusedResourcesCostOptimization' + definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditPublicIpAddressesUnusedResourcesCostOptimization.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AuditServerFarmsUnusedResourcesCostOptimization' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Audit-ServerFarms-UnusedResourcesCostOptimization' + definitionParameters: varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters.AuditServerFarmsUnusedResourcesCostOptimization.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deny-PublicPaaSEndpoints' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ACRDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0fdf0491-d080-4575-b627-ad0e843cba0f' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ACRDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AFSDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/21a8cd35-125e-4d13-b82d-2e19b7208bb7' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AFSDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AKSDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AKSDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ApiManDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/df73bd95-24da-4a4f-96b9-4e8b94b402bd' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ApiManDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppConfigDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3d9f5e4c-9947-4579-9539-2a7695fbc187' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AppConfigDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AsDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b5ef780-c53c-4a64-87f3-bb9c8c8094ba' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AsDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AseDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2d048aca-6479-4923-88f5-e2ac295d9af3' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AseDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AsrVaultDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9ebbbba3-4d65-4da9-bb67-b22cfaaff090' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AsrVaultDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AutomationDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/955a914f-bf86-4f0e-acd5-e0766b0efcb6' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AutomationDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BatchDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/74c5a0ae-5e48-4738-b093-65e23a060488' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.BatchDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BotServiceDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e8168db-69e3-4beb-9822-57cb59202a9d' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.BotServiceDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ContainerAppsEnvironmentDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d074ddf8-01a5-4b5e-a2b8-964aed452c0a' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.ContainerAppsEnvironmentDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CosmosDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.CosmosDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1cf164be-6819-4a50-b8fa-4bcaa4f98fb6' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Adf-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/43bc7be6-5e69-4b0d-a2bb-e815557ca673' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ADX-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppSlots-Public' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/701a595d-38fb-4a66-ae6d-fb3735217622' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-AppSlots-Public'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Cognitive-Services-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0725b4dd-7e76-479c-a735-68e7ee23d5ca' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Cognitive-Services-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CognitiveSearch-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee980b6d-0eca-4501-8d54-f6290fd512c3' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-CognitiveSearch-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/783ea2a8-b8fd-46be-896a-9ae79643a0b1' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ContainerApps-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0602787f-9896-402a-a6e1-39ee63ee435e' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EH-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f8f774be-6aee-492a-9e29-486ef81f3a68' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EventGrid-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Topic-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1adadefe-5f21-44f7-b931-a59b54ccdb45' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EventGrid-Topic-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Grafana-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e8775d5a-73b7-4977-a39b-833ef0114628' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Grafana-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Hostpool-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c25dcf31-878f-4eba-98eb-0818fdc6a334' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Hostpool-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-PublicNetwork' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/19ea9d63-adee-4431-a95e-1913c6c1c75f' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-KV-Hms-PublicNetwork'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-LogicApp-Public-Network-Access' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApp-Public-Network' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-LogicApp-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ManagedDisk-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8405fdab-1faf-48aa-b702-999c9c172094' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ManagedDisk-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-MySql-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-MySql-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-PostgreSql-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-PostgreSql-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cbd11fd3-3002-4907-b6c8-579f0e700e13' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Sb-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Public-Endpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9dfea752-dd46-4766-aed1-c355fa93fb91' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Sql-Managed-Public-Endpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Public-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Storage-Public-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/38d8df46-cf4e-4073-8e03-48c24b29de0d' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Synapse-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Workspace-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/87ac3038-c07a-4b92-860d-29e270a4f3cd' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Workspace-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionAppSlotsDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/11c82d0c-db9f-4d7b-97c5-f3f9aa957da2' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.FunctionAppSlotsDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/969ac98b-88a8-449f-883c-2e9adb123127' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.FunctionDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KeyVaultDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/405c5871-3e91-4644-8a63-58e19d68ff5b' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.KeyVaultDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MariaDbDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fdccbe47-f3e3-4213-ad5d-ea459b2fa077' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MariaDbDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MlDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/438c38d2-3772-465a-a9cc-7a6666a275ce' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MlDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLFlexDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9299215-ae47-4f50-9c54-8a392f68a052' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.MySQLFlexDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLFlexDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e1de0e3-42cb-4ebc-a86d-61d0c619ca48' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.PostgreSQLFlexDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisCacheDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/470baccb-7e51-4549-8b1a-3e5be069f663' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.RedisCacheDenyPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlServerDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b8ca024-1d5c-4dec-8995-b1a932b41780' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.SqlServerDenyPaasPublicIP.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageDenyPaasPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-283140c09693' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.StorageDenyPaasPublicIP.parameters + definitionGroups: [] + } + ] + } + { + name: 'DenyAction-DeleteProtection' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_DenyAction-DeleteProtection.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'DenyActionDelete-ActivityLogSettings' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-ActivityLogs' + definitionParameters: varPolicySetDefinitionEsDenyActionDeleteProtectionParameters['DenyActionDelete-ActivityLogSettings'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DenyActionDelete-DiagnosticSettings' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/DenyAction-DiagnosticLogs' + definitionParameters: varPolicySetDefinitionEsDenyActionDeleteProtectionParameters['DenyActionDelete-DiagnosticSettings'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-AUM-CheckUpdates' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-AUM-CheckUpdates.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateLinux' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46' + definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateLinux.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azureUpdateManagerVmArcCheckUpdateWindows' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfea026e-043f-4ff4-9d1b-bf301ca7ff46' + definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmArcCheckUpdateWindows.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azureUpdateManagerVmCheckUpdateLinux' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15' + definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateLinux.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azureUpdateManagerVmCheckUpdateWindows' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15' + definitionParameters: varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters.azureUpdateManagerVmCheckUpdateWindows.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-Diagnostics-LogAnalytics' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ACIDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ACI' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ACIDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ACRDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ACR' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ACRDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AKSDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6c66c325-74c8-42fd-a286-a74b0e2939d8' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AKSDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AnalysisServiceDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AnalysisService' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AnalysisServiceDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'APIforFHIRDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ApiForFHIR' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.APIforFHIRDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'APIMgmtDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-APIMgmt' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.APIMgmtDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ApplicationGatewayDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ApplicationGateway' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ApplicationGatewayDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WebServerFarm' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AppServiceDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceWebappDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Website' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AppServiceWebappDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AutomationDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AA' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AutomationDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AVDScalingPlansDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-AVDScalingPlans' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.AVDScalingPlansDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BastionDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Bastion' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.BastionDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BatchDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c84e5349-db6d-4769-805e-e14037dab9b5' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.BatchDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CDNEndpointsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CDNEndpoints' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CDNEndpointsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CognitiveServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CognitiveServices' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CognitiveServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CosmosDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-CosmosDB' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.CosmosDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DatabricksDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Databricks' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DatabricksDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DataExplorerClusterDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DataExplorerCluster' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataExplorerClusterDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DataFactoryDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DataFactory' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataFactoryDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DataLakeAnalyticsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-DLAnalytics' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataLakeAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DataLakeStoreDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d56a5a7c-72d7-42bc-8ceb-3baf4c0eae03' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.DataLakeStoreDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EventGridSubDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridSub' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventGridSubDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EventGridTopicDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridTopic' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventGridTopicDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EventHubDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f6e93e8-6b31-41b1-83f6-36e449a42579' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventHubDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EventSystemTopicDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-EventGridSystemTopic' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.EventSystemTopicDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ExpressRouteDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-ExpressRoute' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ExpressRouteDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FirewallDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Firewall' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FirewallDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FrontDoorDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-FrontDoor' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FrontDoorDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionAppDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Function' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.FunctionAppDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'HDInsightDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-HDInsight' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.HDInsightDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'IotHubDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-iotHub' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.IotHubDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KeyVaultDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bef3f64c-5290-43b7-85b0-9b254eef4c47' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.KeyVaultDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'LoadBalancerDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LoadBalancer' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LoadBalancerDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'LogAnalyticsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LogAnalytics' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'LogicAppsISEDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-LogicAppsISE' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogicAppsISEDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'LogicAppsWFDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b889a06c-ec72-4b03-910a-cb169ee18721' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.LogicAppsWFDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MariaDBDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MariaDB' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MariaDBDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MediaServiceDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MediaService' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MediaServiceDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MlWorkspaceDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MlWorkspace' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MlWorkspaceDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-MySQL' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.MySQLDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'NetworkNICDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-NIC' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkNICDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'NetworkPublicIPNicDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/752154a7-1e0f-45c6-a880-ac75a7e4f648' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkPublicIPNicDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'NetworkSecurityGroupsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-NetworkSecurityGroups' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.NetworkSecurityGroupsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-PostgreSQL' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.PostgreSQLDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PowerBIEmbeddedDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-PowerBIEmbedded' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.PowerBIEmbeddedDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RecoveryVaultDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c717fb0c-d118-4c43-ab3d-ece30ac81fb3' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RecoveryVaultDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisCacheDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-RedisCache' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RedisCacheDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RelayDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-Relay' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.RelayDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SearchServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08ba64b8-738f-4918-9686-730d2ed79c7d' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SearchServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ServiceBusDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/04d53d87-841c-4f23-8a5b-21564380b55e' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.ServiceBusDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SignalRDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SignalR' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SignalRDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLDatabaseDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b79fa14e-238a-4c2d-b376-442ce508fc84' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLDatabaseDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLElasticPoolsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SQLElasticPools' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLElasticPoolsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLMDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-SQLMI' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.SQLMDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageAccountBlobServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4fe1a3b-0715-4c6c-a5ea-ffc33cf823cb' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountBlobServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageAccountDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/59759c62-9a22-4cdf-ae64-074495983fef' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageAccountFileServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/25a70cc8-2bd4-47f1-90b6-1478e4662c96' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountFileServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageAccountQueueServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7bd000e3-37c7-4928-9f31-86c4b77c5c45' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountQueueServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageAccountTableServicesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2fb86bf3-d221-43d1-96d1-2434af34eaa0' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StorageAccountTableServicesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StreamAnalyticsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/237e0f7e-b0e8-4ec4-ad46-8c12cb66d673' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.StreamAnalyticsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'TimeSeriesInsightsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-TimeSeriesInsights' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.TimeSeriesInsightsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'TrafficManagerDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-TrafficManager' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.TrafficManagerDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'VirtualMachinesDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VM' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VirtualMachinesDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'VirtualNetworkDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VirtualNetwork' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VirtualNetworkDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'VMSSDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VMSS' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VMSSDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'VNetGWDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VNetGW' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VNetGWDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'VWanS2SVPNGWDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-VWanS2SVPNGW' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.VWanS2SVPNGWDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WVDAppGroupDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDAppGroup' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDAppGroupDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WVDHostPoolsDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDHostPools' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDHostPoolsDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WVDWorkspaceDeployDiagnosticLogDeployLogAnalytics' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Diagnostics-WVDWorkspace' + definitionParameters: varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters.WVDWorkspaceDeployDiagnosticLogDeployLogAnalytics.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-MDFC-Config_20240319' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ascExport' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.ascExport.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azurePolicyForKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.azurePolicyForKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForAppServices' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForAppServices.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForArm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForArm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforContainers' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderforContainers.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCosmosDbs' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82bf5b87-728b-4a74-ba4d-6123845cf542' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForCosmosDbs.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCspm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/689f7782-ef2c-4270-a6d0-7664869076bd' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForCspm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForKeyVaults' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForKeyVaults.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/64def556-fbad-4622-930e-72d1d5589bf5' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderforKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForOssDb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForOssDb.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlPaas' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForSqlPaas.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlServerVirtualMachines' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForSqlServerVirtualMachines.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForStorageAccountsV2' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForStorageAccountsV2.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVM' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForVM.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVMVulnerabilityAssessment' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForVMVulnerabilityAssessment.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'migrateToMdeTvm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.migrateToMdeTvm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'securityEmailContact' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.securityEmailContact.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-MDFC-Config' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ascExport' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.ascExport.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azurePolicyForKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.azurePolicyForKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForApis' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e54d2be9-5f2e-4d65-98e4-4f0e670b23d6' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForApis.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForAppServices' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForAppServices.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForArm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForArm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforContainers' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderforContainers.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCosmosDbs' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82bf5b87-728b-4a74-ba4d-6123845cf542' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForCosmosDbs.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCspm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/689f7782-ef2c-4270-a6d0-7664869076bd' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForCspm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForDns' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2370a3c1-4a25-4283-a91a-c9c1a145fb2f' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForDns.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForKeyVaults' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForKeyVaults.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/64def556-fbad-4622-930e-72d1d5589bf5' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderforKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForOssDb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForOssDb.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlPaas' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForSqlPaas.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlServerVirtualMachines' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForSqlServerVirtualMachines.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForStorageAccountsV2' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForStorageAccountsV2.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVM' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForVM.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVMVulnerabilityAssessment' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.defenderForVMVulnerabilityAssessment.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'migrateToMdeTvm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.migrateToMdeTvm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'securityEmailContact' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfigParameters.securityEmailContact.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-MDFC-DefenderSQL-AMA' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'defenderForSqlAma' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-AMA' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlAma.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlArcAma' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3592ff98-9787-443a-af59-4505d0fe0786' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcAma.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlArcDcrAssociation' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-SQL-DCR-Association' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcDcrAssociation.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlArcMdsql' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/65503269-6a54-4553-8a28-0065a8e6d929' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsql.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlArcMdsqlDcr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-Arc-Sql-DefenderSQL-DCR' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlArcMdsqlDcr.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlMdsql' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsql.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlMdsqlDcr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL-DCR' + definitionParameters: varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters.defenderForSqlMdsqlDcr.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-Private-DNS-Zones' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'DINE-Private-DNS-Azure-ACR' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e9585a95-5b8c-4d03-b193-dc7eb5ac4c32' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ACR'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-App' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7a860e27-9ca2-4fc6-822d-c2d248c300df' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-App'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-AppServices' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b318f84a-b872-429b-ac6d-a01b96814452' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-AppServices'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Arc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55c4db33-97b0-437b-8469-c4f4498f5df9' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Arc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Automation-DSCHybrid' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6dd01e4f-1be1-4e80-9d0b-d109e04cb064' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Automation-DSCHybrid'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Automation-Webhook' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6dd01e4f-1be1-4e80-9d0b-d109e04cb064' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Automation-Webhook'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Batch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4ec38ebc-381f-45ee-81a4-acbc4be878f8' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Batch'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-BotService' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6a4e6f44-f2af-4082-9702-033c9e88b9f8' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-BotService'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-CognitiveSearch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fbc14a67-53e4-4932-abcc-2049c6706009' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-CognitiveSearch'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-CognitiveServices' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c4bc6f10-cb41-49eb-b000-d5ab82e2a091' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-CognitiveServices'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Cassandra' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Cassandra'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Gremlin' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Gremlin'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-MongoDB' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-MongoDB'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-SQL' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-SQL'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Cosmos-Table' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a63cc0bd-cda4-4178-b705-37dc439d3e0f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Cosmos-Table'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-Browser-AuthN' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-Browser-AuthN'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Databricks-UI-Api' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0eddd7f3-3d9b-4927-a07a-806e8ac9486c' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Databricks-UI-Api'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-DataFactory' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86cd96e1-1745-420d-94d4-d3f2fe415aa4' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DataFactory'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-DataFactory-Portal' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86cd96e1-1745-420d-94d4-d3f2fe415aa4' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DataFactory-Portal'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-DiskAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bc05b96c-0b36-4ca9-82f0-5c53f96ce05a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-DiskAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-EventGridDomains' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d389df0a-e0d7-4607-833c-75a6fdac2c2d' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventGridDomains'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-EventGridTopics' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/baf19753-7502-405f-8745-370519b20483' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventGridTopics'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-EventHubNamespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ed66d4f5-8220-45dc-ab4a-20d1749c74e6' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-EventHubNamespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-File-Sync' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/06695360-db88-47f6-b976-7500d4297475' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-File-Sync'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-HDInsight' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/43d6e3bd-fc6a-4b44-8b4d-2151d8736a11' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-HDInsight'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoT' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/aaa64d2d-2fa3-45e5-b332-0b031b9b30e8' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoT'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoTCentral' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d627d7c6-ded5-481a-8f2e-7e16b1e6faf6' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTCentral'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoTDeviceupdate' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a222b93a-e6c2-4c01-817f-21e092455b2a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTDeviceupdate'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoTHubs' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c99ce9c1-ced7-4c3e-aca0-10e69ce0cb02' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTHubs'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-KeyVault' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac673a9a-f77d-4846-b2d8-a57f8e1c01d4' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-KeyVault'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-MachineLearningWorkspace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee40564d-486e-4f68-a5ca-7a621edae0fb' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MachineLearningWorkspace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-ManagedGrafanaWorkspace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4c8537f8-cd1b-49ec-b704-18e82a42fd58' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ManagedGrafanaWorkspace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Key' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Key'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Live' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Live'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Stream' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MediaServices-Stream'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Migrate' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7590a335-57cf-4c95-babd-ecbc8fafeb1f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Migrate'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Monitor' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/437914ee-c176-4fff-8986-7e05eb971365' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Monitor'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-RedisCache' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e016b22b-e0eb-436d-8fd7-160c4eaed6e2' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-RedisCache'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-ServiceBusNamespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0fcf93c-c063-4071-9668-c47474bd3564' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ServiceBusNamespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-SignalR' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0e86710-7fb7-4a6c-a064-32e9b829509e' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-SignalR'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Site-Recovery' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/942bd215-1a66-44be-af65-6a1c0318dbe2' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Site-Recovery'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Site-Recovery-Backup' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/af783da1-4ad1-42be-800d-d19c70038820' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Site-Recovery-Backup'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Blob' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75973700-529f-4de2-b794-fb9b6781b6b0' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Blob'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Blob-Sec' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d847d34b-9337-4e2d-99a5-767e5ac9c582' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Blob-Sec'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-DFS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83c6fe0f-2316-444a-99a1-1ecd8a7872ca' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-DFS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-DFS-Sec' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/90bd4cb3-9f59-45f7-a6ca-f69db2726671' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-DFS-Sec'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-File' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6df98d03-368a-4438-8730-a93c4d7693d6' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-File'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Queue' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bcff79fb-2b0d-47c9-97e5-3023479b00d1' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Queue'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Queue-Sec' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/da9b4ae8-5ddc-48c5-b9c0-25f8abf7a3d6' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Queue-Sec'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-StaticWeb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9adab2a5-05ba-4fbd-831a-5bf958d04218' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-StaticWeb'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-StaticWeb-Sec' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d19ae5f1-b303-4b82-9ca8-7682749faf0c' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-StaticWeb-Sec'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Table' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/028bbd88-e9b5-461f-9424-a1b63a7bee1a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Table'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Table-Secondary' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c1d634a5-f73d-4cdd-889f-2cc7006eb47f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Table-Secondary'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-Dev' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-Dev'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-SQL' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-SQL'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-SQL-OnDemand' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-SQL-OnDemand'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-VirtualDesktopHostpool' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9427df23-0f42-4e1e-bf99-a6133d841c4a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-VirtualDesktopHostpool'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-VirtualDesktopWorkspace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/34804460-d88b-4922-a7ca-537165e060ed' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-VirtualDesktopWorkspace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Web' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b026355-49cb-467b-8ac4-f777874e175a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Web'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-Sql-Security_20240529' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'SqlDbAuditingSettingsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-AuditingSettings' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbAuditingSettingsDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbSecurityAlertPoliciesDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-SecurityAlertPolicies' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbSecurityAlertPoliciesDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbTdeDeploySqlSecurity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbTdeDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbVulnerabilityAssessmentsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-vulnerabilityAssessments_20230706' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbVulnerabilityAssessmentsDeploySqlSecurity.parameters + definitionGroups: [] + } + ] + } + { + name: 'Deploy-Sql-Security' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'SqlDbAuditingSettingsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-AuditingSettings' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbAuditingSettingsDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbSecurityAlertPoliciesDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-SecurityAlertPolicies' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbSecurityAlertPoliciesDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbTdeDeploySqlSecurity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbTdeDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbVulnerabilityAssessmentsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-vulnerabilityAssessments' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurityParameters.SqlDbVulnerabilityAssessmentsDeploySqlSecurity.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-ACSB' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ACSB.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'GcIdentity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3cf2ab00-13f1-4d0c-8971-2ac904541a7e' + definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcIdentity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'GcLinux' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/331e8ea8-378a-410f-a2e5-ae22f38bb0da' + definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcLinux.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'GcWindows' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/385f5831-96d4-41db-9a3c-cd3af78aaae6' + definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.GcWindows.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'LinAcsb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fc9b3da7-8347-4380-8e70-0a0361d8dedd' + definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.LinAcsb.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WinAcsb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/72650e9f-97bc-4b2a-ab5f-9781a9fcecbc' + definitionParameters: varPolicySetDefinitionEsEnforceACSBParameters.WinAcsb.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-ALZ-Decomm' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Decomm.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'DecomDenyResources' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a08ec900-254a-4555-9bf5-e42af04b5c5c' + definitionParameters: varPolicySetDefinitionEsEnforceALZDecommParameters.DecomDenyResources.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DecomShutdownMachines' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Vm-autoShutdown' + definitionParameters: varPolicySetDefinitionEsEnforceALZDecommParameters.DecomShutdownMachines.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-ALZ-Sandbox' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Sandbox.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'SandboxDenyVnetPeering' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-VNET-Peer-Cross-Sub' + definitionParameters: varPolicySetDefinitionEsEnforceALZSandboxParameters.SandboxDenyVnetPeering.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SandboxNotAllowed' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749' + definitionParameters: varPolicySetDefinitionEsEnforceALZSandboxParameters.SandboxNotAllowed.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Backup' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'BackupBVault-Immutability' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2514263b-bc0d-4b06-ac3e-f262c0979018' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-Immutability'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupBVault-MUA' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c58e083e-7982-4e24-afdc-be14d312389e' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-MUA'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupBVault-SoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9798d31d-6028-4dee-8643-46102185c016' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-SoftDelete'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-Immutability' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d6f6f560-14b7-49a4-9fc8-d2c3a9807868' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-Immutability'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-MUA' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c7031eab-0fc0-4cd9-acd0-4497bd66d91a' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-MUA'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-SoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/31b8092a-36b8-434b-9af7-5ec844364148' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-SoftDelete'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Encryption-CMK' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ACRCmkDeny' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.ACRCmkDeny.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AksCmkDeny' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7d7be79c-23ba-4033-84dd-45e2a5ccdd67' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.AksCmkDeny.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AzureBatchCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/99e9ccd8-3db9-4592-b0d1-14b1715a4d8a' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.AzureBatchCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CognitiveServicesCMK' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/67121cc7-ff39-4ab8-b7e3-95b84dab487d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.CognitiveServicesCMK.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'CosmosCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f905d99-2ab7-462c-a6b0-f709acca6c8f' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.CosmosCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DataBoxCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86efb160-8de7-451d-bc08-5d475b0aadae' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.DataBoxCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aa-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/56a5ee18-2ae6-4810-86f7-18e39ce5629b' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Aa-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4ec52d6d-beb7-40c4-9a9e-fe753254690e' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Adf-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/81e74cea-30fd-40d5-802f-d72103c2aaaa' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-ADX-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Backup-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2e94d99a-8a36-4563-bc77-810d8893b671' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Backup-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CognitiveSearch-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/76a56461-9dc0-40f0-82f5-2453283afa2f' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-CognitiveSearch-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerInstance-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0aa61e00-0a01-4a3c-9945-e93cffedf0e6' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-ContainerInstance-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a1ad735a-e96f-45d2-a7b2-9a4932cab7ec' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-EH-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Premium-CMK' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-Premium-CMK' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-EH-Premium-CMK'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OsAndDataDisk-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/702dd420-7fcc-42c5-afe8-4026edd20fe0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-OsAndDataDisk-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/295fc8b1-dc9f-4f53-9c61-3f313ceab40a' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Sb-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac01ad65-10e5-46df-bdd9-6b0cad13e1d2' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Sql-Managed-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Encryption-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b5ec538c-daa0-4006-8596-35468b9148e8' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Encryption-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Queue-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e5abd0-2554-4736-b7c0-4ffef23475ef' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Queue-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Table-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7c322315-e26d-4174-a99e-f49d351b4688' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Table-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EncryptedVMDisksEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.EncryptedVMDisksEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'HealthcareAPIsCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.HealthcareAPIsCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83cef61d-dbd1-4b20-a4fc-5fbc7da10833' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.MySQLCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/18adea5e-f416-4d0f-8aa8-d24321e3e274' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.PostgreSQLCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlServerTDECMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a370ff3-6cab-4e85-8995-295fd854c5b8' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.SqlServerTDECMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6fac406b-40ca-413b-bf8e-0bf964659c25' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.StorageCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StreamAnalyticsCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/87ba29ef-1ab3-4d82-b763-87fcd4f531f7' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.StreamAnalyticsCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SynapseWorkspaceCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f7d52b2d-e161-4dfa-a82b-55e564167385' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.SynapseWorkspaceCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WorkspaceCMK' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ba769a63-b8cc-4b2d-abf6-ac33c7204be8' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.WorkspaceCMK.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-EncryptTransit_20240509' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AKSIngressHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AKSIngressHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'APIAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceApiApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.APIAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceHttpEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-httpsonly' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AppServiceHttpEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceminTlsVersion' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AppServiceminTlsVersion.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ContainerAppsHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.ContainerAppsHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Apps-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a4af4a39-4135-47fb-b175-47fbdf85311d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Apps-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Slots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae1b9a8c-dfce-4605-bd91-69213b4a26fc' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Slots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d6545c6b-dd9d-4265-91e6-0b451e2f1c50' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-ContainerApps-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-minTLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-EH-minTLS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FuncAppSlots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e5dbe3f-2702-4ffc-8b1e-0cae008a5c71' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-FuncAppSlots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FunctionApp-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-FunctionApp-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-LogicApp-Without-Https' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApps-Without-Https' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-LogicApp-Without-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Db-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Sql-Db-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8793640-60f7-487c-b5c3-1d37215905c4' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Sql-Managed-Tls-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fe83a0eb-a853-422d-aac2-1bffd182c5d0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Storage-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cb3738a6-82a2-4a18-b87b-15217b9deff4' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Synapse-Tls-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deploy-LogicApp-TLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-LogicApp-TLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deploy-LogicApp-TLS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-AppService-Apps-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae44c1d1-0df2-4ca9-98fa-a3d3ae5b409d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-AppService-Apps-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-AppSlotTls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/014664e7-e348-41a3-aeb9-566e4ff6a9df' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['DINE-AppService-AppSlotTls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Function-Apps-Slots-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fa3a6357-c6d6-4120-8429-855577ec0063' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-Function-Apps-Slots-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-FunctionApp-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f01f1c7-539c-49b5-9ef4-d4ffa37d22e0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-FunctionApp-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.FunctionLatestTlsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceFunctionApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.FunctionServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.MySQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MySql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.MySQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.PostgreSQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-PostgreSql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.PostgreSQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisDenyhttps' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Redis-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisDenyhttps.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisdisableNonSslPort' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-disableNonSslPort' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisdisableNonSslPort.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLManagedInstanceTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLManagedInstanceTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLServerTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLServerTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageDeployHttpsEnabledEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.StorageDeployHttpsEnabledEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceWebApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.WebAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.WebAppServiceLatestTlsEffect.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-EncryptTransit' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AKSIngressHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AKSIngressHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'APIAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceApiApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.APIAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceHttpEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-httpsonly' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AppServiceHttpEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceminTlsVersion' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.AppServiceminTlsVersion.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ContainerAppsHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.ContainerAppsHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.FunctionLatestTlsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceFunctionApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.FunctionServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.MySQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MySql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.MySQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.PostgreSQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-PostgreSql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.PostgreSQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisDenyhttps' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Redis-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisDenyhttps.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisdisableNonSslPort' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-disableNonSslPort' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisdisableNonSslPort.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.RedisTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLManagedInstanceTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLManagedInstanceTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLServerTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.SQLServerTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageDeployHttpsEnabledEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.StorageDeployHttpsEnabledEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageHttpsEnabledEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.StorageHttpsEnabledEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceWebApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.WebAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransitParameters.WebAppServiceLatestTlsEffect.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-APIM' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Api-subscription-scope' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3aa03346-d8c5-4994-a5bc-7652c2a2aef1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Api-subscription-scope'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Authn' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c15dcc82-b93c-4dcb-9332-fbf121685b54' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Authn'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Cert-Validation' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/92bb331d-ac71-416a-8c91-02f2cb734ce4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Cert-Validation'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Direct-Endpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b741306c-968e-4b67-b916-5675e5c709f4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Direct-Endpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Protocols' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee7495e7-3ba7-40b6-bfee-c29e22cc75d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Protocols'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Sku-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/73ef9241-5d81-4cd4-b483-8443d1730fe5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Sku-Vnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-APIM-TLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-APIM-TLS' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-APIM-TLS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/549814b6-3212-4203-bdc8-1548d342fb67' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-without-Kv' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f1cc7827-022c-473e-836e-5a51cae0b249' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-without-Kv'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-without-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-without-Vnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Apim-Public-NetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7ca8c8ac-3a6e-493d-99ba-c5fa35347ff2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Dine-Apim-Public-NetworkAccess'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-AppServices' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-AppServ-FtpAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/572e342c-c920-4ef5-be2e-1ed3c6a51dc5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-FtpAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServ-Routing' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5747353b-1ca9-42c1-a4dd-b874b894f3d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-Routing'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServ-SkuPl' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/546fe8d2-368d-4029-a418-6af48a7f61e5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-SkuPl'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Byoc' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppService-without-BYOC' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Byoc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Latest-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/eb4d34ab-0929-491c-bbf3-61e13da19f9a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Latest-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Rfc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f5c0bfb3-acea-47b1-b477-b0edcdf6edc1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Rfc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Slots-Remote-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cca5adfe-626b-4cc6-8522-f5b6ed2391bd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Slots-Remote-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Vnet-Routing' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/801543d1-1953-4a90-b8b0-8cf6d41473a5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Vnet-Routing'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServiceApps-Rfc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a691eacb-474d-47e4-b287-b4813ca44222' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServiceApps-Rfc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-AppService-Apps-Remote-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Dine-AppService-Apps-Remote-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/25a5046c-c423-4805-9235-e844ae9ef49b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2c034a29-2a5f-4857-b120-f800fe5549ae' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-ScmAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e97b776-f380-4722-a9a3-e7f0be029e79' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-ScmAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-FuncApp-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/70adbb40-e092-42d5-a6f8-71c540a5efdb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-FuncApp-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-App-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c6c3e00e-d414-4ca4-914f-406699bb8eee' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-App-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-Apps-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2374605e-3e0b-492b-9046-229af202562c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-Apps-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0f98368e-36bc-4716-8ac2-8f8067203b63' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Function-Apps-Slots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08cf2974-d178-48a0-b26d-f6b8e555748b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-Function-Apps-Slots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Function-Apps-Slots-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/242222f3-4985-4e99-b5ef-086d6a6cb01c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-Function-Apps-Slots-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Automation' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aa-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dea83a72-443c-4292-83d5-54a2f98749c0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aa-Variables-Encrypt' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Variables-Encrypt'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Windows-Vm-HotPatch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6d02d2f7-e38b-4bdc-96f3-adc0a8726abc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Windows-Vm-HotPatch'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Modify-Aa-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Aa-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/23b36a7c-9d26-4288-a8fd-c1d2fa284d8c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Modify-Aa-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-CognitiveServices' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-CognitiveSearch-SKU' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a049bf77-880b-470f-ba6d-9f21c530cf83' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Deny-CognitiveSearch-SKU'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CongitiveSearch-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6300012e-e9a4-4649-b41f-a85f5c43be91' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Deny-CongitiveSearch-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Cognitive-Services-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/47ba1dd7-28d9-4b07-a8d5-9813bed64e0c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-Cognitive-Services-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CogntiveSearch-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4eb216f2-9dba-4979-86e6-5d7e63ce3b75' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-CogntiveSearch-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CogntiveSearch-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9cee519f-d9c1-4fd9-9f79-24ec3449ed30' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-CogntiveSearch-PublicEndpoint'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Compute' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Disk-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ca91455f-eace-4f96-be59-e6e2c35b4816' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsComputeParameters['Deny-Disk-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-VmAndVmss-Encryption-Host' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsComputeParameters['Deny-VmAndVmss-Encryption-Host'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerApps' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerApp-Vnet-Injection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8b346db6-85af-419b-8557-92cee2c0f9bb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters['Deny-ContainerApp-Vnet-Injection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters['Deny-ContainerApps-Managed-Identity'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerInstance' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerInstance-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8af8f826-edcb-4178-b35f-851ea6fea615' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerInstanceParameters['Deny-ContainerInstance-Vnet'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerRegistry' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerRegistry-Anonymous-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9f2dea28-e834-476c-99c5-3507b4728395' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Anonymous-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Arm-Audience' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/42781ec6-6127-4c30-bdfa-fb423a0047d3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Arm-Audience'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Exports' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/524b0254-c285-4903-bee6-bb8126cde579' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Exports'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dc921057-6b28-4fbe-9b83-f7bec05db6c2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Repo-Token' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ff05e24e-195c-447e-b322-5e90c9f9f366' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Repo-Token'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Sku-PrivateLink' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bd560fc0-3c69-498a-ae9f-aa8eb7de0e13' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Sku-PrivateLink'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Unrestricted-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Unrestricted-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Anonymous-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cced2946-b08a-44fe-9fd9-e4ed8a779897' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Anonymous-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Arm-Audience' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/785596ed-054f-41bc-aaec-7f3d0ba05725' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Arm-Audience'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/79fdfe03-ffcb-4e55-b4d0-b925b8241759' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a3701552-92ea-433e-9d17-33b7f1208fc9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Repo-Token' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a9b426fe-8856-4945-8600-18c5dd1cca2a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Repo-Token'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-CosmosDb' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Append-CosmosDb-Metadata' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4750c32b-89c0-46af-bfcb-2e4541a818d5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Append-CosmosDb-Metadata'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CosmosDb-Fw-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Deny-CosmosDb-Fw-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CosmosDb-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5450f5bd-9c72-4390-a9c4-a7aba4edfdd2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Deny-CosmosDb-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-CosmosDb-Atp' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b5f04e03-92a3-4b09-9410-2cc5e5047656' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Dine-CosmosDb-Atp'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CosmosDb-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dc2d41d1-4ab1-4666-a3e1-3d51c43e0049' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Modify-CosmosDb-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CosmosDb-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/da69ba51-aaf1-41e5-8651-607cd0b37088' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Modify-CosmosDb-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-DataExplorer' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ADX-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ec068d99-e9c7-401f-8cef-5bdde4e6ccf1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f4b53539-8df9-40e4-86c6-6b607703bd4e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Sku-without-PL-Support' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1fec9658-933f-4b3e-bc95-913ed22d012b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Sku-without-PL-Support'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ADX-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7b32f193-cb28-4e15-9a98-b9556db0bafa' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Modify-ADX-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-DataFactory' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Adf-Git' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/77d40665-3120-4348-b539-3192ec808307' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Git'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Linked-Service-Key-Vault' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/127ef6d7-242f-43b3-9eef-947faf1725d0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Linked-Service-Key-Vault'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f78ccdb4-7bf4-4106-8647-270491d2978a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Sql-Integration' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0088bc63-6dee-4a9c-9d29-91cfdc848952' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Sql-Integration'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Adf-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08b1442b-7789-4130-8506-4f99a97226a7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Modify-Adf-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-EventGrid' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-EventGrid-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8bfadddb-ee1c-4639-8911-a38cb8e0b3bd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Partner-Namespace-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8632b003-3545-4b29-85e6-b2b96773df1e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Partner-Namespace-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Topic-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae9fb87f-8a17-4428-94a4-8135d431055c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Topic-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Domain-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8ac2748f-3bf1-4c02-a3b6-92ae68cf75b1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Domain-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Domain-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/898e9824-104c-4965-8e0e-5197588fa5d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Domain-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Partner-Namespace-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2dd0e8b9-4289-4bb0-b813-1883298e9924' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Partner-Namespace-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Topic-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1c8144d9-746a-4501-b08c-093c8d29ad04' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Topic-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Topic-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/36ea4b4b-0f7f-4a54-89fa-ab18f555a172' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Topic-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-EventHub' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-EH-Auth-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b278e460-7cfc-4451-8294-cccc40a940d7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Auth-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/836cd60e-87f3-4e6a-a27c-29d687f01a4c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5d4e3c65-4873-47be-94f3-6f8b953a3598' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EH-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/57f35901-8389-40bb-ac49-3ba4f86d889d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Modify-EH-Local-Auth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-KeyVault-Sup' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Modify-KV-Fw' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac673a9a-f77d-4846-b2d8-a57f8e1c01dc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters['Modify-KV-Fw'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-KV-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/84d327c3-164a-4685-b453-900478614456' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters['Modify-KV-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-KeyVault' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86810a98-8e91-4a44-8386-ec66d0de5d57' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Cert-Expiration-Within-Specific-Number-Days' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f772fb64-8e40-40ad-87bc-7706e1949427' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Cert-Expiration-Within-Specific-Number-Days'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Cert-Period' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a075868-4c26-42ef-914c-5bc007359560' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Cert-Period'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Cryptographic-Type' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75c4f823-d65c-4f29-a733-01d0077fdbcb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Cryptographic-Type'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Curve-Names' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ff25f3c8-b739-4538-9d07-3d6d25cfb255' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Curve-Names'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Elliptic-Curve' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bd78111f-4953-4367-9fd5-7e08808b54bf' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Elliptic-Curve'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-Key-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1d478a74-21ba-4b9f-9d8f-8e6fced0eec5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Hms-Key-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-PurgeProtection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c39ba22d-4428-4149-b981-70acb31fc383' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Hms-PurgeProtection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Hsm-Curve-Names' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e58fd0c1-feac-4d12-92db-0a7e9421f53e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Hsm-Curve-Names'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Hsm-MinimumDays-Before-Expiration' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ad27588c-0198-4c84-81ef-08efd0274653' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Hsm-MinimumDays-Before-Expiration'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Integrated-Ca' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e826246-c976-48f6-b03e-619bb92b3d82' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Integrated-Ca'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Key-Active' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c26e4b24-cf98-4c67-b48b-5a25c4c69eb9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Key-Active'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Key-Types' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1151cede-290b-4ba0-8b38-0ad145ac888f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Key-Types'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Keys-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/49a22571-d204-4c91-a7b6-09b1a586fbc9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Keys-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Non-Integrated-Ca' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a22f4a40-01d3-4c7d-8071-da157eeff341' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Non-Integrated-Ca'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-RSA-Keys-without-MinCertSize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cee51871-e572-4576-855c-047c820360f0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-RSA-Keys-without-MinCertSize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-RSA-Keys-without-MinKeySize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82067dbb-e53b-4e06-b631-546d197452d9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-RSA-Keys-without-MinKeySize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Secret-ActiveDays' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e8d99835-8a06-45ae-a8e0-87a91941ccfe' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Secret-ActiveDays'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Secret-Content-Type' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75262d3e-ba4a-4f43-85f8-9f72c090e5e3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Secret-Content-Type'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Secrets-ValidityDays' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/342e8053-e12e-4c44-be01-c3c2f318400f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Secrets-ValidityDays'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-without-ArmRbac' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-without-ArmRbac'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvCertLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12ef42cb-9903-4e39-9c26-422d29570417' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvCertLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvFirewallEnabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55615ac9-af46-4a59-874e-391cc3dfb490' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvFirewallEnabled.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvKeysExpire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysExpire.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvKeysLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5ff38825-c5d8-47c5-b70e-069a21955146' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvPurgeProtection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvPurgeProtection.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSecretsExpire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsExpire.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSecretsLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0eb591a-5e70-4534-a8bf-04b9c489584a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSoftDelete.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Kubernetes' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Aks-Allowed-Capabilities' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Allowed-Capabilities'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Cni' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/46238e2f-3f6f-4589-9f3f-77bed4116e67' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Cni'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Default-Namespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Default-Namespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Internal-Lb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3fc4dc25-5baf-40d8-9b05-7fe74c1bc64e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Internal-Lb'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Kms' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dbbdc317-9734-4dd8-9074-993b29c69008' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Kms'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/993c2fcd-2b29-49d2-9eb0-df2c3a730c32' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Naked-Pods' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/65280eef-c8b4-425e-9aec-af55e55bf581' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Naked-Pods'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Priv-Containers' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Priv-Containers'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Priv-Escalation' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Priv-Escalation'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Private-Cluster' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Private-Cluster'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-ReadinessOrLiveness-Probes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b1a9997f-2883-4f12-bdff-2280f99b5915' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-ReadinessOrLiveness-Probes'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Shared-Host-Process-Namespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Shared-Host-Process-Namespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Temp-Disk-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/41425d9f-d1a5-499a-9932-f8ed8453932c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Temp-Disk-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Windows-Container-Administrator' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5485eac0-7e8f-4964-998b-a44f4f0c1e75' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Windows-Container-Administrator'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Aks-Command-Invoke' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b708b0a-3380-40e9-8b79-821f9fa224cc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Dine-Aks-Command-Invoke'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Aks-Policy' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Dine-Aks-Policy'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-MachineLearning' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ML-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ML-Outdated-Os' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f110a506-2dcb-422e-bcea-d533fc8c35e2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-Outdated-Os'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ML-User-Assigned-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5f0c7d88-c7de-45b8-ac49-db49e72eaa78' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-User-Assigned-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ML-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a6f9a2d0-cff7-4855-83ad-4cd750666512' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Modify-ML-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ML-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a10ee784-7409-4941-b091-663697637c0f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Modify-ML-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-MySQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-MySql-Infra-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3a58212a-c829-4f13-9872-6371df2fd0b4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters['Deny-MySql-Infra-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-MySql-Adv-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/80ed5239-4122-41ed-b54a-6f1fa7552816' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters['Dine-MySql-Adv-Threat-Protection'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Network' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-AppGw-Without-Tls' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppGw-Without-Tls' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-AppGw-Without-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppGw-Without-Waf' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-AppGw-Without-Waf'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-AllIDPSS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/610b6183-5f00-4d68-86d2-4ab4cb3a67a5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-AllIDPSS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-EmpIDPSBypass' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f516dc7a-4543-4d40-aad6-98f76a706b50' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-EmpIDPSBypass'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-TLS-AllApp' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a58ac66d-92cb-409c-94b8-8e48d7a96596' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-TLS-AllApp'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-TLS-Inspection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/711c24bb-7f18-4578-b192-81a6161e1f17' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-TLS-Inspection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Ip-Forwarding' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Ip-Forwarding'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Mgmt-From-Internet' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MgmtPorts-From-Internet' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Mgmt-From-Internet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Nsg-GW-subnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Nsg-GW-subnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-with-Service-Endpoints' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Service-Endpoints' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-with-Service-Endpoints'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-Without-NSG' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Nsg' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-NSG'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-Without-Udr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-Udr'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-vNic-Pip' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-vNic-Pip'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-VPN-AzureAD' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-VPN-AzureAD'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-Afd-Enabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-Afd-Enabled'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-AppGw-mode' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12430be1-6cc8-4527-a9a8-e3d38f250096' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-AppGw-mode'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-Fw-rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/632d3993-e2c0-44ea-a7db-2eca131f356d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-Fw-rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-IDPS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6484db87-a62d-4327-9f07-80a2cbdf333a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-IDPS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-mode' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/425bea59-a659-4cbb-8d31-34499bd030b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-mode'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Nsg' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-NSG' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-Nsg'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Udr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-UDR' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-Udr'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-vNet-DDoS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/94de2ad3-e0c1-4caf-ad78-5d47bbc83d3d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-vNet-DDoS'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-OpenAI' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Cognitive-Services-Cust-Storage' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/46aa9b05-0e60-4eae-a88b-1e9d374fa515' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Cust-Storage'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fe3fd216-4f83-4fc1-8984-2bbec80a3418' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OpenAi-NetworkAcls' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-NetworkAcls' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-OpenAi-NetworkAcls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OpenAi-OutboundNetworkAccess' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-RestrictOutboundNetworkAccess' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-OpenAi-OutboundNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Cognitive-Services-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Modify-Cognitive-Services-Local-Auth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-PostgreSQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Dine-PostgreSql-Adv-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/db048e65-913c-49f9-bb5f-1084184671d3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsPostgreSQLParameters['Dine-PostgreSql-Adv-Threat-Protection'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ServiceBus' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Sb-Authz-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a1817ec0-a368-432a-8057-8371e17ac6ee' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-Authz-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ebaf4f25-a4e8-415f-86a8-42d9155bef0b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfb11c26-f069-4c14-8e36-56c394dae5af' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Sb-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/910711a6-8aa2-4f15-ae62-1e5b2ed3ef9e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Modify-Sb-LocalAuth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-SQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Sql-Aad-Only' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/abda6d70-9778-44e7-84a8-06713e6db027' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Deny-Sql-Aad-Only'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Aad-Only' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/78215662-041e-49ed-a9dd-5385911b3a1f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Deny-Sql-Managed-Aad-Only'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Sql-Adv-Data' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6134c3db-786f-471e-87bc-8f479dc890f6' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Dine-Sql-Adv-Data'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Sql-Managed-Defender' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c5a62eb0-c65a-4220-8a4d-f70dd4ca95dd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Dine-Sql-Managed-Defender'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Sql-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Modify-Sql-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Storage' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Storage-Account-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Account-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Account-Keys-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/044985bb-afe1-42cd-8a36-9d5d42424537' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Account-Keys-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Classic' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/37e0d2fe-28a5-43d6-a273-67d37d1f5606' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Classic'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ContainerDeleteRetentionPolicy' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ContainerDeleteRetentionPolicy' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ContainerDeleteRetentionPolicy'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-CopyScope' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CopyScope' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-CopyScope'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-CorsRules' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CorsRules' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-CorsRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Cross-Tenant' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/92a89a79-6c52-4a7e-a03f-61306fc49312' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Cross-Tenant'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Infra-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4733ea7b-a883-42fe-8cac-97454c2a9e4a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Infra-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-LocalUser' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-LocalUser' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-LocalUser'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkAclsBypass' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsBypass' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkAclsBypass'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkAclsVirtualNetworkRules' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsVirtualNetworkRules' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkAclsVirtualNetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkRules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2a1a9cdf-e04d-429a-8416-3bfb72a1b26f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ResourceAccessRulesResourceId' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesResourceId' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ResourceAccessRulesResourceId'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ResourceAccessRulesTenantId' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesTenantId' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ResourceAccessRulesTenantId'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Restrict-NetworkRules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Restrict-NetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ServicesEncryption' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ServicesEncryption' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ServicesEncryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-SFTP' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-SFTP'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Shared-Key' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Shared-Key'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Storage-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/361c2074-3595-4e5d-8cab-4f21dffc835c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Dine-Storage-Threat-Protection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Blob-Storage-Account-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Blob-Storage-Account-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Storage-Account-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a06d0189-92e8-4dba-b0c4-08d7669fce7d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Storage-Account-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Storage-FileSync-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e07b2e9-6cd9-4c40-9ccb-52817b95133b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Storage-FileSync-PublicEndpoint'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Synapse' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Synapse-Data-Traffic' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3484ce98-c0c5-4c83-994b-c5ac24785218' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Data-Traffic'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Fw-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/56fd377d-098c-4f02-8406-81eb055902b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Fw-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2158ddbe-fefa-408e-b43f-d4faef8ff3b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Managed-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2d9dbfa3-927b-4cf0-9d0f-08747f971650' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Managed-Vnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Tenant-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3a003702-13d2-4679-941b-937e58c443f0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Tenant-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Synapse-Defender' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/951c1558-50a5-4ca3-abb6-a93e3e2367a6' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Dine-Synapse-Defender'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c3624673-d2ff-48e0-b28c-5de1c6767c3c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5c8cad01-ef30-4891-b230-652dadb4876a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8b5c654c-fb07-471b-aa8f-15fea733f140' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Tls-Version'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-VirtualDesktop' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Modify-Hostpool-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2a0913ff-51e7-47b8-97bb-ea17127f7c8d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters['Modify-Hostpool-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Workspace-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ce6ebf1d-0b94-4df9-9257-d8cacc238b4f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters['Modify-Workspace-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } +] + + // Policy Set/Initiative Definition Parameter Variables +var varPolicySetDefinitionEsAuditTrustedLaunchParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.parameters.json') + var varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.parameters.json') var varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json') @@ -2053,12 +4242,16 @@ var varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters = loadJsonContent('l var varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.parameters.json') +var varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.parameters.json') + var varPolicySetDefinitionEsDeployMDFCConfigParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.parameters.json') var varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.parameters.json') var varPolicySetDefinitionEsDeployPrivateDNSZonesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json') +var varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.parameters.json') + var varPolicySetDefinitionEsDeploySqlSecurityParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.parameters.json') var varPolicySetDefinitionEsEnforceACSBParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ACSB.parameters.json') @@ -2067,12 +4260,66 @@ var varPolicySetDefinitionEsEnforceALZDecommParameters = loadJsonContent('lib/po var varPolicySetDefinitionEsEnforceALZSandboxParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Sandbox.parameters.json') +var varPolicySetDefinitionEsEnforceBackupParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.parameters.json') + var varPolicySetDefinitionEsEnforceEncryptionCMKParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json') +var varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.parameters.json') + var varPolicySetDefinitionEsEnforceEncryptTransitParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.parameters.json') +var varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsComputeParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerInstanceParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.parameters.json') + var varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json') +var varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsPostgreSQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsSQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsStorageParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.parameters.json') + // Customer Usage Attribution Id var varCuaid = '2b136786-9881-412e-84ba-f4c2822e1ac9' diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/_policyDefinitionsBicepInput.txt b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/_policyDefinitionsBicepInput.txt index 933c1737b..cc8d0a300 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/_policyDefinitionsBicepInput.txt +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/_policyDefinitionsBicepInput.txt @@ -46,10 +46,22 @@ name: 'Deny-AA-child-resources' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AA-child-resources.json') } +{ + name: 'Deny-APIM-TLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-APIM-TLS.json') +} +{ + name: 'Deny-AppGw-Without-Tls' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppGw-Without-Tls.json') +} { name: 'Deny-AppGW-Without-WAF' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppGW-Without-WAF.json') } +{ + name: 'Deny-AppService-without-BYOC' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppService-without-BYOC.json') +} { name: 'Deny-AppServiceApiApp-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppServiceApiApp-http.json') @@ -62,6 +74,22 @@ name: 'Deny-AppServiceWebApp-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AppServiceWebApp-http.json') } +{ + name: 'Deny-AzFw-Without-Policy' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-AzFw-Without-Policy.json') +} +{ + name: 'Deny-CognitiveServices-NetworkAcls' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-NetworkAcls.json') +} +{ + name: 'Deny-CognitiveServices-Resource-Kinds' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-Resource-Kinds.json') +} +{ + name: 'Deny-CognitiveServices-RestrictOutboundNetworkAccess' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-RestrictOutboundNetworkAccess.json') +} { name: 'Deny-Databricks-NoPublicIp' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Databricks-NoPublicIp.json') @@ -74,6 +102,14 @@ name: 'Deny-Databricks-VirtualNetwork' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Databricks-VirtualNetwork.json') } +{ + name: 'Deny-EH-minTLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-EH-minTLS.json') +} +{ + name: 'Deny-EH-Premium-CMK' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-EH-Premium-CMK.json') +} { name: 'Deny-FileServices-InsecureAuth' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-FileServices-InsecureAuth.json') @@ -90,6 +126,14 @@ name: 'Deny-FileServices-InsecureSmbVersions' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-FileServices-InsecureSmbVersions.json') } +{ + name: 'Deny-LogicApp-Public-Network' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-LogicApp-Public-Network.json') +} +{ + name: 'Deny-LogicApps-Without-Https' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-LogicApps-Without-Https.json') +} { name: 'Deny-MachineLearning-Aks' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-MachineLearning-Aks.json') @@ -154,6 +198,10 @@ name: 'Deny-Redis-http' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Redis-http.json') } +{ + name: 'Deny-Service-Endpoints' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Service-Endpoints.json') +} { name: 'Deny-Sql-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Sql-minTLS.json') @@ -162,10 +210,46 @@ name: 'Deny-SqlMi-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-SqlMi-minTLS.json') } +{ + name: 'Deny-Storage-ContainerDeleteRetentionPolicy' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ContainerDeleteRetentionPolicy.json') +} +{ + name: 'Deny-Storage-CopyScope' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-CopyScope.json') +} +{ + name: 'Deny-Storage-CorsRules' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-CorsRules.json') +} +{ + name: 'Deny-Storage-LocalUser' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-LocalUser.json') +} { name: 'Deny-Storage-minTLS' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json') } +{ + name: 'Deny-Storage-NetworkAclsBypass' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsBypass.json') +} +{ + name: 'Deny-Storage-NetworkAclsVirtualNetworkRules' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsVirtualNetworkRules.json') +} +{ + name: 'Deny-Storage-ResourceAccessRulesResourceId' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesResourceId.json') +} +{ + name: 'Deny-Storage-ResourceAccessRulesTenantId' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesTenantId.json') +} +{ + name: 'Deny-Storage-ServicesEncryption' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-ServicesEncryption.json') +} { name: 'Deny-Storage-SFTP' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deny-Storage-SFTP.json') @@ -206,6 +290,10 @@ name: 'DenyAction-ActivityLogs' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json') } +{ + name: 'DenyAction-DeleteResources' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json') +} { name: 'DenyAction-DiagnosticLogs' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json') @@ -442,6 +530,10 @@ name: 'Deploy-FirewallPolicy' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-FirewallPolicy.json') } +{ + name: 'Deploy-LogicApp-TLS' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-LogicApp-TLS.json') +} { name: 'Deploy-MDFC-Arc-SQL-DCR-Association' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json') @@ -478,6 +570,10 @@ name: 'Deploy-PostgreSQL-sslEnforcement' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-PostgreSQL-sslEnforcement.json') } +{ + name: 'Deploy-Private-DNS-Generic' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Private-DNS-Generic.json') +} { name: 'Deploy-Sql-AuditingSettings' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Sql-AuditingSettings.json') @@ -526,3 +622,11 @@ name: 'Deploy-Windows-DomainJoin' libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Deploy-Windows-DomainJoin.json') } +{ + name: 'Modify-NSG' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Modify-NSG.json') +} +{ + name: 'Modify-UDR' + libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_Modify-UDR.json') +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PrivateLinkDnsZones.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PrivateLinkDnsZones.json index b23924b95..e63ca602b 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PrivateLinkDnsZones.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PrivateLinkDnsZones.json @@ -6,10 +6,10 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Audit the creation of Private Link Private DNS Zones", - "description": "This policy audits the creation of a Private Link Private DNS Zones in the current scope, used in combination with policies that create centralized private DNS in connectivity subscription", + "displayName": "Audit or Deny the creation of Private Link Private DNS Zones", + "description": "This policy audits or denies, depending on assignment effect, the creation of a Private Link Private DNS Zones in the current scope, used in combination with policies that create centralized private DNS in connectivity subscription", "metadata": { - "version": "1.0.1", + "version": "1.0.2", "category": "Network", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PublicIpAddresses-UnusedResourcesCostOptimization.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PublicIpAddresses-UnusedResourcesCostOptimization.json index ac9b4f183..e4012c01b 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PublicIpAddresses-UnusedResourcesCostOptimization.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Audit-PublicIpAddresses-UnusedResourcesCostOptimization.json @@ -9,7 +9,7 @@ "displayName": "Unused Public IP addresses driving cost should be avoided", "description": "Optimize cost by detecting unused but chargeable resources. Leverage this Policy definition as a cost control to reveal orphaned Public IP addresses that are driving cost.", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Cost Optimization", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -40,8 +40,8 @@ "equals": "microsoft.network/publicIpAddresses" }, { - "field": "Microsoft.Network/publicIPAddresses/sku.name", - "notEquals": "Basic" + "field": "Microsoft.Network/publicIPAddresses/publicIPAllocationMethod", + "equals": "Static" }, { "anyOf": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-APIM-TLS.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-APIM-TLS.json new file mode 100644 index 000000000..8becabff3 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-APIM-TLS.json @@ -0,0 +1,70 @@ +{ + "name": "Deny-APIM-TLS", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "API Management services should use TLS version 1.2", + "description": "Azure API Management service should use TLS version 1.2", + "metadata": { + "version": "1.0.0", + "category": "API Management", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.ApiManagement/service" + }, + { + "anyOf": [ + { + "value": "[indexof(toLower(string(field('Microsoft.ApiManagement/service/customProperties'))), '\"microsoft.windowsazure.apimanagement.gateway.security.protocols.tls10\":\"true\"')]", + "greater": 0 + }, + { + "value": "[indexof(toLower(string(field('Microsoft.ApiManagement/service/customProperties'))), '\"microsoft.windowsazure.apimanagement.gateway.security.protocols.tls10\":true')]", + "greater": 0 + }, + { + "value": "[indexof(toLower(string(field('Microsoft.ApiManagement/service/customProperties'))), '\"microsoft.windowsazure.apimanagement.gateway.security.protocols.tls11\":\"true\"')]", + "greater": 0 + }, + { + "value": "[indexof(toLower(string(field('Microsoft.ApiManagement/service/customProperties'))), '\"microsoft.windowsazure.apimanagement.gateway.security.protocols.tls11\":true')]", + "greater": 0 + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppGw-Without-Tls.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppGw-Without-Tls.json new file mode 100644 index 000000000..ac9934892 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppGw-Without-Tls.json @@ -0,0 +1,78 @@ +{ + "name": "Deny-AppGw-Without-Tls", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Application Gateway should be deployed with predefined Microsoft policy that is using TLS version 1.2", + "description": "This policy enables you to restrict that Application Gateways is always deployed with predefined Microsoft policy that is using TLS version 1.2", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "predefinedPolicyName": { + "type": "array", + "metadata": { + "displayName": "Predefined policy name", + "description": "Predefined policy name" + }, + "defaultValue": [ + "AppGwSslPolicy20220101", + "AppGwSslPolicy20170401S", + "AppGwSslPolicy20220101S" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/applicationGateways" + }, + { + "anyOf": [ + { + "field": "Microsoft.Network/applicationGateways/sslPolicy.policyType", + "notEquals": "Predefined" + }, + { + "field": "Microsoft.Network/applicationGateways/sslPolicy.policyType", + "exists": "false" + }, + { + "field": "Microsoft.Network/applicationGateways/sslPolicy.policyName", + "notIn": "[parameters('predefinedPolicyName')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppService-without-BYOC.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppService-without-BYOC.json new file mode 100644 index 000000000..13962cc09 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AppService-without-BYOC.json @@ -0,0 +1,62 @@ +{ + "name": "Deny-AppService-without-BYOC", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "App Service certificates must be stored in Key Vault", + "description": "App Service (including Logic apps and Function apps) must use certificates stored in Key Vault", + "metadata": { + "version": "1.0.0", + "category": "App Service", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Audit", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Web/certificates" + }, + { + "anyOf": [ + { + "field": "Microsoft.Web/certificates/keyVaultId", + "exists": "false" + }, + { + "field": "Microsoft.Web/certificates/keyVaultSecretName", + "exists": "false" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AzFw-Without-Policy.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AzFw-Without-Policy.json new file mode 100644 index 000000000..c762992c0 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-AzFw-Without-Policy.json @@ -0,0 +1,54 @@ +{ + "name": "Deny-AzFw-Without-Policy", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Azure Firewall should have a default Firewall Policy", + "description": "This policy denies the creation of Azure Firewall without a default Firewall Policy.", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/azureFirewalls" + }, + { + "field": "Microsoft.Network/azureFirewalls/firewallPolicy.id", + "exists": "false" + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-NetworkAcls.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-NetworkAcls.json new file mode 100644 index 000000000..e3de09eb3 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-NetworkAcls.json @@ -0,0 +1,66 @@ +{ + "name": "Deny-CognitiveServices-NetworkAcls", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Network ACLs should be restricted for Cognitive Services", + "description": "Azure Cognitive Services should not allow adding individual IPs or virtual network rules to the service-level firewall. Enable this to restrict inbound network access and enforce the usage of private endpoints.", + "metadata": { + "version": "1.0.0", + "category": "Cognitive Services", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.CognitiveServices/accounts" + }, + { + "anyOf": [ + { + "count": { + "field": "Microsoft.CognitiveServices/accounts/networkAcls.ipRules[*]" + }, + "greater": 0 + }, + { + "count": { + "field": "Microsoft.CognitiveServices/accounts/networkAcls.virtualNetworkRules[*]" + }, + "greater": 0 + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-Resource-Kinds.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-Resource-Kinds.json new file mode 100644 index 000000000..e4c416f5d --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-Resource-Kinds.json @@ -0,0 +1,95 @@ +{ + "name": "Deny-CognitiveServices-Resource-Kinds", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Only explicit kinds for Cognitive Services should be allowed", + "description": "Azure Cognitive Services should only create explicit allowed kinds.", + "metadata": { + "version": "1.0.0", + "category": "Cognitive Services", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "allowedKinds": { + "type": "array", + "metadata": { + "displayName": "Effect", + "description": "Select the allowed resource kinds to be used with Cognitive Services" + }, + "allowedValues": [ + "AnomalyDetector", + "ComputerVision", + "CognitiveServices", + "ContentModerator", + "CustomVision.Training", + "CustomVision.Prediction", + "Face", + "FormRecognizer", + "ImmersiveReader", + "LUIS", + "Personalizer", + "SpeechServices", + "TextAnalytics", + "TextTranslation", + "OpenAI" + ], + "defaultValue": [ + "AnomalyDetector", + "ComputerVision", + "CognitiveServices", + "ContentModerator", + "CustomVision.Training", + "CustomVision.Prediction", + "Face", + "FormRecognizer", + "ImmersiveReader", + "LUIS", + "Personalizer", + "SpeechServices", + "TextAnalytics", + "TextTranslation", + "OpenAI" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.CognitiveServices/accounts" + }, + { + "field": "kind", + "notIn": "[parameters('allowedKinds')]" + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-RestrictOutboundNetworkAccess.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-RestrictOutboundNetworkAccess.json new file mode 100644 index 000000000..07c5885f2 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-CognitiveServices-RestrictOutboundNetworkAccess.json @@ -0,0 +1,62 @@ +{ + "name": "Deny-CognitiveServices-RestrictOutboundNetworkAccess", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Outbound network access should be restricted for Cognitive Services", + "description": "Azure Cognitive Services allow restricting outbound network access. Enable this to limit outbound connectivity for the service.", + "metadata": { + "version": "1.0.0", + "category": "Cognitive Services", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.CognitiveServices/accounts" + }, + { + "anyOf": [ + { + "field": "Microsoft.CognitiveServices/accounts/restrictOutboundNetworkAccess", + "exists": "false" + }, + { + "field": "Microsoft.CognitiveServices/accounts/restrictOutboundNetworkAccess", + "notEquals": true + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-Premium-CMK.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-Premium-CMK.json new file mode 100644 index 000000000..2785c8031 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-Premium-CMK.json @@ -0,0 +1,60 @@ +{ + "name": "Deny-EH-Premium-CMK", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Event Hub namespaces (Premium) should use a customer-managed key for encryption", + "description": "Event Hub namespaces (Premium) should use a customer-managed key for encryption.", + "metadata": { + "version": "1.0.0", + "category": "Event Hub", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.EventHub/namespaces" + }, + { + "field": "Microsoft.EventHub/namespaces/sku.name", + "equals": "Premium" + }, + { + "not": { + "field": "Microsoft.EventHub/namespaces/encryption.keySource", + "equals": "Microsoft.Keyvault" + } + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-minTLS.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-minTLS.json new file mode 100644 index 000000000..a1e8b33e7 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-EH-minTLS.json @@ -0,0 +1,70 @@ +{ + "name": "Deny-EH-minTLS", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Event Hub namespaces should use a valid TLS version", + "description": "Event Hub namespaces should use a valid TLS version.", + "metadata": { + "version": "1.0.0", + "category": "Event Hub", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "minTlsVersion": { + "type": "string", + "metadata": { + "displayName": "Minimum TLS Version", + "description": "Minimum TLS version to be used by Event Hub" + }, + "defaultValue": "1.2" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.EventHub/namespaces" + }, + { + "anyOf": [ + { + "field": "Microsoft.EventHub/namespaces/minimumTlsVersion", + "notEquals": "[parameters('minTlsVersion')]" + }, + { + "field": "Microsoft.EventHub/namespaces/minimumTlsVersion", + "exists": "false" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApp-Public-Network.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApp-Public-Network.json new file mode 100644 index 000000000..08af4808c --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApp-Public-Network.json @@ -0,0 +1,66 @@ +{ + "name": "Deny-LogicApp-Public-Network", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Logic apps should disable public network access", + "description": "Disabling public network access improves security by ensuring that the Logic App is not exposed on the public internet. Creating private endpoints can limit exposure of a Logic App. Learn more at: https://aka.ms/app-service-private-endpoint.", + "metadata": { + "version": "1.0.0", + "category": "Logic Apps", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Web/sites" + }, + { + "field": "kind", + "contains": "workflowapp" + }, + { + "anyOf": [ + { + "field": "Microsoft.Web/sites/publicNetworkAccess", + "exists": "false" + }, + { + "field": "Microsoft.Web/sites/publicNetworkAccess", + "notEquals": "Disabled" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApps-Without-Https.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApps-Without-Https.json new file mode 100644 index 000000000..412add92b --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-LogicApps-Without-Https.json @@ -0,0 +1,66 @@ +{ + "name": "Deny-LogicApps-Without-Https", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Logic app should only be accessible over HTTPS", + "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.", + "metadata": { + "version": "1.0.0", + "category": "Logic Apps", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Web/sites" + }, + { + "field": "kind", + "contains": "workflowapp" + }, + { + "anyOf": [ + { + "field": "Microsoft.Web/sites/httpsOnly", + "exists": "false" + }, + { + "field": "Microsoft.Web/sites/httpsOnly", + "equals": "false" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Service-Endpoints.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Service-Endpoints.json new file mode 100644 index 000000000..6c90c9947 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Service-Endpoints.json @@ -0,0 +1,60 @@ +{ + "name": "Deny-Service-Endpoints", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Deny or Audit service endpoints on subnets", + "description": "This Policy will deny/audit Service Endpoints on subnets. Service Endpoints allows the network traffic to bypass Network appliances, such as the Azure Firewall.", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/virtualNetworks/subnets" + }, + { + "count": { + "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpoints[*]", + "where": { + "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpoints[*].service", + "exists": true + } + }, + "greater": 0 + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ContainerDeleteRetentionPolicy.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ContainerDeleteRetentionPolicy.json new file mode 100644 index 000000000..6325b5b49 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ContainerDeleteRetentionPolicy.json @@ -0,0 +1,74 @@ +{ + "name": "Deny-Storage-ContainerDeleteRetentionPolicy", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Storage Accounts should use a container delete retention policy", + "description": "Enforce container delete retention policies larger than seven days for storage account. Enable this for increased data loss protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "minContainerDeleteRetentionInDays": { + "type": "Integer", + "metadata": { + "displayName": "Minimum Container Delete Retention in Days", + "description": "Specifies the minimum number of days for the container delete retention policy" + }, + "defaultValue": 7 + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts/blobServices" + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/blobServices/containerDeleteRetentionPolicy.enabled", + "exists": false + }, + { + "field": "Microsoft.Storage/storageAccounts/blobServices/containerDeleteRetentionPolicy.enabled", + "notEquals": true + }, + { + "field": "Microsoft.Storage/storageAccounts/blobServices/containerDeleteRetentionPolicy.days", + "less": "[parameters('minContainerDeleteRetentionInDays')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CopyScope.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CopyScope.json new file mode 100644 index 000000000..a8fb06bb8 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CopyScope.json @@ -0,0 +1,74 @@ +{ + "name": "Deny-Storage-CopyScope", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Allowed Copy scope should be restricted for Storage Accounts", + "description": "Azure Storage accounts should restrict the allowed copy scope. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "allowedCopyScope": { + "type": "String", + "metadata": { + "displayName": "Allowed Copy Scope", + "description": "Specify the allowed copy scope." + }, + "allowedValues": [ + "AAD", + "PrivateLink" + ], + "defaultValue": "AAD" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/allowedCopyScope", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/allowedCopyScope", + "notEquals": "[parameters('allowedCopyScope')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CorsRules.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CorsRules.json new file mode 100644 index 000000000..758a36ba5 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-CorsRules.json @@ -0,0 +1,102 @@ +{ + "name": "Deny-Storage-CorsRules", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Storage Accounts should restrict CORS rules", + "description": "Deny CORS rules for storage account for increased data exfiltration protection and endpoint protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "anyOf": [ + { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts/blobServices" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/blobServices/cors.corsRules[*]" + }, + "greater": 0 + } + ] + }, + { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts/fileServices" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/fileServices/cors.corsRules[*]" + }, + "greater": 0 + } + ] + }, + { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts/tableServices" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/tableServices/cors.corsRules[*]" + }, + "greater": 0 + } + ] + }, + { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts/queueServices" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/queueServices/cors.corsRules[*]" + }, + "greater": 0 + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-LocalUser.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-LocalUser.json new file mode 100644 index 000000000..ef224a3a6 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-LocalUser.json @@ -0,0 +1,62 @@ +{ + "name": "Deny-Storage-LocalUser", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Local users should be restricted for Storage Accounts", + "description": "Azure Storage accounts should disable local users for features like SFTP. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/isLocalUserEnabled", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/isLocalUserEnabled", + "notEquals": false + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsBypass.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsBypass.json new file mode 100644 index 000000000..47b3b9608 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsBypass.json @@ -0,0 +1,90 @@ +{ + "name": "Deny-Storage-NetworkAclsBypass", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Network ACL bypass option should be restricted for Storage Accounts", + "description": "Azure Storage accounts should restrict the bypass option for service-level network ACLs. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "allowedBypassOptions": { + "type": "Array", + "metadata": { + "displayName": "Allowed Bypass Options", + "description": "Specifies which options are allowed to bypass the vnet configuration" + }, + "allowedValues": [ + "None", + "Logging", + "Metrics", + "AzureServices", + "Logging, Metrics", + "Logging, AzureServices", + "Metrics, AzureServices", + "Logging, Metrics, AzureServices", + "Logging, Metrics, AzureServices" + ], + "defaultValue": [ + "Logging", + "Metrics", + "AzureServices", + "Logging, Metrics", + "Logging, AzureServices", + "Metrics, AzureServices", + "Logging, Metrics, AzureServices", + "Logging, Metrics, AzureServices" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/networkAcls.bypass", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/networkAcls.bypass", + "notIn": "[parameters('allowedBypassOptions')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsVirtualNetworkRules.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsVirtualNetworkRules.json new file mode 100644 index 000000000..f8ae97ebc --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-NetworkAclsVirtualNetworkRules.json @@ -0,0 +1,56 @@ +{ + "name": "Deny-Storage-NetworkAclsVirtualNetworkRules", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Virtual network rules should be restricted for Storage Accounts", + "description": "Azure Storage accounts should restrict the virtual network service-level network ACLs. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/networkAcls.virtualNetworkRules[*]" + }, + "greater": 0 + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesResourceId.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesResourceId.json new file mode 100644 index 000000000..140f10232 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesResourceId.json @@ -0,0 +1,66 @@ +{ + "name": "Deny-Storage-ResourceAccessRulesResourceId", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Resource Access Rules resource IDs should be restricted for Storage Accounts", + "description": "Azure Storage accounts should restrict the resource access rule for service-level network ACLs to services from a specific Azure subscription. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/networkAcls.resourceAccessRules[*]" + }, + "greater": 0 + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/networkAcls.resourceAccessRules[*]", + "where": { + "value": "[split(current('Microsoft.Storage/storageAccounts/networkAcls.resourceAccessRules[*].resourceId'), '/')[2]]", + "equals": "*" + } + }, + "greater": 0 + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesTenantId.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesTenantId.json new file mode 100644 index 000000000..6cce477cd --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ResourceAccessRulesTenantId.json @@ -0,0 +1,60 @@ +{ + "name": "Deny-Storage-ResourceAccessRulesTenantId", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Resource Access Rules Tenants should be restricted for Storage Accounts", + "description": "Azure Storage accounts should restrict the resource access rule for service-level network ACLs to service from the same AAD tenant. Enforce this for increased data exfiltration protection.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "count": { + "field": "Microsoft.Storage/storageAccounts/networkAcls.resourceAccessRules[*]" + }, + "greater": 0 + }, + { + "field": "Microsoft.Storage/storageAccounts/networkAcls.resourceAccessRules[*].tenantId", + "notEquals": "[subscription().tenantId]" + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ServicesEncryption.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ServicesEncryption.json new file mode 100644 index 000000000..54d016827 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-ServicesEncryption.json @@ -0,0 +1,102 @@ +{ + "name": "Deny-Storage-ServicesEncryption", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Encryption for storage services should be enforced for Storage Accounts", + "description": "Azure Storage accounts should enforce encryption for all storage services. Enforce this for increased encryption scope.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Storage/storageAccounts" + }, + { + "anyOf": [ + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.blob.enabled", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.blob.enabled", + "notEquals": true + } + ] + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.file.enabled", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.file.enabled", + "notEquals": true + } + ] + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.queue.keyType", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.queue.keyType", + "notEquals": "Account" + } + ] + }, + { + "anyOf": [ + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.table.keyType", + "exists": "false" + }, + { + "field": "Microsoft.Storage/storageAccounts/encryption.services.table.keyType", + "notEquals": "Account" + } + ] + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json index 5b10d4862..b4b36c6e4 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deny-Storage-minTLS.json @@ -5,11 +5,13 @@ "scope": null, "properties": { "policyType": "Custom", - "mode": "Indexed", - "displayName": "Storage Account set to minimum TLS and Secure transfer should be enabled", - "description": "Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking", + "mode": "All", + "displayName": "[Deprecated] Storage Account set to minimum TLS and Secure transfer should be enabled", + "description": "Audit requirement of Secure transfer in your storage account. This policy is superseded by https://www.azadvertizer.net/azpolicyadvertizer/fe83a0eb-a853-422d-aac2-1bffd182c5d0.html and https://www.azadvertizer.net/azpolicyadvertizer/404c3081-a854-4457-ae30-26a93ef643f9.html", "metadata": { - "version": "1.0.0", + "deprecated": true, + "supersededBy": "fe83a0eb-a853-422d-aac2-1bffd182c5d0,404c3081-a854-4457-ae30-26a93ef643f9", + "version": "1.0.0-deprecated", "category": "Storage", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json new file mode 100644 index 000000000..c28daa545 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json @@ -0,0 +1,72 @@ +{ + "name": "DenyAction-DeleteResources", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Do not allow deletion of specified resource and resource type", + "description": "This policy enables you to specify the resource and resource type that your organization can protect from accidentals deletion by blocking delete calls using the deny action effect.", + "metadata": { + "version": "1.0.0", + "category": "General", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "resourceName": { + "type": "String", + "metadata": { + "displayName": "Resource Name", + "description": "Provide the name of the resource that you want to protect from accidental deletion." + } + }, + "resourceType": { + "type": "String", + "metadata": { + "displayName": "Resource Type", + "description": "Provide the resource type that you want to protect from accidental deletion." + } + }, + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + }, + "allowedValues": [ + "DenyAction", + "Disabled" + ], + "defaultValue": "DenyAction" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "[parameters('resourceType')]" + }, + { + "field": "name", + "like": "[parameters('resourceName')]" + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "actionNames": [ + "delete" + ] + } + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-ASC-SecurityContacts.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-ASC-SecurityContacts.json index fc32cb2ba..55c20e2ce 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-ASC-SecurityContacts.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-ASC-SecurityContacts.json @@ -9,7 +9,7 @@ "displayName": "Deploy Microsoft Defender for Cloud Security Contacts", "description": "Deploy Microsoft Defender for Cloud Security Contacts", "metadata": { - "version": "1.1.0", + "version": "2.0.0", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -20,14 +20,14 @@ }, "parameters": { "emailSecurityContact": { - "type": "string", + "type": "String", "metadata": { "displayName": "Security contacts email address", - "description": "Provide email address for Azure Security Center contact details" + "description": "Provide email addresses (semi-colon separated) for Defender for Cloud contact details" } }, "effect": { - "type": "string", + "type": "String", "defaultValue": "DeployIfNotExists", "allowedValues": [ "DeployIfNotExists", @@ -39,7 +39,7 @@ } }, "minimalSeverity": { - "type": "string", + "type": "String", "defaultValue": "High", "allowedValues": [ "High", @@ -77,20 +77,12 @@ "contains": "[parameters('emailSecurityContact')]" }, { - "field": "Microsoft.Security/securityContacts/alertNotifications.minimalSeverity", - "contains": "[parameters('minimalSeverity')]" - }, - { - "field": "type", - "equals": "Microsoft.Security/securityContacts" + "field": "Microsoft.Security/securityContacts/isEnabled", + "equals": true }, { - "field": "Microsoft.Security/securityContacts/alertNotifications", - "equals": "On" - }, - { - "field": "Microsoft.Security/securityContacts/alertsToAdmins", - "equals": "On" + "field": "Microsoft.Security/securityContacts/notificationsSources[*].Alert.minimalSeverity", + "contains": "[parameters('minimalSeverity')]" } ] }, @@ -128,19 +120,22 @@ { "type": "Microsoft.Security/securityContacts", "name": "default", - "apiVersion": "2020-01-01-preview", + "apiVersion": "2023-12-01-preview", "properties": { "emails": "[parameters('emailSecurityContact')]", + "isEnabled": true, "notificationsByRole": { "state": "On", "roles": [ "Owner" ] }, - "alertNotifications": { - "state": "On", - "minimalSeverity": "[parameters('minimalSeverity')]" - } + "notificationsSources": [ + { + "sourceType": "Alert", + "minimalSeverity": "[parameters('minimalSeverity')]" + } + ] } } ], diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AA.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AA.json index fee8ee212..c1e6c49bd 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AA.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AA.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Automation to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Automation to stream to a Log Analytics workspace when any Automation which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Automation to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Automation to stream to a Log Analytics workspace when any Automation which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACI.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACI.json index 2ab193db6..0a88a7df4 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACI.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACI.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Container Instances to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Container Instances to stream to a Log Analytics workspace when any ACR which is missing this diagnostic settings is created or updated. The Policy willset the diagnostic with all metrics enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Container Instances to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Container Instances to stream to a Log Analytics workspace when any ACR which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACR.json index fac00d211..7860050e2 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACR.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ACR.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Container Registry to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Container Registry to stream to a Log Analytics workspace when any ACR which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Container Registry to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Container Registry to stream to a Log Analytics workspace when any ACR which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-APIMgmt.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-APIMgmt.json index 9ffe64057..fda4db6d1 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-APIMgmt.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-APIMgmt.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for API Management to Log Analytics workspace", - "description": "Deploys the diagnostic settings for API Management to stream to a Log Analytics workspace when any API Management which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for API Management to Log Analytics workspace", + "description": "Deploys the diagnostic settings for API Management to stream to a Log Analytics workspace when any API Management which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AVDScalingPlans.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AVDScalingPlans.json index 631957ec9..727dd199e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AVDScalingPlans.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AVDScalingPlans.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for AVD Scaling Plans to Log Analytics workspace", - "description": "Deploys the diagnostic settings for AVD Scaling Plans to stream to a Log Analytics workspace when any Scaling Plan which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all and categorys enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for AVD Scaling Plans to Log Analytics workspace", + "description": "Deploys the diagnostic settings for AVD Scaling Plans to stream to a Log Analytics workspace when any Scaling Plan which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AnalysisService.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AnalysisService.json index 0b6991826..9774e025d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AnalysisService.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-AnalysisService.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Analysis Services to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Analysis Services to stream to a Log Analytics workspace when any Analysis Services which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Analysis Services to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Analysis Services to stream to a Log Analytics workspace when any Analysis Services which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApiForFHIR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApiForFHIR.json index 3c43b2d87..0dd4e3223 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApiForFHIR.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApiForFHIR.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Azure API for FHIR to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Azure API for FHIR to stream to a Log Analytics workspace when any Azure API for FHIR which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Azure API for FHIR to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Azure API for FHIR to stream to a Log Analytics workspace when any Azure API for FHIR which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApplicationGateway.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApplicationGateway.json index 4362a337f..03f5b218c 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApplicationGateway.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ApplicationGateway.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Application Gateway to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Application Gateway to stream to a Log Analytics workspace when any Application Gateway which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Application Gateway to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Application Gateway to stream to a Log Analytics workspace when any Application Gateway which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Bastion.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Bastion.json index 8958c29e1..48afcbdea 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Bastion.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Bastion.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Azure Bastion to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Azure Bastion to stream to a Log Analytics workspace when any Azure Bastion which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Azure Bastion to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Azure Bastion to stream to a Log Analytics workspace when any Azure Bastion which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CDNEndpoints.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CDNEndpoints.json index 618a4d6b0..eaebf19cd 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CDNEndpoints.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CDNEndpoints.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for CDN Endpoint to Log Analytics workspace", - "description": "Deploys the diagnostic settings for CDN Endpoint to stream to a Log Analytics workspace when any CDN Endpoint which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for CDN Endpoint to Log Analytics workspace", + "description": "Deploys the diagnostic settings for CDN Endpoint to stream to a Log Analytics workspace when any CDN Endpoint which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CognitiveServices.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CognitiveServices.json index fbf8a0e5b..17951837e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CognitiveServices.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CognitiveServices.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Cognitive Services to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Cognitive Services to stream to a Log Analytics workspace when any Cognitive Services which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Cognitive Services to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Cognitive Services to stream to a Log Analytics workspace when any Cognitive Services which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CosmosDB.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CosmosDB.json index 0c5e86c70..8832fe3c0 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CosmosDB.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-CosmosDB.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Cosmos DB to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Cosmos DB to stream to a Log Analytics workspace when any Cosmos DB which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Cosmos DB to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Cosmos DB to stream to a Log Analytics workspace when any Cosmos DB which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DLAnalytics.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DLAnalytics.json index 43e223d8e..54232fd32 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DLAnalytics.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DLAnalytics.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Data Lake Analytics to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Data Lake Analytics to stream to a Log Analytics workspace when any Data Lake Analytics which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Data Lake Analytics to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Data Lake Analytics to stream to a Log Analytics workspace when any Data Lake Analytics which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataExplorerCluster.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataExplorerCluster.json index 8faad53c9..896422bd0 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataExplorerCluster.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataExplorerCluster.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Azure Data Explorer Cluster to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Azure Data Explorer Cluster to stream to a Log Analytics workspace when any Azure Data Explorer Cluster which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Azure Data Explorer Cluster to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Azure Data Explorer Cluster to stream to a Log Analytics workspace when any Azure Data Explorer Cluster which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataFactory.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataFactory.json index fe5aa77ef..019beab83 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataFactory.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-DataFactory.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Data Factory to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Data Factory to stream to a Log Analytics workspace when any Data Factory which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Data Factory to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Data Factory to stream to a Log Analytics workspace when any Data Factory which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Databricks.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Databricks.json index b93b48b69..a2b53063a 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Databricks.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Databricks.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Databricks to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Databricks to stream to a Log Analytics workspace when any Databricks which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Databricks to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Databricks to stream to a Log Analytics workspace when any Databricks which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.3.0", + "deprecated": true, + "version": "1.3.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSub.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSub.json index c77b4eb3d..b4b5adb0c 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSub.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSub.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Event Grid subscriptions to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Event Grid subscriptions to stream to a Log Analytics workspace when any Event Grid subscriptions which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Event Grid subscriptions to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Event Grid subscriptions to stream to a Log Analytics workspace when any Event Grid subscriptions which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSystemTopic.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSystemTopic.json index 51ed84ae9..bd4501c9b 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSystemTopic.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridSystemTopic.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Event Grid System Topic to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Event Grid System Topic to stream to a Log Analytics workspace when any Event Grid System Topic which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Event Grid System Topic to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Event Grid System Topic to stream to a Log Analytics workspace when any Event Grid System Topic which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridTopic.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridTopic.json index 5990ef97e..cf1ff1ce2 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridTopic.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-EventGridTopic.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Event Grid Topic to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Event Grid Topic to stream to a Log Analytics workspace when any Event Grid Topic which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Event Grid Topic to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Event Grid Topic to stream to a Log Analytics workspace when any Event Grid Topic which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ExpressRoute.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ExpressRoute.json index 25aa36286..88257d03f 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ExpressRoute.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-ExpressRoute.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for ExpressRoute to Log Analytics workspace", - "description": "Deploys the diagnostic settings for ExpressRoute to stream to a Log Analytics workspace when any ExpressRoute which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for ExpressRoute to Log Analytics workspace", + "description": "Deploys the diagnostic settings for ExpressRoute to stream to a Log Analytics workspace when any ExpressRoute which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Firewall.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Firewall.json index 01d780d7d..3546fe19e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Firewall.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Firewall.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Firewall to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Firewall to stream to a Log Analytics workspace when any Firewall which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Firewall to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Firewall to stream to a Log Analytics workspace when any Firewall which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-FrontDoor.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-FrontDoor.json index d7fa9f3c2..7bd6c5416 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-FrontDoor.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-FrontDoor.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Front Door to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Front Door to stream to a Log Analytics workspace when any Front Door which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Front Door to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Front Door to stream to a Log Analytics workspace when any Front Door which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Function.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Function.json index bcde0b94b..0ad8e5e58 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Function.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Function.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Azure Function App to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Azure Function App to stream to a Log Analytics workspace when any function app which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Azure Function App to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Azure Function App to stream to a Log Analytics workspace when any function app which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-HDInsight.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-HDInsight.json index b2a779ec5..f23df3993 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-HDInsight.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-HDInsight.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for HDInsight to Log Analytics workspace", - "description": "Deploys the diagnostic settings for HDInsight to stream to a Log Analytics workspace when any HDInsight which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for HDInsight to Log Analytics workspace", + "description": "Deploys the diagnostic settings for HDInsight to stream to a Log Analytics workspace when any HDInsight which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LoadBalancer.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LoadBalancer.json index 69898554f..b4a00e7e3 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LoadBalancer.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LoadBalancer.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Load Balancer to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Load Balancer to stream to a Log Analytics workspace when any Load Balancer which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Load Balancer to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Load Balancer to stream to a Log Analytics workspace when any Load Balancer which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogAnalytics.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogAnalytics.json index bf6d6c29f..2eaf1d164 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogAnalytics.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogAnalytics.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Log Analytics to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Log Analytics workspaces to stream to a Log Analytics workspace when any Log Analytics workspace which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Log Analytics to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Log Analytics workspaces to stream to a Log Analytics workspace when any Log Analytics workspace which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogicAppsISE.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogicAppsISE.json index 1d5628291..19b436fb6 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogicAppsISE.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-LogicAppsISE.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Logic Apps integration service environment to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Logic Apps integration service environment to stream to a Log Analytics workspace when any Logic Apps integration service environment which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Logic Apps integration service environment to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Logic Apps integration service environment to stream to a Log Analytics workspace when any Logic Apps integration service environment which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MediaService.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MediaService.json index c98506e3b..c0e9d24fd 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MediaService.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MediaService.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Azure Media Service to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Azure Media Service to stream to a Log Analytics workspace when any Azure Media Service which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Azure Media Service to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Azure Media Service to stream to a Log Analytics workspace when any Azure Media Service which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MlWorkspace.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MlWorkspace.json index 6df9c2472..1dcb9ebd9 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MlWorkspace.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MlWorkspace.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Machine Learning workspace to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Machine Learning workspace to stream to a Log Analytics workspace when any Machine Learning workspace which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Machine Learning workspace to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Machine Learning workspace to stream to a Log Analytics workspace when any Machine Learning workspace which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MySQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MySQL.json index 1048f2fa3..4fbe778f3 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MySQL.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-MySQL.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Database for MySQL to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Database for MySQL to stream to a Log Analytics workspace when any Database for MySQL which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Database for MySQL to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Database for MySQL to stream to a Log Analytics workspace when any Database for MySQL which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NIC.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NIC.json index daca6b487..747da3d7d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NIC.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NIC.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Network Interfaces to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Network Interfaces to stream to a Log Analytics workspace when any Network Interfaces which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Network Interfaces to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Network Interfaces to stream to a Log Analytics workspace when any Network Interfaces which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NetworkSecurityGroups.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NetworkSecurityGroups.json index e78433615..fb73376ef 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NetworkSecurityGroups.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-NetworkSecurityGroups.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Network Security Groups to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Network Security Groups to stream to a Log Analytics workspace when any Network Security Groups which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Network Security Groups to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Network Security Groups to stream to a Log Analytics workspace when any Network Security Groups which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PostgreSQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PostgreSQL.json index 82b1ba70c..e78cb594d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PostgreSQL.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PostgreSQL.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Database for PostgreSQL to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Database for PostgreSQL to stream to a Log Analytics workspace when any Database for PostgreSQL which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Database for PostgreSQL to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Database for PostgreSQL to stream to a Log Analytics workspace when any Database for PostgreSQL which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "2.0.0", + "deprecated": true, + "version": "2.0.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PowerBIEmbedded.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PowerBIEmbedded.json index e3988dbff..f06edec62 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PowerBIEmbedded.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-PowerBIEmbedded.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Power BI Embedded to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Power BI Embedded to stream to a Log Analytics workspace when any Power BI Embedded which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Power BI Embedded to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Power BI Embedded to stream to a Log Analytics workspace when any Power BI Embedded which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-RedisCache.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-RedisCache.json index 44f70db10..8b73c2d2c 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-RedisCache.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-RedisCache.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Redis Cache to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Redis Cache to stream to a Log Analytics workspace when any Redis Cache which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Redis Cache to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Redis Cache to stream to a Log Analytics workspace when any Redis Cache which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Relay.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Relay.json index f8595c851..2f9c9047b 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Relay.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Relay.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Relay to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Relay to stream to a Log Analytics workspace when any Relay which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Relay to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Relay to stream to a Log Analytics workspace when any Relay which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLElasticPools.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLElasticPools.json index 2cf6fe69f..6d632c1d8 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLElasticPools.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLElasticPools.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for SQL Elastic Pools to Log Analytics workspace", - "description": "Deploys the diagnostic settings for SQL Elastic Pools to stream to a Log Analytics workspace when any SQL Elastic Pools which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for SQL Elastic Pools to Log Analytics workspace", + "description": "Deploys the diagnostic settings for SQL Elastic Pools to stream to a Log Analytics workspace when any SQL Elastic Pools which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLMI.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLMI.json index d838026c2..825ba0362 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLMI.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SQLMI.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for SQL Managed Instances to Log Analytics workspace", - "description": "Deploys the diagnostic settings for SQL Managed Instances to stream to a Log Analytics workspace when any SQL Managed Instances which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for SQL Managed Instances to Log Analytics workspace", + "description": "Deploys the diagnostic settings for SQL Managed Instances to stream to a Log Analytics workspace when any SQL Managed Instances which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SignalR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SignalR.json index e9a395c1f..ed26505af 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SignalR.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-SignalR.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for SignalR to Log Analytics workspace", - "description": "Deploys the diagnostic settings for SignalR to stream to a Log Analytics workspace when any SignalR which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for SignalR to Log Analytics workspace", + "description": "Deploys the diagnostic settings for SignalR to stream to a Log Analytics workspace when any SignalR which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TimeSeriesInsights.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TimeSeriesInsights.json index ca3dfcc2d..76c53faea 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TimeSeriesInsights.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TimeSeriesInsights.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Time Series Insights to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Time Series Insights to stream to a Log Analytics workspace when any Time Series Insights which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Time Series Insights to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Time Series Insights to stream to a Log Analytics workspace when any Time Series Insights which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TrafficManager.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TrafficManager.json index 2bd6593bf..575f26bf8 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TrafficManager.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-TrafficManager.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Traffic Manager to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Traffic Manager to stream to a Log Analytics workspace when any Traffic Manager which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Traffic Manager to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Traffic Manager to stream to a Log Analytics workspace when any Traffic Manager which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VM.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VM.json index fe19ea182..98b10facc 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VM.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VM.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Virtual Machines to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Virtual Machines to stream to a Log Analytics workspace when any Virtual Machines which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Virtual Machines to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Virtual Machines to stream to a Log Analytics workspace when any Virtual Machines which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VMSS.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VMSS.json index 3adea471a..dac3394e2 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VMSS.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VMSS.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Virtual Machine Scale Sets to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Virtual Machine Scale Sets to stream to a Log Analytics workspace when any Virtual Machine Scale Sets which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Virtual Machine Scale Sets to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Virtual Machine Scale Sets to stream to a Log Analytics workspace when any Virtual Machine Scale Sets which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VNetGW.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VNetGW.json index ac9bd97fa..98cbd291f 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VNetGW.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VNetGW.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for VPN Gateway to Log Analytics workspace", - "description": "Deploys the diagnostic settings for VPN Gateway to stream to a Log Analytics workspace when any VPN Gateway which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for VPN Gateway to Log Analytics workspace", + "description": "Deploys the diagnostic settings for VPN Gateway to stream to a Log Analytics workspace when any VPN Gateway which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.1", + "deprecated": true, + "version": "1.1.1-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VWanS2SVPNGW.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VWanS2SVPNGW.json index 6d51b7520..46db0f5f6 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VWanS2SVPNGW.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VWanS2SVPNGW.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for VWAN S2S VPN Gateway to Log Analytics workspace", - "description": "Deploys the diagnostic settings for VWAN S2S VPN Gateway to stream to a Log Analytics workspace when any VWAN S2S VPN Gateway which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for VWAN S2S VPN Gateway to Log Analytics workspace", + "description": "Deploys the diagnostic settings for VWAN S2S VPN Gateway to stream to a Log Analytics workspace when any VWAN S2S VPN Gateway which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.0.0", + "deprecated": true, + "version": "1.0.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VirtualNetwork.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VirtualNetwork.json index 9dbde3a3e..1add05f3d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VirtualNetwork.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-VirtualNetwork.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for Virtual Network to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Virtual Network to stream to a Log Analytics workspace when any Virtual Network which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for Virtual Network to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Virtual Network to stream to a Log Analytics workspace when any Virtual Network which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDAppGroup.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDAppGroup.json index 5db3014d0..29958cbcc 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDAppGroup.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDAppGroup.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for AVD Application group to Log Analytics workspace", - "description": "Deploys the diagnostic settings for AVD Application group to stream to a Log Analytics workspace when any application group which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all and categorys enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for AVD Application group to Log Analytics workspace", + "description": "Deploys the diagnostic settings for AVD Application group to stream to a Log Analytics workspace when any application group which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.1", + "deprecated": true, + "version": "1.1.1-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDHostPools.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDHostPools.json index 213d020c4..9f8d0e8a8 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDHostPools.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDHostPools.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for AVD Host Pools to Log Analytics workspace", - "description": "Deploys the diagnostic settings for AVD Host Pools to stream to a Log Analytics workspace when any Host Pools which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all and categorys enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for AVD Host Pools to Log Analytics workspace", + "description": "Deploys the diagnostic settings for AVD Host Pools to stream to a Log Analytics workspace when any Host Pools which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.3.0", + "deprecated": true, + "version": "1.3.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDWorkspace.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDWorkspace.json index 215102a42..072193393 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDWorkspace.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WVDWorkspace.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for AVD Workspace to Log Analytics workspace", - "description": "Deploys the diagnostic settings for AVD Workspace to stream to a Log Analytics workspace when any Workspace which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all and categorys enabled.", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for AVD Workspace to Log Analytics workspace", + "description": "Deploys the diagnostic settings for AVD Workspace to stream to a Log Analytics workspace when any Workspace which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.1", + "deprecated": true, + "version": "1.1.1-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WebServerFarm.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WebServerFarm.json index ba52b224c..e4fdf8e2f 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WebServerFarm.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-WebServerFarm.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for App Service Plan to Log Analytics workspace", - "description": "Deploys the diagnostic settings for App Service Plan to stream to a Log Analytics workspace when any App Service Plan which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for App Service Plan to Log Analytics workspace", + "description": "Deploys the diagnostic settings for App Service Plan to stream to a Log Analytics workspace when any App Service Plan which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Website.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Website.json index af682e66a..c31f9e38d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Website.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-Website.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for App Service to Log Analytics workspace", - "description": "Deploys the diagnostic settings for Web App to stream to a Log Analytics workspace when any Web App which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for App Service to Log Analytics workspace", + "description": "Deploys the diagnostic settings for Web App to stream to a Log Analytics workspace when any Web App which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.2.0", + "deprecated": true, + "version": "1.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-iotHub.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-iotHub.json index 2ab78fb4b..82aec5d9d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-iotHub.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Diagnostics-iotHub.json @@ -6,10 +6,11 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy Diagnostic Settings for IoT Hub to Log Analytics workspace", - "description": "Deploys the diagnostic settings for IoT Hub to stream to a Log Analytics workspace when any IoT Hub which is missing this diagnostic settings is created or updated. The Policy will set the diagnostic with all metrics and category enabled", + "displayName": "[Deprecated]: Deploy Diagnostic Settings for IoT Hub to Log Analytics workspace", + "description": "Deploys the diagnostic settings for IoT Hub to stream to a Log Analytics workspace when any IoT Hub which is missing this diagnostic settings is created or updated. This policy is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "1.1.0", + "deprecated": true, + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-LogicApp-TLS.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-LogicApp-TLS.json new file mode 100644 index 000000000..9c202975f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-LogicApp-TLS.json @@ -0,0 +1,95 @@ +{ + "name": "Deploy-LogicApp-TLS", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "Indexed", + "displayName": "Configure Logic apps to use the latest TLS version", + "description": "Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version.", + "metadata": { + "version": "1.0.0", + "category": "Logic Apps", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Web/sites" + }, + { + "field": "kind", + "contains": "workflowapp" + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Web/sites/config", + "name": "web", + "existenceCondition": { + "field": "Microsoft.Web/sites/config/minTlsVersion", + "equals": "1.2" + }, + "roleDefinitionIds": [ + "/providers/microsoft.authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772" + ], + "deployment": { + "properties": { + "mode": "incremental", + "parameters": { + "siteName": { + "value": "[field('name')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "siteName": { + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Web/sites/config", + "apiVersion": "2021-02-01", + "name": "[concat(parameters('siteName'), '/web')]", + "properties": { + "minTlsVersion": "1.2" + } + } + ], + "outputs": {} + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json index dd506c8a6..4b39f8dc4 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-SQL-DCR-Association.json @@ -6,12 +6,14 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Configure Arc-enabled SQL Servers with Data Collection Rule Association to Microsoft Defender for SQL user-defined DCR", - "description": "Configure association between Arc-enabled SQL Servers and the Microsoft Defender for SQL user-defined DCR. Deleting this association will break the detection of security vulnerabilities for this Arc-enabled SQL Servers.", + "displayName": "[Deprecated]: Configure Arc-enabled SQL Servers with DCR Association to Microsoft Defender for SQL user-defined DCR", + "description": "Policy is deprecated as the built-in policy now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/2227e1f1-23dd-4c3a-85a9-7024a401d8b2.html", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "2227e1f1-23dd-4c3a-85a9-7024a401d8b2", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json index c4aa4fdc9..4bf554007 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-Arc-Sql-DefenderSQL-DCR.json @@ -6,12 +6,14 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace", - "description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.", + "displayName": "[Deprecated]: Configure Arc-enabled SQL Servers to auto install Microsoft Defender for SQL and DCR with a user-defined LAW", + "description": "Policy is deprecated as the built-in policy now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/63d03cbd-47fd-4ee1-8a1c-9ddf07303de0.html", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "63d03cbd-47fd-4ee1-8a1c-9ddf07303de0", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json index fec449274..2b456fab0 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-AMA.json @@ -6,12 +6,14 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Configure SQL Virtual Machines to automatically install Azure Monitor Agent", - "description": "Automate the deployment of Azure Monitor Agent extension on your Windows SQL Virtual Machines. Learn more: https://aka.ms/AMAOverview.", + "displayName": "[Deprecated]: Configure SQL Virtual Machines to automatically install Azure Monitor Agent", + "description": "Policy is deprecated as the built-in policy now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/f91991d1-5383-4c95-8ee5-5ac423dd8bb1.html", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "f91991d1-5383-4c95-8ee5-5ac423dd8bb1", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json index b683aff53..6cd564908 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL-DCR.json @@ -6,12 +6,14 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace", - "description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.", + "displayName": "[Deprecated]: Configure SQL Virtual Machines to auto install Microsoft Defender for SQL and DCR with a user-defined LAW", + "description": "Policy is deprecated as the built-in policy now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/04754ef9-9ae3-4477-bf17-86ef50026304.html", "metadata": { - "version": "1.0.1", + "version": "1.0.1-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "04754ef9-9ae3-4477-bf17-86ef50026304", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json index 6ee701b64..b56e54526 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-MDFC-SQL-DefenderSQL.json @@ -6,12 +6,14 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL", - "description": "Configure Windows SQL Virtual Machines to automatically install the Microsoft Defender for SQL extension. Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations).", + "displayName": "[Deprecated]: Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL", + "description": "Policy is deprecated as the built-in policy now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/ddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce.html", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "ddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Private-DNS-Generic.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Private-DNS-Generic.json new file mode 100644 index 000000000..caf64db9f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-Private-DNS-Generic.json @@ -0,0 +1,154 @@ +{ + "name": "Deploy-Private-DNS-Generic", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Deploy-Private-DNS-Generic", + "description": "Configure private DNS zone group to override the DNS resolution for PaaS services private endpoint. See https://aka.ms/pepdnszones for information on values to provide to parameters in this policy.", + "metadata": { + "version": "1.0.0", + "category": "Networking", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "privateDnsZoneId": { + "type": "String", + "metadata": { + "displayName": "Private DNS Zone ID for Paas services", + "description": "The private DNS zone name required for specific Paas Services to resolve a private DNS Zone.", + "strongType": "Microsoft.Network/privateDnsZones", + "assignPermissions": true + } + }, + "resourceType": { + "type": "String", + "metadata": { + "displayName": "PaaS private endpoint resource type", + "description": "The PaaS endpoint resource type." + } + }, + "groupId": { + "type": "String", + "metadata": { + "displayName": "PaaS Private endpoint group ID (subresource)", + "description": "The group ID of the PaaS private endpoint. Also referred to as subresource." + } + }, + "evaluationDelay": { + "type": "String", + "metadata": { + "displayName": "Evaluation Delay", + "description": "The delay in evaluation of the policy. Review delay options at https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-deploy-if-not-exists" + }, + "defaultValue": "PT10M" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/privateEndpoints" + }, + { + "count": { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]", + "where": { + "allOf": [ + { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId", + "contains": "[parameters('resourceType')]" + }, + { + "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]", + "equals": "[parameters('groupId')]" + } + ] + } + }, + "greaterOrEquals": 1 + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "evaluationDelay": "[parameters('evaluationDelay')]", + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" + ], + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "privateDnsZoneId": { + "type": "string" + }, + "privateEndpointName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2020-03-01", + "location": "[parameters('location')]", + "properties": { + "privateDnsZoneConfigs": [ + { + "name": "PaaS-Service-Private-DNS-Zone-Config", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneId')]" + } + } + ] + } + } + ] + }, + "parameters": { + "privateDnsZoneId": { + "value": "[parameters('privateDnsZoneId')]" + }, + "privateEndpointName": { + "value": "[field('name')]" + }, + "location": { + "value": "[field('location')]" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json index 06d9b8e7d..c88be40b7 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Deploy-UserAssignedManagedIdentity-VMInsights.json @@ -6,12 +6,13 @@ "properties": { "policyType": "Custom", "mode": "Indexed", - "displayName": "Deploy User Assigned Managed Identity for VM Insights", - "description": "Create and assign a User Assigned Managed Identity to Virtual Machines for VM Insights", + "displayName": "[Deprecated]: Deploy User Assigned Managed Identity for VM Insights", + "description": "Policy is deprecated as it's no longer required. User-Assigned Management Identity is now centralized and deployed by Azure Landing Zones to the Management Subscription.", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "Managed Identity", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-NSG.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-NSG.json new file mode 100644 index 000000000..7591cf640 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-NSG.json @@ -0,0 +1,129 @@ +{ + "name": "Modify-NSG", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Enforce specific configuration of Network Security Groups (NSG)", + "description": "This policy enforces the configuration of Network Security Groups (NSG).", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Modify", + "Disabled" + ], + "defaultValue": "Modify", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "nsgRuleName": { + "type": "string", + "defaultValue": "DenyAnyInternetOutbound" + }, + "nsgRulePriority": { + "type": "integer", + "defaultValue": 1000 + }, + "nsgRuleDirection": { + "type": "string", + "allowedValues": [ + "Inbound", + "Outbound" + ], + "defaultValue": "Outbound" + }, + "nsgRuleAccess": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "defaultValue": "Deny" + }, + "nsgRuleProtocol": { + "type": "string", + "defaultValue": "*" + }, + "nsgRuleSourceAddressPrefix": { + "type": "string", + "defaultValue": "*" + }, + "nsgRuleSourcePortRange": { + "type": "string", + "defaultValue": "*" + }, + "nsgRuleDestinationAddressPrefix": { + "type": "string", + "defaultValue": "Internet" + }, + "nsgRuleDestinationPortRange": { + "type": "string", + "defaultValue": "*" + }, + "nsgRuleDescription": { + "type": "string", + "defaultValue": "Deny any outbound traffic to the Internet" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/networkSecurityGroups" + }, + { + "count": { + "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]" + }, + "equals": 0 + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "roleDefinitionIds": [ + "/providers/microsoft.authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" + ], + "conflictEffect": "audit", + "operations": [ + { + "operation": "add", + "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]", + "value": { + "name": "[parameters('nsgRuleName')]", + "properties": { + "description": "[parameters('nsgRuleDescription')]", + "protocol": "[parameters('nsgRuleProtocol')]", + "sourcePortRange": "[parameters('nsgRuleSourcePortRange')]", + "destinationPortRange": "[parameters('nsgRuleDestinationPortRange')]", + "sourceAddressPrefix": "[parameters('nsgRuleSourceAddressPrefix')]", + "destinationAddressPrefix": "[parameters('nsgRuleDestinationAddressPrefix')]", + "access": "[parameters('nsgRuleAccess')]", + "priority": "[parameters('nsgRulePriority')]", + "direction": "[parameters('nsgRuleDirection')]" + } + } + } + ] + } + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-UDR.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-UDR.json new file mode 100644 index 000000000..aeba9b862 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_definitions/policy_definition_es_Modify-UDR.json @@ -0,0 +1,103 @@ +{ + "name": "Modify-UDR", + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Enforce specific configuration of User-Defined Routes (UDR)", + "description": "This policy enforces the configuration of User-Defined Routes (UDR) within a subnet.", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "allowedValues": [ + "Modify", + "Disabled" + ], + "defaultValue": "Modify", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "addressPrefix": { + "type": "string", + "metadata": { + "description": "The destination IP address range in CIDR notation that this Policy checks for within the UDR. Example: 0.0.0.0/0 to check for the presence of a default route.", + "displayName": "Address Prefix" + } + }, + "nextHopType": { + "type": "string", + "metadata": { + "description": "The next hope type that the policy checks for within the inspected route. The value can be Virtual Network, Virtual Network Gateway, Internet, Virtual Appliance, or None.", + "displayName": "Next Hop Type" + }, + "allowedValues": [ + "VnetLocal", + "VirtualNetworkGateway", + "Internet", + "VirtualAppliance", + "None" + ] + }, + "nextHopIpAddress": { + "type": "string", + "metadata": { + "description": "The IP address packets should be forwarded to.", + "displayName": "Next Hop IP Address" + } + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Network/routeTables" + }, + { + "count": { + "field": "Microsoft.Network/routeTables/routes[*]" + }, + "equals": 0 + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "roleDefinitionIds": [ + "/providers/microsoft.authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" + ], + "conflictEffect": "audit", + "operations": [ + { + "operation": "add", + "field": "Microsoft.Network/routeTables/routes[*]", + "value": { + "name": "default", + "properties": { + "addressPrefix": "[parameters('addressPrefix')]", + "nextHopType": "[parameters('nextHopType')]", + "nextHopIpAddress": "[parameters('nextHopIpAddress')]" + } + } + } + ] + } + } + } + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt index bd8496804..f70087457 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/_policySetDefinitionsBicepInput.txt @@ -1,4 +1,22 @@ var varCustomPolicySetDefinitionsArray = [ + { + name: 'Audit-TrustedLaunch' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AuditDisksOsTrustedLaunch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b03bb370-5249-4ea4-9fce-2552e87e45fa' + definitionParameters: varPolicySetDefinitionEsAuditTrustedLaunchParameters.AuditDisksOsTrustedLaunch.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AuditTrustedLaunchEnabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c95b54ad-0614-4633-ab29-104b01235cbf' + definitionParameters: varPolicySetDefinitionEsAuditTrustedLaunchParameters.AuditTrustedLaunchEnabled.parameters + definitionGroups: [] + } + ] + } { name: 'Audit-UnusedResourcesCostOptimization' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.json') @@ -75,6 +93,12 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AseDenyPublicIP.parameters definitionGroups: [] } + { + definitionReferenceId: 'AsrVaultDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9ebbbba3-4d65-4da9-bb67-b22cfaaff090' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.AsrVaultDenyPublicIP.parameters + definitionGroups: [] + } { definitionReferenceId: 'AutomationDenyPublicIP' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/955a914f-bf86-4f0e-acd5-e0766b0efcb6' @@ -105,6 +129,144 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.CosmosDenyPaasPublicIP.parameters definitionGroups: [] } + { + definitionReferenceId: 'Deny-Adf-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1cf164be-6819-4a50-b8fa-4bcaa4f98fb6' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Adf-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/43bc7be6-5e69-4b0d-a2bb-e815557ca673' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ADX-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppSlots-Public' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/701a595d-38fb-4a66-ae6d-fb3735217622' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-AppSlots-Public'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Cognitive-Services-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0725b4dd-7e76-479c-a735-68e7ee23d5ca' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Cognitive-Services-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CognitiveSearch-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee980b6d-0eca-4501-8d54-f6290fd512c3' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-CognitiveSearch-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/783ea2a8-b8fd-46be-896a-9ae79643a0b1' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ContainerApps-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0602787f-9896-402a-a6e1-39ee63ee435e' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EH-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f8f774be-6aee-492a-9e29-486ef81f3a68' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EventGrid-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Topic-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1adadefe-5f21-44f7-b931-a59b54ccdb45' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-EventGrid-Topic-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Grafana-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e8775d5a-73b7-4977-a39b-833ef0114628' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Grafana-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Hostpool-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c25dcf31-878f-4eba-98eb-0818fdc6a334' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Hostpool-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-PublicNetwork' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/19ea9d63-adee-4431-a95e-1913c6c1c75f' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-KV-Hms-PublicNetwork'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-LogicApp-Public-Network-Access' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApp-Public-Network' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-LogicApp-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ManagedDisk-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8405fdab-1faf-48aa-b702-999c9c172094' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-ManagedDisk-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-MySql-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-MySql-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-PostgreSql-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-PostgreSql-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cbd11fd3-3002-4907-b6c8-579f0e700e13' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Sb-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Public-Endpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9dfea752-dd46-4766-aed1-c355fa93fb91' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Sql-Managed-Public-Endpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Public-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Storage-Public-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/38d8df46-cf4e-4073-8e03-48c24b29de0d' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Synapse-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Workspace-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/87ac3038-c07a-4b92-860d-29e270a4f3cd' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters['Deny-Workspace-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionAppSlotsDenyPublicIP' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/11c82d0c-db9f-4d7b-97c5-f3f9aa957da2' + definitionParameters: varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters.FunctionAppSlotsDenyPublicIP.parameters + definitionGroups: [] + } { definitionReferenceId: 'FunctionDenyPublicIP' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/969ac98b-88a8-449f-883c-2e9adb123127' @@ -635,6 +797,114 @@ var varCustomPolicySetDefinitionsArray = [ } ] } + { + name: 'Deploy-MDFC-Config_20240319' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'ascExport' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.ascExport.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'azurePolicyForKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.azurePolicyForKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForAppServices' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForAppServices.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForArm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForArm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforContainers' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderforContainers.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCosmosDbs' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82bf5b87-728b-4a74-ba4d-6123845cf542' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForCosmosDbs.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForCspm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/689f7782-ef2c-4270-a6d0-7664869076bd' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForCspm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForKeyVaults' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForKeyVaults.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderforKubernetes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/64def556-fbad-4622-930e-72d1d5589bf5' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderforKubernetes.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForOssDb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForOssDb.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlPaas' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForSqlPaas.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForSqlServerVirtualMachines' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForSqlServerVirtualMachines.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForStorageAccountsV2' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForStorageAccountsV2.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVM' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForVM.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'defenderForVMVulnerabilityAssessment' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.defenderForVMVulnerabilityAssessment.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'migrateToMdeTvm' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.migrateToMdeTvm.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'securityEmailContact' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts' + definitionParameters: varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters.securityEmailContact.parameters + definitionGroups: [] + } + ] + } { name: 'Deploy-MDFC-Config' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json') @@ -825,6 +1095,12 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-AppServices'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Arc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55c4db33-97b0-437b-8469-c4f4498f5df9' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Arc'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-Automation-DSCHybrid' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6dd01e4f-1be1-4e80-9d0b-d109e04cb064' @@ -843,6 +1119,12 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Batch'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-BotService' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6a4e6f44-f2af-4082-9702-033c9e88b9f8' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-BotService'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-CognitiveSearch' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fbc14a67-53e4-4932-abcc-2049c6706009' @@ -951,6 +1233,18 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoT'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoTCentral' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d627d7c6-ded5-481a-8f2e-7e16b1e6faf6' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTCentral'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-IoTDeviceupdate' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a222b93a-e6c2-4c01-817f-21e092455b2a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-IoTDeviceupdate'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-IoTHubs' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c99ce9c1-ced7-4c3e-aca0-10e69ce0cb02' @@ -969,6 +1263,12 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-MachineLearningWorkspace'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-ManagedGrafanaWorkspace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4c8537f8-cd1b-49ec-b704-18e82a42fd58' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-ManagedGrafanaWorkspace'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-MediaServices-Key' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b4a7f6c1-585e-4177-ad5b-c2c93f4bb991' @@ -1023,6 +1323,12 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Site-Recovery'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Site-Recovery-Backup' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/af783da1-4ad1-42be-800d-d19c70038820' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Site-Recovery-Backup'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Blob' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75973700-529f-4de2-b794-fb9b6781b6b0' @@ -1077,6 +1383,18 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-StaticWeb-Sec'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Table' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/028bbd88-e9b5-461f-9424-a1b63a7bee1a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Table'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-Storage-Table-Secondary' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c1d634a5-f73d-4cdd-889f-2cc7006eb47f' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Storage-Table-Secondary'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-Synapse-Dev' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e5ed725-f16c-478b-bd4b-7bfa2f7940b9' @@ -1095,6 +1413,18 @@ var varCustomPolicySetDefinitionsArray = [ definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-Synapse-SQL-OnDemand'].parameters definitionGroups: [] } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-VirtualDesktopHostpool' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9427df23-0f42-4e1e-bf99-a6133d841c4a' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-VirtualDesktopHostpool'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-Private-DNS-Azure-VirtualDesktopWorkspace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/34804460-d88b-4922-a7ca-537165e060ed' + definitionParameters: varPolicySetDefinitionEsDeployPrivateDNSZonesParameters['DINE-Private-DNS-Azure-VirtualDesktopWorkspace'].parameters + definitionGroups: [] + } { definitionReferenceId: 'DINE-Private-DNS-Azure-Web' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b026355-49cb-467b-8ac4-f777874e175a' @@ -1103,6 +1433,36 @@ var varCustomPolicySetDefinitionsArray = [ } ] } + { + name: 'Deploy-Sql-Security_20240529' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'SqlDbAuditingSettingsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-AuditingSettings' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbAuditingSettingsDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbSecurityAlertPoliciesDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-SecurityAlertPolicies' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbSecurityAlertPoliciesDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbTdeDeploySqlSecurity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbTdeDeploySqlSecurity.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SqlDbVulnerabilityAssessmentsDeploySqlSecurity' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-vulnerabilityAssessments_20230706' + definitionParameters: varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters.SqlDbVulnerabilityAssessmentsDeploySqlSecurity.parameters + definitionGroups: [] + } + ] + } { name: 'Deploy-Sql-Security' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json') @@ -1205,6 +1565,48 @@ var varCustomPolicySetDefinitionsArray = [ } ] } + { + name: 'Enforce-Backup' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'BackupBVault-Immutability' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2514263b-bc0d-4b06-ac3e-f262c0979018' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-Immutability'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupBVault-MUA' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c58e083e-7982-4e24-afdc-be14d312389e' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-MUA'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupBVault-SoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9798d31d-6028-4dee-8643-46102185c016' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupBVault-SoftDelete'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-Immutability' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d6f6f560-14b7-49a4-9fc8-d2c3a9807868' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-Immutability'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-MUA' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c7031eab-0fc0-4cd9-acd0-4497bd66d91a' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-MUA'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'BackupRVault-SoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/31b8092a-36b8-434b-9af7-5ec844364148' + definitionParameters: varPolicySetDefinitionEsEnforceBackupParameters['BackupRVault-SoftDelete'].parameters + definitionGroups: [] + } + ] + } { name: 'Enforce-Encryption-CMK' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json') @@ -1246,25 +1648,109 @@ var varCustomPolicySetDefinitionsArray = [ definitionGroups: [] } { - definitionReferenceId: 'EncryptedVMDisksEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.EncryptedVMDisksEffect.parameters + definitionReferenceId: 'Deny-Aa-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/56a5ee18-2ae6-4810-86f7-18e39ce5629b' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Aa-Cmk'].parameters definitionGroups: [] } { - definitionReferenceId: 'HealthcareAPIsCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.HealthcareAPIsCMKEffect.parameters + definitionReferenceId: 'Deny-Adf-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4ec52d6d-beb7-40c4-9a9e-fe753254690e' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Adf-Cmk'].parameters definitionGroups: [] } { - definitionReferenceId: 'MySQLCMKEffect' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83cef61d-dbd1-4b20-a4fc-5fbc7da10833' - definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.MySQLCMKEffect.parameters + definitionReferenceId: 'Deny-ADX-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/81e74cea-30fd-40d5-802f-d72103c2aaaa' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-ADX-Cmk'].parameters definitionGroups: [] } { - definitionReferenceId: 'PostgreSQLCMKEffect' + definitionReferenceId: 'Deny-Backup-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2e94d99a-8a36-4563-bc77-810d8893b671' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Backup-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CognitiveSearch-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/76a56461-9dc0-40f0-82f5-2453283afa2f' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-CognitiveSearch-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerInstance-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0aa61e00-0a01-4a3c-9945-e93cffedf0e6' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-ContainerInstance-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a1ad735a-e96f-45d2-a7b2-9a4932cab7ec' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-EH-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Premium-CMK' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-Premium-CMK' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-EH-Premium-CMK'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OsAndDataDisk-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/702dd420-7fcc-42c5-afe8-4026edd20fe0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-OsAndDataDisk-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/295fc8b1-dc9f-4f53-9c61-3f313ceab40a' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Sb-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac01ad65-10e5-46df-bdd9-6b0cad13e1d2' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Sql-Managed-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Encryption-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b5ec538c-daa0-4006-8596-35468b9148e8' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Encryption-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Queue-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e5abd0-2554-4736-b7c0-4ffef23475ef' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Queue-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Table-Cmk' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7c322315-e26d-4174-a99e-f49d351b4688' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters['Deny-Storage-Table-Cmk'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'EncryptedVMDisksEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.EncryptedVMDisksEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'HealthcareAPIsCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.HealthcareAPIsCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLCMKEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83cef61d-dbd1-4b20-a4fc-5fbc7da10833' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.MySQLCMKEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLCMKEffect' definitionId: '/providers/Microsoft.Authorization/policyDefinitions/18adea5e-f416-4d0f-8aa8-d24321e3e274' definitionParameters: varPolicySetDefinitionEsEnforceEncryptionCMKParameters.PostgreSQLCMKEffect.parameters definitionGroups: [] @@ -1301,6 +1787,240 @@ var varCustomPolicySetDefinitionsArray = [ } ] } + { + name: 'Enforce-EncryptTransit_20240509' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'AKSIngressHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AKSIngressHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'APIAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceApiApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.APIAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceHttpEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-httpsonly' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AppServiceHttpEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'AppServiceminTlsVersion' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.AppServiceminTlsVersion.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'ContainerAppsHttpsOnlyEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.ContainerAppsHttpsOnlyEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Apps-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a4af4a39-4135-47fb-b175-47fbdf85311d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Apps-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Slots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae1b9a8c-dfce-4605-bd91-69213b4a26fc' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Slots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d6545c6b-dd9d-4265-91e6-0b451e2f1c50' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-AppService-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-ContainerApps-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-minTLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-EH-minTLS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FuncAppSlots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e5dbe3f-2702-4ffc-8b1e-0cae008a5c71' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-FuncAppSlots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FunctionApp-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-FunctionApp-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-LogicApp-Without-Https' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApps-Without-Https' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-LogicApp-Without-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Db-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Sql-Db-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8793640-60f7-487c-b5c3-1d37215905c4' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Sql-Managed-Tls-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fe83a0eb-a853-422d-aac2-1bffd182c5d0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Storage-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cb3738a6-82a2-4a18-b87b-15217b9deff4' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-Synapse-Tls-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deploy-LogicApp-TLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-LogicApp-TLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deploy-LogicApp-TLS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-AppService-Apps-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae44c1d1-0df2-4ca9-98fa-a3d3ae5b409d' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-AppService-Apps-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-AppSlotTls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/014664e7-e348-41a3-aeb9-566e4ff6a9df' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['DINE-AppService-AppSlotTls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Function-Apps-Slots-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fa3a6357-c6d6-4120-8429-855577ec0063' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-Function-Apps-Slots-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-FunctionApp-Tls' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1f01f1c7-539c-49b5-9ef4-d4ffa37d22e0' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Dine-FunctionApp-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.FunctionLatestTlsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'FunctionServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceFunctionApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.FunctionServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.MySQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'MySQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MySql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.MySQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.PostgreSQLEnableSSLDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'PostgreSQLEnableSSLEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-PostgreSql-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.PostgreSQLEnableSSLEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisDenyhttps' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Redis-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisDenyhttps.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisdisableNonSslPort' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-disableNonSslPort' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisdisableNonSslPort.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'RedisTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.RedisTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLManagedInstanceTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLManagedInstanceTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLManagedInstanceTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSDeployEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLServerTLSDeployEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'SQLServerTLSEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.SQLServerTLSEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'StorageDeployHttpsEnabledEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.StorageDeployHttpsEnabledEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceHttpsEffect' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceWebApp-http' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.WebAppServiceHttpsEffect.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'WebAppServiceLatestTlsEffect' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b' + definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters.WebAppServiceLatestTlsEffect.parameters + definitionGroups: [] + } + ] + } { name: 'Enforce-EncryptTransit' libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json') @@ -1440,67 +2160,1431 @@ var varCustomPolicySetDefinitionsArray = [ ] } { - name: 'Enforce-Guardrails-KeyVault' - libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json') + name: 'Enforce-Guardrails-APIM' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.json') libSetChildDefinitions: [ { - definitionReferenceId: 'KvCertLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12ef42cb-9903-4e39-9c26-422d29570417' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvCertLifetime.parameters + definitionReferenceId: 'Deny-Api-subscription-scope' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3aa03346-d8c5-4994-a5bc-7652c2a2aef1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Api-subscription-scope'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvFirewallEnabled' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55615ac9-af46-4a59-874e-391cc3dfb490' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvFirewallEnabled.parameters + definitionReferenceId: 'Deny-Apim-Authn' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c15dcc82-b93c-4dcb-9332-fbf121685b54' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Authn'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvKeysExpire' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysExpire.parameters + definitionReferenceId: 'Deny-Apim-Cert-Validation' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/92bb331d-ac71-416a-8c91-02f2cb734ce4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Cert-Validation'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvKeysLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5ff38825-c5d8-47c5-b70e-069a21955146' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysLifetime.parameters + definitionReferenceId: 'Deny-Apim-Direct-Endpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b741306c-968e-4b67-b916-5675e5c709f4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Direct-Endpoint'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvPurgeProtection' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvPurgeProtection.parameters + definitionReferenceId: 'Deny-Apim-Protocols' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ee7495e7-3ba7-40b6-bfee-c29e22cc75d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Protocols'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvSecretsExpire' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsExpire.parameters + definitionReferenceId: 'Deny-Apim-Sku-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/73ef9241-5d81-4cd4-b483-8443d1730fe5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Sku-Vnet'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvSecretsLifetime' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0eb591a-5e70-4534-a8bf-04b9c489584a' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsLifetime.parameters + definitionReferenceId: 'Deny-APIM-TLS' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-APIM-TLS' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-APIM-TLS'].parameters definitionGroups: [] } { - definitionReferenceId: 'KvSoftDelete' - definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d' - definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSoftDelete.parameters + definitionReferenceId: 'Deny-Apim-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/549814b6-3212-4203-bdc8-1548d342fb67' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-without-Kv' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f1cc7827-022c-473e-836e-5a51cae0b249' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-without-Kv'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Apim-without-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Deny-Apim-without-Vnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Apim-Public-NetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7ca8c8ac-3a6e-493d-99ba-c5fa35347ff2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters['Dine-Apim-Public-NetworkAccess'].parameters definitionGroups: [] } ] } -] - - -// Policy Set/Initiative Definition Parameter Variables - -var varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.parameters.json') - -var varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json') + { + name: 'Enforce-Guardrails-AppServices' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-AppServ-FtpAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/572e342c-c920-4ef5-be2e-1ed3c6a51dc5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-FtpAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServ-Routing' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5747353b-1ca9-42c1-a4dd-b874b894f3d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-Routing'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServ-SkuPl' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/546fe8d2-368d-4029-a418-6af48a7f61e5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServ-SkuPl'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Byoc' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppService-without-BYOC' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Byoc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Latest-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/eb4d34ab-0929-491c-bbf3-61e13da19f9a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Latest-Version'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Rfc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f5c0bfb3-acea-47b1-b477-b0edcdf6edc1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Rfc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Slots-Remote-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cca5adfe-626b-4cc6-8522-f5b6ed2391bd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Slots-Remote-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppService-Vnet-Routing' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/801543d1-1953-4a90-b8b0-8cf6d41473a5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppService-Vnet-Routing'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppServiceApps-Rfc' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a691eacb-474d-47e4-b287-b4813ca44222' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Deny-AppServiceApps-Rfc'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-AppService-Apps-Remote-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Dine-AppService-Apps-Remote-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/25a5046c-c423-4805-9235-e844ae9ef49b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2c034a29-2a5f-4857-b120-f800fe5549ae' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-AppService-ScmAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5e97b776-f380-4722-a9a3-e7f0be029e79' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-AppService-ScmAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'DINE-FuncApp-Debugging' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/70adbb40-e092-42d5-a6f8-71c540a5efdb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['DINE-FuncApp-Debugging'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-App-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c6c3e00e-d414-4ca4-914f-406699bb8eee' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-App-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-Apps-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2374605e-3e0b-492b-9046-229af202562c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-Apps-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-AppService-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0f98368e-36bc-4716-8ac2-8f8067203b63' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-AppService-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Function-Apps-Slots-Https' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08cf2974-d178-48a0-b26d-f6b8e555748b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-Function-Apps-Slots-Https'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Function-Apps-Slots-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/242222f3-4985-4e99-b5ef-086d6a6cb01c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters['Modify-Function-Apps-Slots-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Automation' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aa-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dea83a72-443c-4292-83d5-54a2f98749c0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aa-Variables-Encrypt' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Aa-Variables-Encrypt'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Windows-Vm-HotPatch' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6d02d2f7-e38b-4bdc-96f3-adc0a8726abc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Deny-Windows-Vm-HotPatch'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Aa-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Modify-Aa-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Aa-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/23b36a7c-9d26-4288-a8fd-c1d2fa284d8c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters['Modify-Aa-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-CognitiveServices' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-CognitiveSearch-SKU' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a049bf77-880b-470f-ba6d-9f21c530cf83' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Deny-CognitiveSearch-SKU'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CongitiveSearch-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6300012e-e9a4-4649-b41f-a85f5c43be91' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Deny-CongitiveSearch-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Cognitive-Services-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/47ba1dd7-28d9-4b07-a8d5-9813bed64e0c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-Cognitive-Services-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CogntiveSearch-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4eb216f2-9dba-4979-86e6-5d7e63ce3b75' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-CogntiveSearch-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CogntiveSearch-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9cee519f-d9c1-4fd9-9f79-24ec3449ed30' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters['Modify-CogntiveSearch-PublicEndpoint'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Compute' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Disk-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ca91455f-eace-4f96-be59-e6e2c35b4816' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsComputeParameters['Deny-Disk-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-VmAndVmss-Encryption-Host' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsComputeParameters['Deny-VmAndVmss-Encryption-Host'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerApps' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerApp-Vnet-Injection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8b346db6-85af-419b-8557-92cee2c0f9bb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters['Deny-ContainerApp-Vnet-Injection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerApps-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters['Deny-ContainerApps-Managed-Identity'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerInstance' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerInstance-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8af8f826-edcb-4178-b35f-851ea6fea615' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerInstanceParameters['Deny-ContainerInstance-Vnet'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ContainerRegistry' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ContainerRegistry-Anonymous-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9f2dea28-e834-476c-99c5-3507b4728395' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Anonymous-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Arm-Audience' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/42781ec6-6127-4c30-bdfa-fb423a0047d3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Arm-Audience'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Exports' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/524b0254-c285-4903-bee6-bb8126cde579' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Exports'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dc921057-6b28-4fbe-9b83-f7bec05db6c2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Repo-Token' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ff05e24e-195c-447e-b322-5e90c9f9f366' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Repo-Token'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Sku-PrivateLink' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bd560fc0-3c69-498a-ae9f-aa8eb7de0e13' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Sku-PrivateLink'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ContainerRegistry-Unrestricted-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Deny-ContainerRegistry-Unrestricted-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Anonymous-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cced2946-b08a-44fe-9fd9-e4ed8a779897' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Anonymous-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Arm-Audience' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/785596ed-054f-41bc-aaec-7f3d0ba05725' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Arm-Audience'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/79fdfe03-ffcb-4e55-b4d0-b925b8241759' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a3701552-92ea-433e-9d17-33b7f1208fc9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ContainerRegistry-Repo-Token' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a9b426fe-8856-4945-8600-18c5dd1cca2a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters['Modify-ContainerRegistry-Repo-Token'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-CosmosDb' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Append-CosmosDb-Metadata' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4750c32b-89c0-46af-bfcb-2e4541a818d5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Append-CosmosDb-Metadata'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CosmosDb-Fw-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Deny-CosmosDb-Fw-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-CosmosDb-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5450f5bd-9c72-4390-a9c4-a7aba4edfdd2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Deny-CosmosDb-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-CosmosDb-Atp' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b5f04e03-92a3-4b09-9410-2cc5e5047656' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Dine-CosmosDb-Atp'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CosmosDb-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dc2d41d1-4ab1-4666-a3e1-3d51c43e0049' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Modify-CosmosDb-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-CosmosDb-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/da69ba51-aaf1-41e5-8651-607cd0b37088' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters['Modify-CosmosDb-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-DataExplorer' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ADX-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ec068d99-e9c7-401f-8cef-5bdde4e6ccf1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f4b53539-8df9-40e4-86c6-6b607703bd4e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ADX-Sku-without-PL-Support' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1fec9658-933f-4b3e-bc95-913ed22d012b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Deny-ADX-Sku-without-PL-Support'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ADX-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/7b32f193-cb28-4e15-9a98-b9556db0bafa' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters['Modify-ADX-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-DataFactory' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Adf-Git' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/77d40665-3120-4348-b539-3192ec808307' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Git'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Linked-Service-Key-Vault' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/127ef6d7-242f-43b3-9eef-947faf1725d0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Linked-Service-Key-Vault'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f78ccdb4-7bf4-4106-8647-270491d2978a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Adf-Sql-Integration' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0088bc63-6dee-4a9c-9d29-91cfdc848952' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Deny-Adf-Sql-Integration'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Adf-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/08b1442b-7789-4130-8506-4f99a97226a7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters['Modify-Adf-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-EventGrid' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-EventGrid-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8bfadddb-ee1c-4639-8911-a38cb8e0b3bd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Partner-Namespace-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8632b003-3545-4b29-85e6-b2b96773df1e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Partner-Namespace-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EventGrid-Topic-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ae9fb87f-8a17-4428-94a4-8135d431055c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Deny-EventGrid-Topic-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Domain-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8ac2748f-3bf1-4c02-a3b6-92ae68cf75b1' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Domain-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Domain-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/898e9824-104c-4965-8e0e-5197588fa5d4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Domain-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Partner-Namespace-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2dd0e8b9-4289-4bb0-b813-1883298e9924' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Partner-Namespace-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Topic-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1c8144d9-746a-4501-b08c-093c8d29ad04' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Topic-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EventGrid-Topic-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/36ea4b4b-0f7f-4a54-89fa-ab18f555a172' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters['Modify-EventGrid-Topic-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-EventHub' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-EH-Auth-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b278e460-7cfc-4451-8294-cccc40a940d7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Auth-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Double-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/836cd60e-87f3-4e6a-a27c-29d687f01a4c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Double-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-EH-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5d4e3c65-4873-47be-94f3-6f8b953a3598' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Deny-EH-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-EH-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/57f35901-8389-40bb-ac49-3ba4f86d889d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters['Modify-EH-Local-Auth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-KeyVault-Sup' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Modify-KV-Fw' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ac673a9a-f77d-4846-b2d8-a57f8e1c01dc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters['Modify-KV-Fw'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-KV-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/84d327c3-164a-4685-b453-900478614456' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters['Modify-KV-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-KeyVault' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/86810a98-8e91-4a44-8386-ec66d0de5d57' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Cert-Expiration-Within-Specific-Number-Days' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f772fb64-8e40-40ad-87bc-7706e1949427' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Cert-Expiration-Within-Specific-Number-Days'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Cert-Period' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0a075868-4c26-42ef-914c-5bc007359560' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Cert-Period'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Cryptographic-Type' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75c4f823-d65c-4f29-a733-01d0077fdbcb' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Cryptographic-Type'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Curve-Names' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ff25f3c8-b739-4538-9d07-3d6d25cfb255' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Curve-Names'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Elliptic-Curve' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bd78111f-4953-4367-9fd5-7e08808b54bf' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Elliptic-Curve'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-Key-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1d478a74-21ba-4b9f-9d8f-8e6fced0eec5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Hms-Key-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Hms-PurgeProtection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c39ba22d-4428-4149-b981-70acb31fc383' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Hms-PurgeProtection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Hsm-Curve-Names' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e58fd0c1-feac-4d12-92db-0a7e9421f53e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Hsm-Curve-Names'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Hsm-MinimumDays-Before-Expiration' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ad27588c-0198-4c84-81ef-08efd0274653' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Hsm-MinimumDays-Before-Expiration'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Integrated-Ca' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8e826246-c976-48f6-b03e-619bb92b3d82' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Integrated-Ca'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Key-Active' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c26e4b24-cf98-4c67-b48b-5a25c4c69eb9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Key-Active'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Key-Types' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1151cede-290b-4ba0-8b38-0ad145ac888f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Key-Types'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Keys-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/49a22571-d204-4c91-a7b6-09b1a586fbc9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Keys-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Non-Integrated-Ca' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a22f4a40-01d3-4c7d-8071-da157eeff341' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Non-Integrated-Ca'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-RSA-Keys-without-MinCertSize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cee51871-e572-4576-855c-047c820360f0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-RSA-Keys-without-MinCertSize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-RSA-Keys-without-MinKeySize' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/82067dbb-e53b-4e06-b631-546d197452d9' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-RSA-Keys-without-MinKeySize'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Secret-ActiveDays' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e8d99835-8a06-45ae-a8e0-87a91941ccfe' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Secret-ActiveDays'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Kv-Secret-Content-Type' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/75262d3e-ba4a-4f43-85f8-9f72c090e5e3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-Kv-Secret-Content-Type'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-Secrets-ValidityDays' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/342e8053-e12e-4c44-be01-c3c2f318400f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-Secrets-ValidityDays'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-KV-without-ArmRbac' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters['Deny-KV-without-ArmRbac'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvCertLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12ef42cb-9903-4e39-9c26-422d29570417' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvCertLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvFirewallEnabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/55615ac9-af46-4a59-874e-391cc3dfb490' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvFirewallEnabled.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvKeysExpire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysExpire.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvKeysLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5ff38825-c5d8-47c5-b70e-069a21955146' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvKeysLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvPurgeProtection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvPurgeProtection.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSecretsExpire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsExpire.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSecretsLifetime' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b0eb591a-5e70-4534-a8bf-04b9c489584a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSecretsLifetime.parameters + definitionGroups: [] + } + { + definitionReferenceId: 'KvSoftDelete' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters.KvSoftDelete.parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Kubernetes' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Aks-Allowed-Capabilities' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Allowed-Capabilities'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Cni' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/46238e2f-3f6f-4589-9f3f-77bed4116e67' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Cni'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Default-Namespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Default-Namespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Internal-Lb' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3fc4dc25-5baf-40d8-9b05-7fe74c1bc64e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Internal-Lb'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Kms' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/dbbdc317-9734-4dd8-9074-993b29c69008' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Kms'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/993c2fcd-2b29-49d2-9eb0-df2c3a730c32' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Naked-Pods' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/65280eef-c8b4-425e-9aec-af55e55bf581' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Naked-Pods'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Priv-Containers' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Priv-Containers'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Priv-Escalation' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Priv-Escalation'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Private-Cluster' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Private-Cluster'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-ReadinessOrLiveness-Probes' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/b1a9997f-2883-4f12-bdff-2280f99b5915' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-ReadinessOrLiveness-Probes'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Shared-Host-Process-Namespace' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Shared-Host-Process-Namespace'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Temp-Disk-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/41425d9f-d1a5-499a-9932-f8ed8453932c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Temp-Disk-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Aks-Windows-Container-Administrator' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5485eac0-7e8f-4964-998b-a44f4f0c1e75' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Deny-Aks-Windows-Container-Administrator'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Aks-Command-Invoke' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/1b708b0a-3380-40e9-8b79-821f9fa224cc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Dine-Aks-Command-Invoke'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Aks-Policy' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters['Dine-Aks-Policy'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-MachineLearning' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-ML-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ML-Outdated-Os' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f110a506-2dcb-422e-bcea-d533fc8c35e2' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-Outdated-Os'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-ML-User-Assigned-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5f0c7d88-c7de-45b8-ac49-db49e72eaa78' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Deny-ML-User-Assigned-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ML-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a6f9a2d0-cff7-4855-83ad-4cd750666512' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Modify-ML-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-ML-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a10ee784-7409-4941-b091-663697637c0f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters['Modify-ML-Public-Network-Access'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-MySQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-MySql-Infra-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3a58212a-c829-4f13-9872-6371df2fd0b4' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters['Deny-MySql-Infra-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-MySql-Adv-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/80ed5239-4122-41ed-b54a-6f1fa7552816' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters['Dine-MySql-Adv-Threat-Protection'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Network' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-AppGw-Without-Tls' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppGw-Without-Tls' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-AppGw-Without-Tls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-AppGw-Without-Waf' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-AppGw-Without-Waf'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-AllIDPSS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/610b6183-5f00-4d68-86d2-4ab4cb3a67a5' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-AllIDPSS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-EmpIDPSBypass' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/f516dc7a-4543-4d40-aad6-98f76a706b50' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-EmpIDPSBypass'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-TLS-AllApp' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a58ac66d-92cb-409c-94b8-8e48d7a96596' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-TLS-AllApp'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-FW-TLS-Inspection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/711c24bb-7f18-4578-b192-81a6161e1f17' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-FW-TLS-Inspection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Ip-Forwarding' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Ip-Forwarding'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Mgmt-From-Internet' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MgmtPorts-From-Internet' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Mgmt-From-Internet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Nsg-GW-subnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Nsg-GW-subnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-with-Service-Endpoints' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Service-Endpoints' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-with-Service-Endpoints'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-Without-NSG' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Nsg' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-NSG'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Subnet-Without-Udr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-Udr'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-vNic-Pip' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-vNic-Pip'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-VPN-AzureAD' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-VPN-AzureAD'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-Afd-Enabled' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-Afd-Enabled'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-AppGw-mode' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/12430be1-6cc8-4527-a9a8-e3d38f250096' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-AppGw-mode'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-Fw-rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/632d3993-e2c0-44ea-a7db-2eca131f356d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-Fw-rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-IDPS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6484db87-a62d-4327-9f07-80a2cbdf333a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-IDPS'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Waf-mode' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/425bea59-a659-4cbb-8d31-34499bd030b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Waf-mode'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Nsg' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-NSG' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-Nsg'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Udr' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-UDR' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-Udr'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-vNet-DDoS' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/94de2ad3-e0c1-4caf-ad78-5d47bbc83d3d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Modify-vNet-DDoS'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-OpenAI' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Cognitive-Services-Cust-Storage' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/46aa9b05-0e60-4eae-a88b-1e9d374fa515' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Cust-Storage'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Cognitive-Services-Managed-Identity' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/fe3fd216-4f83-4fc1-8984-2bbec80a3418' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-Cognitive-Services-Managed-Identity'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OpenAi-NetworkAcls' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-NetworkAcls' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-OpenAi-NetworkAcls'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-OpenAi-OutboundNetworkAccess' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-RestrictOutboundNetworkAccess' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Deny-OpenAi-OutboundNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Cognitive-Services-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters['Modify-Cognitive-Services-Local-Auth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-PostgreSQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Dine-PostgreSql-Adv-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/db048e65-913c-49f9-bb5f-1084184671d3' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsPostgreSQLParameters['Dine-PostgreSql-Adv-Threat-Protection'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-ServiceBus' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Sb-Authz-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a1817ec0-a368-432a-8057-8371e17ac6ee' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-Authz-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ebaf4f25-a4e8-415f-86a8-42d9155bef0b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sb-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/cfb11c26-f069-4c14-8e36-56c394dae5af' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Deny-Sb-LocalAuth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Sb-LocalAuth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/910711a6-8aa2-4f15-ae62-1e5b2ed3ef9e' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters['Modify-Sb-LocalAuth'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-SQL' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Sql-Aad-Only' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/abda6d70-9778-44e7-84a8-06713e6db027' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Deny-Sql-Aad-Only'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Sql-Managed-Aad-Only' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/78215662-041e-49ed-a9dd-5385911b3a1f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Deny-Sql-Managed-Aad-Only'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Sql-Adv-Data' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/6134c3db-786f-471e-87bc-8f479dc890f6' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Dine-Sql-Adv-Data'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Sql-Managed-Defender' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c5a62eb0-c65a-4220-8a4d-f70dd4ca95dd' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Dine-Sql-Managed-Defender'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Sql-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSQLParameters['Modify-Sql-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Storage' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Storage-Account-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Account-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Account-Keys-Expire' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/044985bb-afe1-42cd-8a36-9d5d42424537' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Account-Keys-Expire'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Classic' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/37e0d2fe-28a5-43d6-a273-67d37d1f5606' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Classic'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ContainerDeleteRetentionPolicy' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ContainerDeleteRetentionPolicy' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ContainerDeleteRetentionPolicy'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-CopyScope' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CopyScope' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-CopyScope'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-CorsRules' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CorsRules' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-CorsRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Cross-Tenant' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/92a89a79-6c52-4a7e-a03f-61306fc49312' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Cross-Tenant'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Infra-Encryption' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/4733ea7b-a883-42fe-8cac-97454c2a9e4a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Infra-Encryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-LocalUser' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-LocalUser' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-LocalUser'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkAclsBypass' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsBypass' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkAclsBypass'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkAclsVirtualNetworkRules' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsVirtualNetworkRules' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkAclsVirtualNetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-NetworkRules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2a1a9cdf-e04d-429a-8416-3bfb72a1b26f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-NetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ResourceAccessRulesResourceId' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesResourceId' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ResourceAccessRulesResourceId'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ResourceAccessRulesTenantId' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesTenantId' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ResourceAccessRulesTenantId'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Restrict-NetworkRules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Restrict-NetworkRules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-ServicesEncryption' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ServicesEncryption' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-ServicesEncryption'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-SFTP' + definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-SFTP'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Storage-Shared-Key' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Shared-Key'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Storage-Threat-Protection' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/361c2074-3595-4e5d-8cab-4f21dffc835c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Dine-Storage-Threat-Protection'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Blob-Storage-Account-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Blob-Storage-Account-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Storage-Account-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/a06d0189-92e8-4dba-b0c4-08d7669fce7d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Storage-Account-PublicEndpoint'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Storage-FileSync-PublicEndpoint' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/0e07b2e9-6cd9-4c40-9ccb-52817b95133b' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Modify-Storage-FileSync-PublicEndpoint'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-Synapse' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Deny-Synapse-Data-Traffic' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3484ce98-c0c5-4c83-994b-c5ac24785218' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Data-Traffic'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Fw-Rules' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/56fd377d-098c-4f02-8406-81eb055902b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Fw-Rules'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2158ddbe-fefa-408e-b43f-d4faef8ff3b8' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Managed-Vnet' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2d9dbfa3-927b-4cf0-9d0f-08747f971650' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Managed-Vnet'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Deny-Synapse-Tenant-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/3a003702-13d2-4679-941b-937e58c443f0' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Deny-Synapse-Tenant-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Dine-Synapse-Defender' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/951c1558-50a5-4ca3-abb6-a93e3e2367a6' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Dine-Synapse-Defender'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Local-Auth' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/c3624673-d2ff-48e0-b28c-5de1c6767c3c' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Local-Auth'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Public-Network-Access' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/5c8cad01-ef30-4891-b230-652dadb4876a' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Public-Network-Access'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Synapse-Tls-Version' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/8b5c654c-fb07-471b-aa8f-15fea733f140' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters['Modify-Synapse-Tls-Version'].parameters + definitionGroups: [] + } + ] + } + { + name: 'Enforce-Guardrails-VirtualDesktop' + libSetDefinition: loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.json') + libSetChildDefinitions: [ + { + definitionReferenceId: 'Modify-Hostpool-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/2a0913ff-51e7-47b8-97bb-ea17127f7c8d' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters['Modify-Hostpool-PublicNetworkAccess'].parameters + definitionGroups: [] + } + { + definitionReferenceId: 'Modify-Workspace-PublicNetworkAccess' + definitionId: '/providers/Microsoft.Authorization/policyDefinitions/ce6ebf1d-0b94-4df9-9257-d8cacc238b4f' + definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters['Modify-Workspace-PublicNetworkAccess'].parameters + definitionGroups: [] + } + ] + } +] + + +// Policy Set/Initiative Definition Parameter Variables + +var varPolicySetDefinitionEsAuditTrustedLaunchParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.parameters.json') + +var varPolicySetDefinitionEsAuditUnusedResourcesCostOptimizationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Audit-UnusedResourcesCostOptimization.parameters.json') + +var varPolicySetDefinitionEsDenyPublicPaaSEndpointsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json') var varPolicySetDefinitionEsDenyActionDeleteProtectionParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_DenyAction-DeleteProtection.parameters.json') @@ -1508,12 +3592,16 @@ var varPolicySetDefinitionEsDeployAUMCheckUpdatesParameters = loadJsonContent('l var varPolicySetDefinitionEsDeployDiagnosticsLogAnalyticsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.parameters.json') +var varPolicySetDefinitionEsDeployMDFCConfig_20240319Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.parameters.json') + var varPolicySetDefinitionEsDeployMDFCConfigParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.parameters.json') var varPolicySetDefinitionEsDeployMDFCDefenderSQLAMAParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.parameters.json') var varPolicySetDefinitionEsDeployPrivateDNSZonesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json') +var varPolicySetDefinitionEsDeploySqlSecurity_20240529Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.parameters.json') + var varPolicySetDefinitionEsDeploySqlSecurityParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.parameters.json') var varPolicySetDefinitionEsEnforceACSBParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ACSB.parameters.json') @@ -1522,9 +3610,63 @@ var varPolicySetDefinitionEsEnforceALZDecommParameters = loadJsonContent('lib/po var varPolicySetDefinitionEsEnforceALZSandboxParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-ALZ-Sandbox.parameters.json') +var varPolicySetDefinitionEsEnforceBackupParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.parameters.json') + var varPolicySetDefinitionEsEnforceEncryptionCMKParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json') +var varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.parameters.json') + var varPolicySetDefinitionEsEnforceEncryptTransitParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.parameters.json') +var varPolicySetDefinitionEsEnforceGuardrailsAPIMParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsAppServicesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsAutomationParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsCognitiveServicesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsComputeParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerAppsParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerInstanceParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsContainerRegistryParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsCosmosDbParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsDataExplorerParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsDataFactoryParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsEventGridParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsEventHubParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsKeyVaultSupParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.parameters.json') + var varPolicySetDefinitionEsEnforceGuardrailsKeyVaultParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json') +var varPolicySetDefinitionEsEnforceGuardrailsKubernetesParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsMachineLearningParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsMySQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsOpenAIParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsPostgreSQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsServiceBusParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsSQLParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsStorageParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsSynapseParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.parameters.json') + +var varPolicySetDefinitionEsEnforceGuardrailsVirtualDesktopParameters = loadJsonContent('lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.parameters.json') + diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.json new file mode 100644 index 000000000..09491dae7 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.json @@ -0,0 +1,58 @@ +{ + "name": "Audit-TrustedLaunch", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Audit virtual machines for Trusted Launch support", + "description": "Trusted Launch improves security of a Virtual Machine which requires VM SKU, OS Disk & OS Image to support it (Gen 2). To learn more about Trusted Launch, visit https://aka.ms/trustedlaunch.", + "metadata": { + "version": "1.0.0", + "category": "Trusted Launch", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + }, + "allowedValues": [ + "Audit", + "Disabled" + ], + "defaultValue": "Audit" + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "AuditDisksOsTrustedLaunch", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b03bb370-5249-4ea4-9fce-2552e87e45fa", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "AuditTrustedLaunchEnabled", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c95b54ad-0614-4633-ab29-104b01235cbf", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.parameters.json new file mode 100644 index 000000000..51de616da --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Audit-TrustedLaunch.parameters.json @@ -0,0 +1,16 @@ +{ + "AuditDisksOsTrustedLaunch": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "AuditTrustedLaunchEnabled": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json index fa63ce3a0..09a0d916e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.json @@ -8,7 +8,7 @@ "displayName": "Public network access should be disabled for PaaS services", "description": "This policy initiative is a group of policies that prevents creation of Azure PaaS services with exposed public endpoints", "metadata": { - "version": "3.2.0", + "version": "5.1.0", "category": "Network", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -20,7 +20,7 @@ "type": "String", "metadata": { "displayName": "Public network access should be disabled for CosmosDB", - "description": "This policy denies that Cosmos database accounts are created with out public network access is disabled." + "description": "This policy denies that Cosmos database accounts are created with out public network access is disabled." }, "allowedValues": [ "Audit", @@ -85,7 +85,7 @@ "type": "String", "metadata": { "displayName": "Public network access on Azure Container Registry disabled", - "description": "This policy denies the creation of Azure Container Registires with exposed public endpoints " + "description": "This policy denies the creation of Azure Container Registries with exposed public endpoints " }, "allowedValues": [ "Audit", @@ -111,7 +111,20 @@ "type": "String", "metadata": { "displayName": "Public network access should be disabled for PostgreSql Flexible Server", - "description": "This policy denies creation of Postgre SQL Flexible DB accounts with exposed public endpoints" + "description": "This policy denies creation of PostgreSQL Flexible DB accounts with exposed public endpoints" + }, + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "postgreSqlPublicNetworkAccess": { + "type": "string", + "metadata": { + "displayName": "Public network access should be disabled for PostgreSQL servers", + "description": "This policy denies creation of PostgreSQL DB accounts with exposed public endpoints" }, "allowedValues": [ "Audit", @@ -189,7 +202,7 @@ "type": "String", "metadata": { "displayName": "Public network access should be disabled for Bot Service", - "description": "This policy denies creation of Bot Service with exposed public endpoints. Bots should be seet to 'isolated only' mode" + "description": "This policy denies creation of Bot Service with exposed public endpoints. Bots should be set to 'isolated only' mode" }, "allowedValues": [ "Audit", @@ -202,7 +215,7 @@ "type": "String", "metadata": { "displayName": "Public network access should be disabled for Automation accounts", - "description": "This policy denies creation of Automation accounts with exposed public endpoints. Bots should be seet to 'isolated only' mode" + "description": "This policy denies creation of Automation accounts with exposed public endpoints. Bots should be set to 'isolated only' mode" }, "allowedValues": [ "Audit", @@ -237,6 +250,19 @@ ], "defaultValue": "Deny" }, + "FunctionAppSlotPublicIpDenyEffect": { + "type": "String", + "metadata": { + "displayName": "Public network access should be disabled for Function apps", + "description": "This policy denies creation of Function apps with exposed public endpoints" + }, + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, "AsePublicIpDenyEffect": { "type": "String", "metadata": { @@ -287,6 +313,207 @@ "Disabled" ], "defaultValue": "Deny" + }, + "AsrVaultDenyEffect": { + "type": "String", + "metadata": { + "displayName": "Azure Recovery Services vaults should disable public network access", + "description": "This policy denies creation of Azure Recovery Services vaults with exposed public endpoints" + }, + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "logicAppPublicNetworkAccessEffect": { + "type": "String", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "appSlotsPublicNetworkAccess": { + "type": "string", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "cognitiveSearchPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "managedDiskPublicNetworkAccess": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "containerAppsPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adxPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventGridPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventGridTopicPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventHubNamespacesPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultManagedHsmDisablePublicNetwork": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "mySqlPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "serviceBusDisablePublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "sqlManagedPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsPublicAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapsePublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "avdHostPoolPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "avdWorkspacePublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "grafanaPublicNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] } }, "policyDefinitions": [ @@ -370,6 +597,16 @@ }, "groupNames": [] }, + { + "policyDefinitionReferenceId": "Deny-PostgreSql-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c", + "parameters": { + "effect": { + "value": "[[parameters('postgreSqlPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, { "policyDefinitionReferenceId": "MySQLFlexDenyPublicIP", "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c9299215-ae47-4f50-9c54-8a392f68a052", @@ -460,6 +697,16 @@ }, "groupNames": [] }, + { + "policyDefinitionReferenceId": "FunctionAppSlotsDenyPublicIP", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/11c82d0c-db9f-4d7b-97c5-f3f9aa957da2", + "parameters": { + "effect": { + "value": "[[parameters('FunctionAppSlotPublicIpDenyEffect')]" + } + }, + "groupNames": [] + }, { "policyDefinitionReferenceId": "AseDenyPublicIP", "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2d048aca-6479-4923-88f5-e2ac295d9af3", @@ -499,6 +746,226 @@ } }, "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerApps-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/783ea2a8-b8fd-46be-896a-9ae79643a0b1", + "parameters": { + "effect": { + "value": "[[parameters('containerAppsPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "AsrVaultDenyPublicIP", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9ebbbba3-4d65-4da9-bb67-b22cfaaff090", + "parameters": { + "effect": { + "value": "[[parameters('AsrVaultDenyEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-LogicApp-Public-Network-Access", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApp-Public-Network", + "parameters": { + "effect": { + "value": "[[parameters('logicAppPublicNetworkAccessEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppSlots-Public", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/701a595d-38fb-4a66-ae6d-fb3735217622", + "parameters": { + "effect": { + "value": "[[parameters('appSlotsPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-CognitiveSearch-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ee980b6d-0eca-4501-8d54-f6290fd512c3", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ManagedDisk-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8405fdab-1faf-48aa-b702-999c9c172094", + "parameters": { + "effect": { + "value": "[[parameters('managedDiskPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ADX-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/43bc7be6-5e69-4b0d-a2bb-e815557ca673", + "parameters": { + "effect": { + "value": "[[parameters('adxPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Adf-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1cf164be-6819-4a50-b8fa-4bcaa4f98fb6", + "parameters": { + "effect": { + "value": "[[parameters('adfPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EventGrid-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f8f774be-6aee-492a-9e29-486ef81f3a68", + "parameters": { + "effect": { + "value": "[[parameters('eventGridPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EventGrid-Topic-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1adadefe-5f21-44f7-b931-a59b54ccdb45", + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0602787f-9896-402a-a6e1-39ee63ee435e", + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Hms-PublicNetwork", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/19ea9d63-adee-4431-a95e-1913c6c1c75f", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmDisablePublicNetwork')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-MySql-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095", + "parameters": { + "effect": { + "value": "[[parameters('mySqlPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Cognitive-Services-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0725b4dd-7e76-479c-a735-68e7ee23d5ca", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Cognitive-Services-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sb-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cbd11fd3-3002-4907-b6c8-579f0e700e13", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDisablePublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Managed-Public-Endpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9dfea752-dd46-4766-aed1-c355fa93fb91", + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Public-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsPublicAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/38d8df46-cf4e-4073-8e03-48c24b29de0d", + "parameters": { + "effect": { + "value": "[[parameters('synapsePublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Workspace-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/87ac3038-c07a-4b92-860d-29e270a4f3cd", + "parameters": { + "effect": { + "value": "[[parameters('avdWorkspacePublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Hostpool-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c25dcf31-878f-4eba-98eb-0818fdc6a334", + "parameters": { + "effect": { + "value": "[[parameters('avdHostPoolPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Grafana-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e8775d5a-73b7-4977-a39b-833ef0114628", + "parameters": { + "effect": { + "value": "[[parameters('grafanaPublicNetworkAccess')]" + } + }, + "groupNames": [] } ], "policyDefinitionGroups": null diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json index 19246f70b..cf93ab603 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deny-PublicPaaSEndpoints.parameters.json @@ -48,6 +48,13 @@ } } }, + "AsrVaultDenyPublicIP": { + "parameters": { + "effect": { + "value": "[[parameters('AsrVaultDenyEffect')]" + } + } + }, "AutomationDenyPublicIP": { "parameters": { "effect": { @@ -83,6 +90,167 @@ } } }, + "Deny-Adf-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('adfPublicNetworkAccess')]" + } + } + }, + "Deny-ADX-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('adxPublicNetworkAccess')]" + } + } + }, + "Deny-AppSlots-Public": { + "parameters": { + "effect": { + "value": "[[parameters('appSlotsPublicNetworkAccess')]" + } + } + }, + "Deny-Cognitive-Services-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesNetworkAccess')]" + } + } + }, + "Deny-Cognitive-Services-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesPublicNetworkAccess')]" + } + } + }, + "Deny-CognitiveSearch-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchPublicNetworkAccess')]" + } + } + }, + "Deny-ContainerApps-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('containerAppsPublicNetworkAccess')]" + } + } + }, + "Deny-EH-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesPublicNetworkAccess')]" + } + } + }, + "Deny-EventGrid-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridPublicNetworkAccess')]" + } + } + }, + "Deny-EventGrid-Topic-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicPublicNetworkAccess')]" + } + } + }, + "Deny-Grafana-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('grafanaPublicNetworkAccess')]" + } + } + }, + "Deny-Hostpool-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('avdHostPoolPublicNetworkAccess')]" + } + } + }, + "Deny-KV-Hms-PublicNetwork": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmDisablePublicNetwork')]" + } + } + }, + "Deny-LogicApp-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('logicAppPublicNetworkAccessEffect')]" + } + } + }, + "Deny-ManagedDisk-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('managedDiskPublicNetworkAccess')]" + } + } + }, + "Deny-MySql-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('mySqlPublicNetworkAccess')]" + } + } + }, + "Deny-PostgreSql-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('postgreSqlPublicNetworkAccess')]" + } + } + }, + "Deny-Sb-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDisablePublicNetworkAccess')]" + } + } + }, + "Deny-Sql-Managed-Public-Endpoint": { + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedPublicNetworkAccess')]" + } + } + }, + "Deny-Storage-Public-Access": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsPublicAccess')]" + } + } + }, + "Deny-Synapse-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('synapsePublicNetworkAccess')]" + } + } + }, + "Deny-Workspace-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('avdWorkspacePublicNetworkAccess')]" + } + } + }, + "FunctionAppSlotsDenyPublicIP": { + "parameters": { + "effect": { + "value": "[[parameters('FunctionAppSlotPublicIpDenyEffect')]" + } + } + }, "FunctionDenyPublicIP": { "parameters": { "effect": { diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json index 4a121b9c3..0fa287d91 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Diagnostics-LogAnalytics.json @@ -5,10 +5,11 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Deploy Diagnostic Settings to Azure Services", - "description": "This policy set deploys the configurations of application Azure resources to forward diagnostic logs and metrics to an Azure Log Analytics workspace. See the list of policies of the services that are included ", + "displayName": "[Deprecated]: Deploy Diagnostic Settings to Azure Services", + "description": "This policy set deploys the configurations of application Azure resources to forward diagnostic logs and metrics to an Azure Log Analytics workspace. This policy set is superseded by built-in initiative https://www.azadvertizer.net/azpolicyinitiativesadvertizer/0884adba-2312-4468-abeb-5422caed1038.html.", "metadata": { - "version": "2.2.0", + "deprecated": true, + "version": "2.2.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json index 222ad52d7..c880772c0 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config.json @@ -5,12 +5,14 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Deploy Microsoft Defender for Cloud configuration", - "description": "Deploy Microsoft Defender for Cloud configuration", + "displayName": "[Deprecated]: Deploy Microsoft Defender for Cloud configuration", + "description": "Deploy Microsoft Defender for Cloud configuration. Superseded by https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config_20240319.html", "metadata": { - "version": "7.0.0", + "version": "7.0.0-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "Deploy-MDFC-Config_20240319", "alzCloudEnvironments": [ "AzureCloud" ] diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.json new file mode 100644 index 000000000..ffe9b7f9d --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.json @@ -0,0 +1,404 @@ +{ + "name": "Deploy-MDFC-Config_20240319", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Deploy Microsoft Defender for Cloud configuration", + "description": "Deploy Microsoft Defender for Cloud configuration", + "metadata": { + "version": "1.0.0", + "category": "Security Center", + "source": "https://github.com/Azure/Enterprise-Scale/", + "replacesPolicy": "Deploy-MDFC-Config", + "alzCloudEnvironments": [ + "AzureCloud" + ] + }, + "parameters": { + "emailSecurityContact": { + "type": "string", + "metadata": { + "displayName": "Security contacts email address", + "description": "Provide email address for Microsoft Defender for Cloud contact details" + } + }, + "minimalSeverity": { + "type": "string", + "allowedValues": [ + "High", + "Medium", + "Low" + ], + "defaultValue": "High", + "metadata": { + "displayName": "Minimal severity", + "description": "Defines the minimal alert severity which will be sent as email notifications" + } + }, + "logAnalytics": { + "type": "String", + "metadata": { + "displayName": "Primary Log Analytics workspace", + "description": "Select Log Analytics workspace from dropdown list. If this workspace is outside of the scope of the assignment you must manually grant 'Log Analytics Contributor' permissions (or similar) to the policy assignment's principal ID.", + "strongType": "omsWorkspace" + } + }, + "ascExportResourceGroupName": { + "type": "String", + "metadata": { + "displayName": "Resource Group name for the export to Log Analytics workspace configuration", + "description": "The resource group name where the export to Log Analytics workspace configuration is created. If you enter a name for a resource group that doesn't exist, it'll be created in the subscription. Note that each resource group can only have one export to Log Analytics workspace configured." + } + }, + "ascExportResourceGroupLocation": { + "type": "String", + "metadata": { + "displayName": "Resource Group location for the export to Log Analytics workspace configuration", + "description": "The location where the resource group and the export to Log Analytics workspace configuration are created." + } + }, + "enableAscForCosmosDbs": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForSql": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForSqlOnVm": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForArm": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForOssDb": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForAppServices": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForKeyVault": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForStorage": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForContainers": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForServers": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "enableAscForServersVulnerabilityAssessments": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + }, + "vulnerabilityAssessmentProvider": { + "type": "String", + "allowedValues": [ + "default", + "mdeTvm" + ], + "defaultValue": "mdeTvm", + "metadata": { + "displayName": "Vulnerability assessment provider type", + "description": "Select the vulnerability assessment solution to provision to machines." + } + }, + "enableAscForCspm": { + "type": "String", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "defenderForOssDb", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForOssDb')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForVM", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForServers')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForVMVulnerabilityAssessment", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForServersVulnerabilityAssessments')]" + }, + "vaType": { + "value": "[[parameters('vulnerabilityAssessmentProvider')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForSqlServerVirtualMachines", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForSqlOnVm')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForAppServices", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForAppServices')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForStorageAccountsV2", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForStorage')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderforContainers", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderforKubernetes", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/64def556-fbad-4622-930e-72d1d5589bf5", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + }, + "logAnalyticsWorkspaceResourceId": { + "value": "[[parameters('logAnalytics')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "azurePolicyForKubernetes", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForKeyVaults", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForKeyVault')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForArm", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForArm')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForSqlPaas", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForSql')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForCosmosDbs", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/82bf5b87-728b-4a74-ba4d-6123845cf542", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForCosmosDbs')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "defenderForCspm", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/689f7782-ef2c-4270-a6d0-7664869076bd", + "parameters": { + "effect": { + "value": "[[parameters('enableAscForCspm')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "securityEmailContact", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts", + "parameters": { + "emailSecurityContact": { + "value": "[[parameters('emailSecurityContact')]" + }, + "minimalSeverity": { + "value": "[[parameters('minimalSeverity')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "ascExport", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9", + "parameters": { + "resourceGroupName": { + "value": "[[parameters('ascExportResourceGroupName')]" + }, + "resourceGroupLocation": { + "value": "[[parameters('ascExportResourceGroupLocation')]" + }, + "workspaceResourceId": { + "value": "[[parameters('logAnalytics')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "migrateToMdeTvm", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/766e621d-ba95-4e43-a6f2-e945db3d7888", + "parameters": {}, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.parameters.json new file mode 100644 index 000000000..5408895e1 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-Config_20240319.parameters.json @@ -0,0 +1,132 @@ +{ + "ascExport": { + "parameters": { + "resourceGroupName": { + "value": "[[parameters('ascExportResourceGroupName')]" + }, + "resourceGroupLocation": { + "value": "[[parameters('ascExportResourceGroupLocation')]" + }, + "workspaceResourceId": { + "value": "[[parameters('logAnalytics')]" + } + } + }, + "azurePolicyForKubernetes": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + } + } + }, + "defenderForAppServices": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForAppServices')]" + } + } + }, + "defenderForArm": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForArm')]" + } + } + }, + "defenderforContainers": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + } + } + }, + "defenderForCosmosDbs": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForCosmosDbs')]" + } + } + }, + "defenderForCspm": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForCspm')]" + } + } + }, + "defenderForKeyVaults": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForKeyVault')]" + } + } + }, + "defenderforKubernetes": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForContainers')]" + }, + "logAnalyticsWorkspaceResourceId": { + "value": "[[parameters('logAnalytics')]" + } + } + }, + "defenderForOssDb": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForOssDb')]" + } + } + }, + "defenderForSqlPaas": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForSql')]" + } + } + }, + "defenderForSqlServerVirtualMachines": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForSqlOnVm')]" + } + } + }, + "defenderForStorageAccountsV2": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForStorage')]" + } + } + }, + "defenderForVM": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForServers')]" + } + } + }, + "defenderForVMVulnerabilityAssessment": { + "parameters": { + "effect": { + "value": "[[parameters('enableAscForServersVulnerabilityAssessments')]" + }, + "vaType": { + "value": "[[parameters('vulnerabilityAssessmentProvider')]" + } + } + }, + "migrateToMdeTvm": { + "parameters": {} + }, + "securityEmailContact": { + "parameters": { + "emailSecurityContact": { + "value": "[[parameters('emailSecurityContact')]" + }, + "minimalSeverity": { + "value": "[[parameters('minimalSeverity')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json index 9b0d468bc..0ae5f70e5 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-MDFC-DefenderSQL-AMA.json @@ -5,12 +5,14 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace", - "description": "Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.", + "displayName": "[Deprecated]: Configure SQL VM and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LAW", + "description": "Initiative is deprecated as the built-in initiative now supports bringing your own UAMI and DCR. Superseded by https://www.azadvertizer.net/azpolicyinitiativesadvertizer/de01d381-bae9-4670-8870-786f89f49e26.html", "metadata": { - "version": "1.0.1", + "version": "1.0.1-deprecated", "category": "Security Center", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "de01d381-bae9-4670-8870-786f89f49e26", "alzCloudEnvironments": [ "AzureCloud" ] diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json index 1c664daf7..78db42184 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.json @@ -8,7 +8,7 @@ "displayName": "Configure Azure PaaS services to use private DNS zones", "description": "This policy initiative is a group of policies that ensures private endpoints to Azure PaaS services are integrated with Azure Private DNS zones", "metadata": { - "version": "2.1.2", + "version": "2.2.0", "category": "Network", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -466,6 +466,15 @@ "description": "Private DNS Zone Identifier" } }, + "azureMachineLearningWorkspaceSecondPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureMachineLearningWorkspaceSecondPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, "azureServiceBusNamespacePrivateDnsZoneId": { "type": "string", "defaultValue": "", @@ -484,6 +493,132 @@ "description": "Private DNS Zone Identifier" } }, + "azureBotServicePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureBotServicePrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureManagedGrafanaWorkspacePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureManagedGrafanaWorkspacePrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureVirtualDesktopHostpoolPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureVirtualDesktopHostpoolPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureVirtualDesktopWorkspacePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureVirtualDesktopWorkspacePrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureIotDeviceupdatePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureIotDeviceupdatePrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureArcGuestconfigurationPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureArcGuestconfigurationPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureArcHybridResourceProviderPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureArcHybridResourceProviderPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureArcKubernetesConfigurationPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureArcKubernetesConfigurationPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureIotCentralPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureIotCentralPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureStorageTablePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureStorageTablePrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureStorageTableSecondaryPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureStorageTableSecondaryPrivateDnsZoneId", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureSiteRecoveryBackupPrivateDnsZoneID": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureSiteRecoveryBackupPrivateDnsZoneID", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureSiteRecoveryBlobPrivateDnsZoneID": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureSiteRecoveryBlobPrivateDnsZoneID", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, + "azureSiteRecoveryQueuePrivateDnsZoneID": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "azureSiteRecoveryQueuePrivateDnsZoneID", + "strongType": "Microsoft.Network/privateDnsZones", + "description": "Private DNS Zone Identifier" + } + }, "effect": { "type": "string", "metadata": { @@ -1185,6 +1320,9 @@ "privateDnsZoneId": { "value": "[[parameters('azureMachineLearningWorkspacePrivateDnsZoneId')]" }, + "secondPrivateDnsZoneId": { + "value": "[[parameters('azureMachineLearningWorkspaceSecondPrivateDnsZoneId')]" + }, "effect": { "value": "[[parameters('effect')]" } @@ -1216,6 +1354,154 @@ } }, "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-BotService", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6a4e6f44-f2af-4082-9702-033c9e88b9f8", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureBotServicePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-ManagedGrafanaWorkspace", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4c8537f8-cd1b-49ec-b704-18e82a42fd58", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureManagedGrafanaWorkspacePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-VirtualDesktopHostpool", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9427df23-0f42-4e1e-bf99-a6133d841c4a", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureVirtualDesktopHostpoolPrivateDnsZoneId')]" + }, + "privateEndpointGroupId": { + "value": "connection" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-VirtualDesktopWorkspace", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34804460-d88b-4922-a7ca-537165e060ed", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureVirtualDesktopWorkspacePrivateDnsZoneId')]" + }, + "privateEndpointGroupId": { + "value": "feed" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-IoTDeviceupdate", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a222b93a-e6c2-4c01-817f-21e092455b2a", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureIotDeviceupdatePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Arc", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/55c4db33-97b0-437b-8469-c4f4498f5df9", + "parameters": { + "privateDnsZoneIdForGuestConfiguration": { + "value": "[[parameters('azureArcGuestconfigurationPrivateDnsZoneId')]" + }, + "privateDnsZoneIdForHybridResourceProvider": { + "value": "[[parameters('azureArcHybridResourceProviderPrivateDnsZoneId')]" + }, + "privateDnsZoneIdForKubernetesConfiguration": { + "value": "[[parameters('azureArcKubernetesConfigurationPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-IoTCentral", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d627d7c6-ded5-481a-8f2e-7e16b1e6faf6", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureIotCentralPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Storage-Table", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/028bbd88-e9b5-461f-9424-a1b63a7bee1a", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureStorageTablePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Storage-Table-Secondary", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c1d634a5-f73d-4cdd-889f-2cc7006eb47f", + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureStorageTableSecondaryPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-Private-DNS-Azure-Site-Recovery-Backup", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af783da1-4ad1-42be-800d-d19c70038820", + "parameters": { + "privateDnsZone-Backup": { + "value": "[[parameters('azureSiteRecoveryBackupPrivateDnsZoneID')]" + }, + "privateDnsZone-Blob": { + "value": "[[parameters('azureSiteRecoveryBlobPrivateDnsZoneID')]" + }, + "privateDnsZone-Queue": { + "value": "[[parameters('azureSiteRecoveryQueuePrivateDnsZoneID')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] } ], "policyDefinitionGroups": null diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json index 2224284fb..e63e3e07e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Private-DNS-Zones.parameters.json @@ -29,6 +29,22 @@ } } }, + "DINE-Private-DNS-Azure-Arc": { + "parameters": { + "privateDnsZoneIdForGuestConfiguration": { + "value": "[[parameters('azureArcGuestconfigurationPrivateDnsZoneId')]" + }, + "privateDnsZoneIdForHybridResourceProvider": { + "value": "[[parameters('azureArcHybridResourceProviderPrivateDnsZoneId')]" + }, + "privateDnsZoneIdForKubernetesConfiguration": { + "value": "[[parameters('azureArcKubernetesConfigurationPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-Automation-DSCHybrid": { "parameters": { "privateDnsZoneId": { @@ -65,6 +81,16 @@ } } }, + "DINE-Private-DNS-Azure-BotService": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureBotServicePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-CognitiveSearch": { "parameters": { "privateDnsZoneId": { @@ -279,6 +305,26 @@ } } }, + "DINE-Private-DNS-Azure-IoTCentral": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureIotCentralPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "DINE-Private-DNS-Azure-IoTDeviceupdate": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureIotDeviceupdatePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-IoTHubs": { "parameters": { "privateDnsZoneId": { @@ -304,6 +350,19 @@ "privateDnsZoneId": { "value": "[[parameters('azureMachineLearningWorkspacePrivateDnsZoneId')]" }, + "secondPrivateDnsZoneId": { + "value": "[[parameters('azureMachineLearningWorkspaceSecondPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "DINE-Private-DNS-Azure-ManagedGrafanaWorkspace": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureManagedGrafanaWorkspacePrivateDnsZoneId')]" + }, "effect": { "value": "[[parameters('effect')]" } @@ -420,6 +479,22 @@ } } }, + "DINE-Private-DNS-Azure-Site-Recovery-Backup": { + "parameters": { + "privateDnsZone-Backup": { + "value": "[[parameters('azureSiteRecoveryBackupPrivateDnsZoneID')]" + }, + "privateDnsZone-Blob": { + "value": "[[parameters('azureSiteRecoveryBlobPrivateDnsZoneID')]" + }, + "privateDnsZone-Queue": { + "value": "[[parameters('azureSiteRecoveryQueuePrivateDnsZoneID')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-Storage-Blob": { "parameters": { "privateDnsZoneId": { @@ -510,6 +585,26 @@ } } }, + "DINE-Private-DNS-Azure-Storage-Table": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureStorageTablePrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "DINE-Private-DNS-Azure-Storage-Table-Secondary": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureStorageTableSecondaryPrivateDnsZoneId')]" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-Synapse-Dev": { "parameters": { "privateDnsZoneId": { @@ -549,6 +644,32 @@ } } }, + "DINE-Private-DNS-Azure-VirtualDesktopHostpool": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureVirtualDesktopHostpoolPrivateDnsZoneId')]" + }, + "privateEndpointGroupId": { + "value": "connection" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "DINE-Private-DNS-Azure-VirtualDesktopWorkspace": { + "parameters": { + "privateDnsZoneId": { + "value": "[[parameters('azureVirtualDesktopWorkspacePrivateDnsZoneId')]" + }, + "privateEndpointGroupId": { + "value": "feed" + }, + "effect": { + "value": "[[parameters('effect')]" + } + } + }, "DINE-Private-DNS-Azure-Web": { "parameters": { "privateDnsZoneId": { diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json index 5f45bbeb9..295bdc686 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security.json @@ -5,12 +5,14 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Deploy SQL Database built-in SQL security configuration", - "description": "Deploy auditing, Alert, TDE and SQL vulnerability to SQL Databases when it not exist in the deployment", + "displayName": "[Deprecated]: Deploy SQL Database built-in SQL security configuration", + "description": "Deploy auditing, Alert, TDE and SQL vulnerability to SQL Databases when it not exist in the deployment. Superseded by https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-Sql-Security_20240529.html", "metadata": { - "version": "1.0.0", + "version": "1.0.0-deprecated", "category": "SQL", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "Deploy-Sql-Security_20240529", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.json new file mode 100644 index 000000000..c215cb374 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.json @@ -0,0 +1,135 @@ +{ + "name": "Deploy-Sql-Security_20240529", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Deploy SQL Database built-in SQL security configuration", + "description": "Deploy auditing, Alert, TDE and SQL vulnerability to SQL Databases when it not exist in the deployment", + "metadata": { + "version": "1.0.0", + "category": "SQL", + "source": "https://github.com/Azure/Enterprise-Scale/", + "replacesPolicy": "Deploy-Sql-Security", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "vulnerabilityAssessmentsEmail": { + "metadata": { + "description": "The email address to send alerts", + "displayName": "The email address to send alerts" + }, + "type": "Array" + }, + "vulnerabilityAssessmentsStorageID": { + "metadata": { + "description": "The storage account ID to store assessments", + "displayName": "The storage account ID to store assessments" + }, + "type": "String" + }, + "SqlDbTdeDeploySqlSecurityEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Deploy SQL Database Transparent Data Encryption ", + "description": "Deploy the Transparent Data Encryption when it is not enabled in the deployment" + } + }, + "SqlDbSecurityAlertPoliciesDeploySqlSecurityEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Deploy SQL Database security Alert Policies configuration with email admin accounts", + "description": "Deploy the security Alert Policies configuration with email admin accounts when it not exist in current configuration" + } + }, + "SqlDbAuditingSettingsDeploySqlSecurityEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Deploy SQL database auditing settings", + "description": "Deploy auditing settings to SQL Database when it not exist in the deployment" + } + }, + "SqlDbVulnerabilityAssessmentsDeploySqlSecurityEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Deploy SQL Database vulnerability Assessments", + "description": "Deploy SQL Database vulnerability Assessments when it not exist in the deployment. To the specific storage account in the parameters" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "SqlDbTdeDeploySqlSecurity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f", + "parameters": { + "effect": { + "value": "[[parameters('SqlDbTdeDeploySqlSecurityEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SqlDbSecurityAlertPoliciesDeploySqlSecurity", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-SecurityAlertPolicies", + "parameters": { + "effect": { + "value": "[[parameters('SqlDbSecurityAlertPoliciesDeploySqlSecurityEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SqlDbAuditingSettingsDeploySqlSecurity", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-AuditingSettings", + "parameters": { + "effect": { + "value": "[[parameters('SqlDbAuditingSettingsDeploySqlSecurityEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SqlDbVulnerabilityAssessmentsDeploySqlSecurity", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Sql-vulnerabilityAssessments_20230706", + "parameters": { + "effect": { + "value": "[[parameters('SqlDbVulnerabilityAssessmentsDeploySqlSecurityEffect')]" + }, + "vulnerabilityAssessmentsEmail": { + "value": "[[parameters('vulnerabilityAssessmentsEmail')]" + }, + "vulnerabilityAssessmentsStorageID": { + "value": "[[parameters('vulnerabilityAssessmentsStorageID')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.parameters.json new file mode 100644 index 000000000..d954e7bce --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Deploy-Sql-Security_20240529.parameters.json @@ -0,0 +1,36 @@ +{ + "SqlDbAuditingSettingsDeploySqlSecurity": { + "parameters": { + "effect": { + "value": "[[parameters('SqlDbAuditingSettingsDeploySqlSecurityEffect')]" + } + } + }, + "SqlDbSecurityAlertPoliciesDeploySqlSecurity": { + "parameters": { + "effect": { + "value": "[[parameters('SqlDbSecurityAlertPoliciesDeploySqlSecurityEffect')]" + } + } + }, + "SqlDbTdeDeploySqlSecurity": { + "parameters": { + "effect": { + "value": "[[parameters('SqlDbTdeDeploySqlSecurityEffect')]" + } + } + }, + "SqlDbVulnerabilityAssessmentsDeploySqlSecurity": { + "parameters": { + "effect": { + "value": "[[parameters('SqlDbVulnerabilityAssessmentsDeploySqlSecurityEffect')]" + }, + "vulnerabilityAssessmentsEmail": { + "value": "[[parameters('vulnerabilityAssessmentsEmail')]" + }, + "vulnerabilityAssessmentsStorageID": { + "value": "[[parameters('vulnerabilityAssessmentsStorageID')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.json new file mode 100644 index 000000000..926070f11 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.json @@ -0,0 +1,134 @@ +{ + "name": "Enforce-Backup", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce enhanced recovery and backup policies", + "description": "Enforce enhanced recovery and backup policies on assigned scopes.", + "metadata": { + "version": "1.0.0", + "category": "Backup", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Enable or disable the execution of the policy." + }, + "allowedValues": [ + "Audit", + "Disabled" + ], + "defaultValue": "Audit" + }, + "checkLockedImmutabilityOnly": { + "type": "Boolean", + "metadata": { + "displayName": "checkLockedImmutabilityOnly", + "description": "This parameter checks if Immutability is locked for Backup Vaults in scope. Selecting 'true' will mark only vaults with Immutability 'Locked' as compliant. Selecting 'false' will mark vaults that have Immutability either 'Enabled' or 'Locked' as compliant." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + }, + "checkAlwaysOnSoftDeleteOnly": { + "type": "Boolean", + "metadata": { + "displayName": "CheckAlwaysOnSoftDeleteOnly", + "description": "This parameter checks if Soft Delete is 'Locked' for Backup Vaults in scope. Selecting 'true' will mark only vaults with Soft Delete 'AlwaysOn' as compliant. Selecting 'false' will mark vaults that have Soft Delete either 'On' or 'AlwaysOn' as compliant." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "BackupBVault-Immutability", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2514263b-bc0d-4b06-ac3e-f262c0979018", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "CheckLockedImmutabiltyOnly": { + "value": "[[parameters('checkLockedImmutabilityOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "BackupRVault-Immutability", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d6f6f560-14b7-49a4-9fc8-d2c3a9807868", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkLockedImmutabilityOnly": { + "value": "[[parameters('checkLockedImmutabilityOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "BackupBVault-SoftDelete", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9798d31d-6028-4dee-8643-46102185c016", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkAlwaysOnSoftDeleteOnly": { + "value": "[[parameters('checkAlwaysOnSoftDeleteOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "BackupRVault-SoftDelete", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/31b8092a-36b8-434b-9af7-5ec844364148", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkAlwaysOnSoftDeleteOnly": { + "value": "[[parameters('checkAlwaysOnSoftDeleteOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "BackupBVault-MUA", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c58e083e-7982-4e24-afdc-be14d312389e", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "BackupRVault-MUA", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c7031eab-0fc0-4cd9-acd0-4497bd66d91a", + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.parameters.json new file mode 100644 index 000000000..309234ee1 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Backup.parameters.json @@ -0,0 +1,56 @@ +{ + "BackupBVault-Immutability": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "CheckLockedImmutabiltyOnly": { + "value": "[[parameters('checkLockedImmutabilityOnly')]" + } + } + }, + "BackupBVault-MUA": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "BackupBVault-SoftDelete": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkAlwaysOnSoftDeleteOnly": { + "value": "[[parameters('checkAlwaysOnSoftDeleteOnly')]" + } + } + }, + "BackupRVault-Immutability": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkLockedImmutabilityOnly": { + "value": "[[parameters('checkLockedImmutabilityOnly')]" + } + } + }, + "BackupRVault-MUA": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + } + } + }, + "BackupRVault-SoftDelete": { + "parameters": { + "effect": { + "value": "[[parameters('effect')]" + }, + "checkAlwaysOnSoftDeleteOnly": { + "value": "[[parameters('checkAlwaysOnSoftDeleteOnly')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json index 4b9f1d58a..12f0f0d97 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit.json @@ -5,12 +5,14 @@ "scope": null, "properties": { "policyType": "Custom", - "displayName": "Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit", - "description": "Choose either Deploy if not exist and append in combination with audit or Select Deny in the Policy effect. Deny polices shift left. Deploy if not exist and append enforce but can be changed, and because missing existence condition require then the combination of Audit. ", + "displayName": "[Deprecated]: Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit", + "description": "Choose either Deploy if not exist and append in combination with audit or Select Deny in the Policy effect. Superseded by https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-EncryptTransit_20240509.html", "metadata": { - "version": "2.1.0", + "version": "2.1.0-deprecated", "category": "Encryption", "source": "https://github.com/Azure/Enterprise-Scale/", + "deprecated": true, + "supersededBy": "Enforce-EncryptTransit_20240509", "alzCloudEnvironments": [ "AzureCloud", "AzureChinaCloud", diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.json new file mode 100644 index 000000000..1b70b98b9 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.json @@ -0,0 +1,937 @@ +{ + "name": "Enforce-EncryptTransit_20240509", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit", + "description": "Choose either Deploy if not exist and append in combination with audit or Select Deny in the Policy effect. Deny polices shift left. Deploy if not exist and append enforce but can be changed, and because missing existence condition require then the combination of Audit. ", + "metadata": { + "version": "1.0.0", + "category": "Encryption", + "source": "https://github.com/Azure/Enterprise-Scale/", + "replacesPolicy": "Enforce-EncryptTransit", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "AppServiceHttpEffect": { + "type": "String", + "defaultValue": "Append", + "allowedValues": [ + "Append", + "Disabled" + ], + "metadata": { + "displayName": "App Service. Appends the AppService sites config WebApp, APIApp, Function App with TLS version selected below", + "description": "Append the AppService sites object to ensure that min Tls version is set to required TLS version. Please note Append does not enforce compliance use then deny." + } + }, + "AppServiceTlsVersionEffect": { + "type": "String", + "defaultValue": "Append", + "allowedValues": [ + "Append", + "Disabled" + ], + "metadata": { + "displayName": "App Service. Appends the AppService WebApp, APIApp, Function App to enable https only", + "description": "App Service. Appends the AppService sites object to ensure that HTTPS only is enabled for server/service authentication and protects data in transit from network layer eavesdropping attacks. Please note Append does not enforce compliance use then deny." + } + }, + "AppServiceminTlsVersion": { + "type": "String", + "defaultValue": "1.2", + "allowedValues": [ + "1.2", + "1.0", + "1.1" + ], + "metadata": { + "displayName": "App Service. Select version minimum TLS Web App config", + "description": "App Service. Select version minimum TLS version for a Web App config to enforce" + } + }, + "APIAppServiceHttpsEffect": { + "metadata": { + "displayName": "App Service API App. API App should only be accessible over HTTPS. Choose Deny or Audit in combination with Append policy.", + "description": "Choose Deny or Audit in combination with Append policy. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "FunctionLatestTlsEffect": { + "metadata": { + "displayName": "App Service Function App. Latest TLS version should be used in your Function App", + "description": "Only Audit, deny not possible as it is a related resource. Upgrade to the latest TLS version." + }, + "type": "String", + "defaultValue": "AuditIfNotExists", + "allowedValues": [ + "AuditIfNotExists", + "Disabled" + ] + }, + "FunctionServiceHttpsEffect": { + "metadata": { + "displayName": "App Service Function App. Function App should only be accessible over HTTPS. Choose Deny or Audit in combination with Append policy.", + "description": "App Service Function App. Choose Deny or Audit in combination with Append policy. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "FunctionAppTlsEffect": { + "metadata": { + "displayName": "App Service Function App. Configure Function apps to use the latest TLS version.", + "description": "App Service Function App. Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version." + }, + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "LogicAppTlsEffect": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "WebAppServiceLatestTlsEffect": { + "metadata": { + "displayName": "App Service Web App. Latest TLS version should be used in your Web App", + "description": "Only Audit, deny not possible as it is a related resource. Upgrade to the latest TLS version." + }, + "type": "String", + "defaultValue": "AuditIfNotExists", + "allowedValues": [ + "AuditIfNotExists", + "Disabled" + ] + }, + "WebAppServiceHttpsEffect": { + "metadata": { + "displayName": "App Service Web App. Web Application should only be accessible over HTTPS. Choose Deny or Audit in combination with Append policy.", + "description": "Choose Deny or Audit in combination with Append policy. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "AKSIngressHttpsOnlyEffect": { + "metadata": { + "displayName": "AKS Service. Enforce HTTPS ingress in Kubernetes cluster", + "description": "This policy enforces HTTPS ingress in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc." + }, + "type": "String", + "defaultValue": "deny", + "allowedValues": [ + "audit", + "deny", + "disabled" + ] + }, + "MySQLEnableSSLDeployEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "MySQL database servers. Deploy if not exist set minimum TLS version Azure Database for MySQL server", + "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for MySQL server. Enforce the Server to client applications using minimum version of Tls to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + } + }, + "MySQLEnableSSLEffect": { + "metadata": { + "displayName": "MySQL database servers. Enforce SSL connection should be enabled for MySQL database servers", + "description": "Azure Database for MySQL supports connecting your Azure Database for MySQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "MySQLminimalTlsVersion": { + "type": "String", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2", + "TLS1_0", + "TLS1_1", + "TLSEnforcementDisabled" + ], + "metadata": { + "displayName": "MySQL database servers. Select version minimum TLS for MySQL server", + "description": "Select version minimum TLS version Azure Database for MySQL server to enforce" + } + }, + "PostgreSQLEnableSSLDeployEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "PostgreSQL database servers. Deploy if not exist set minimum TLS version Azure Database for PostgreSQL server", + "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Database for PostgreSQL server. Enforce the Server to client applications using minimum version of Tls to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + } + }, + "PostgreSQLEnableSSLEffect": { + "metadata": { + "displayName": "PostgreSQL database servers. Enforce SSL connection should be enabled for PostgreSQL database servers", + "description": "Azure Database for PostgreSQL supports connecting your Azure Database for PostgreSQL server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "PostgreSQLminimalTlsVersion": { + "type": "String", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2", + "TLS1_0", + "TLS1_1", + "TLSEnforcementDisabled" + ], + "metadata": { + "displayName": "PostgreSQL database servers. Select version minimum TLS for MySQL server", + "description": "PostgreSQL database servers. Select version minimum TLS version Azure Database for MySQL server to enforce" + } + }, + "RedisTLSDeployEffect": { + "type": "String", + "defaultValue": "Append", + "allowedValues": [ + "Append", + "Disabled" + ], + "metadata": { + "displayName": "Azure Cache for Redis. Deploy a specific min TLS version requirement and enforce SSL Azure Cache for Redis", + "description": "Deploy a specific min TLS version requirement and enforce SSL on Azure Cache for Redis. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + } + }, + "RedisMinTlsVersion": { + "type": "String", + "defaultValue": "1.2", + "allowedValues": [ + "1.2", + "1.0", + "1.1" + ], + "metadata": { + "displayName": "Azure Cache for Redis.Select version minimum TLS for Azure Cache for Redis", + "description": "Select version minimum TLS version for a Azure Cache for Redis to enforce" + } + }, + "RedisTLSEffect": { + "metadata": { + "displayName": "Azure Cache for Redis. Only secure connections to your Azure Cache for Redis should be enabled", + "description": "Azure Cache for Redis. Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "SQLManagedInstanceTLSDeployEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Azure Managed Instance. Deploy a specific min TLS version requirement and enforce SSL on SQL servers", + "description": "Deploy a specific min TLS version requirement and enforce SSL on SQL servers. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + } + }, + "SQLManagedInstanceMinTlsVersion": { + "type": "String", + "defaultValue": "1.2", + "allowedValues": [ + "1.2", + "1.0", + "1.1" + ], + "metadata": { + "displayName": "Azure Managed Instance.Select version minimum TLS for Azure Managed Instance", + "description": "Select version minimum TLS version for Azure Managed Instanceto to enforce" + } + }, + "SQLManagedInstanceTLSEffect": { + "metadata": { + "displayName": "SQL Managed Instance should have the minimal TLS version of 1.2", + "description": "Setting minimal TLS version to 1.2 improves security by ensuring your SQL Managed Instance can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not recommended since they have well documented security vulnerabilities." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "SQLServerTLSDeployEffect": { + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ], + "metadata": { + "displayName": "Azure SQL Database. Deploy a specific min TLS version requirement and enforce SSL on SQL servers", + "description": "Deploy a specific min TLS version requirement and enforce SSL on SQL servers. Enables secure server to client by enforce minimal Tls Version to secure the connection between your database server and your client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and your application. This configuration enforces that SSL is always enabled for accessing your database server." + } + }, + "SQLServerminTlsVersion": { + "type": "String", + "defaultValue": "1.2", + "allowedValues": [ + "1.2", + "1.0", + "1.1" + ], + "metadata": { + "displayName": "Azure SQL Database.Select version minimum TLS for Azure SQL Database", + "description": "Select version minimum TLS version for Azure SQL Database to enforce" + } + }, + "SQLServerTLSEffect": { + "metadata": { + "displayName": "Azure SQL Database should have the minimal TLS version of 1.2", + "description": "Setting minimal TLS version to 1.2 improves security by ensuring your Azure SQL Database can only be accessed from clients using TLS 1.2. Using versions of TLS less than 1.2 is not recommended since they have well documented security vulnerabilities." + }, + "type": "String", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "StorageDeployHttpsEnabledEffect": { + "metadata": { + "displayName": "Azure Storage Account. Deploy Secure transfer to storage accounts should be enabled", + "description": "Audit requirement of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking" + }, + "type": "String", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "StorageminimumTlsVersion": { + "type": "String", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2", + "TLS1_1", + "TLS1_0" + ], + "metadata": { + "displayName": "Storage Account select minimum TLS version", + "description": "Select version minimum TLS version on Azure Storage Account to enforce" + } + }, + "ContainerAppsHttpsOnlyEffect": { + "metadata": { + "displayName": "Container Apps should only be accessible over HTTPS", + "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Disabling 'allowInsecure' will result in the automatic redirection of requests from HTTP to HTTPS connections for container apps." + }, + "type": "String", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "logicAppHttpsEffect": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppsTls": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "functionAppSlotsTls": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceAppsHttps": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceTls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppSlotTls": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "functionAppSlotsHttps": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "functionAppHttps": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppSlotsHttps": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerAppsHttps": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventHubMinTls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "sqlManagedTlsVersion": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "sqlDbTls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsTls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseTlsVersion": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "AppServiceHttpEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-httpsonly", + "parameters": { + "effect": { + "value": "[[parameters('AppServiceHttpEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "AppServiceminTlsVersion", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-AppService-latestTLS", + "parameters": { + "effect": { + "value": "[[parameters('AppServiceTlsVersionEffect')]" + }, + "minTlsVersion": { + "value": "[[parameters('AppServiceminTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "FunctionLatestTlsEffect", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193", + "parameters": { + "effect": { + "value": "[[parameters('FunctionLatestTlsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "WebAppServiceLatestTlsEffect", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b", + "parameters": { + "effect": { + "value": "[[parameters('WebAppServiceLatestTlsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "APIAppServiceHttpsEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceApiApp-http", + "parameters": { + "effect": { + "value": "[[parameters('APIAppServiceHttpsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "FunctionServiceHttpsEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceFunctionApp-http", + "parameters": { + "effect": { + "value": "[[parameters('FunctionServiceHttpsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "WebAppServiceHttpsEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppServiceWebApp-http", + "parameters": { + "effect": { + "value": "[[parameters('WebAppServiceHttpsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "AKSIngressHttpsOnlyEffect", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d", + "parameters": { + "effect": { + "value": "[[parameters('AKSIngressHttpsOnlyEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "MySQLEnableSSLDeployEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-MySQL-sslEnforcement", + "parameters": { + "effect": { + "value": "[[parameters('MySQLEnableSSLDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('MySQLminimalTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "MySQLEnableSSLEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MySql-http", + "parameters": { + "effect": { + "value": "[[parameters('MySQLEnableSSLEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('MySQLminimalTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "PostgreSQLEnableSSLDeployEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-PostgreSQL-sslEnforcement", + "parameters": { + "effect": { + "value": "[[parameters('PostgreSQLEnableSSLDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('PostgreSQLminimalTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "PostgreSQLEnableSSLEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-PostgreSql-http", + "parameters": { + "effect": { + "value": "[[parameters('PostgreSQLEnableSSLEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('PostgreSQLminimalTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "RedisTLSDeployEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-sslEnforcement", + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSDeployEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('RedisMinTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "RedisdisableNonSslPort", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Append-Redis-disableNonSslPort", + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSDeployEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "RedisDenyhttps", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Redis-http", + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('RedisMinTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SQLManagedInstanceTLSDeployEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SqlMi-minTLS", + "parameters": { + "effect": { + "value": "[[parameters('SQLManagedInstanceTLSDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLManagedInstanceMinTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SQLManagedInstanceTLSEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-SqlMi-minTLS", + "parameters": { + "effect": { + "value": "[[parameters('SQLManagedInstanceTLSEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLManagedInstanceMinTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SQLServerTLSDeployEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-SQL-minTLS", + "parameters": { + "effect": { + "value": "[[parameters('SQLServerTLSDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLServerminTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "SQLServerTLSEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Sql-minTLS", + "parameters": { + "effect": { + "value": "[[parameters('SQLServerTLSEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLServerminTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "StorageDeployHttpsEnabledEffect", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-Storage-sslEnforcement", + "parameters": { + "effect": { + "value": "[[parameters('StorageDeployHttpsEnabledEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('StorageMinimumTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "ContainerAppsHttpsOnlyEffect", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb", + "parameters": { + "effect": { + "value": "[[parameters('ContainerAppsHttpsOnlyEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-FunctionApp-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f01f1c7-539c-49b5-9ef4-d4ffa37d22e0", + "parameters": { + "effect": { + "value": "[[parameters('FunctionAppTlsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deploy-LogicApp-TLS", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deploy-LogicApp-TLS", + "parameters": { + "effect": { + "value": "[[parameters('LogicAppTlsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-LogicApp-Without-Https", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-LogicApps-Without-Https", + "parameters": { + "effect": { + "value": "[[parameters('logicAppHttpsEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Function-Apps-Slots-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fa3a6357-c6d6-4120-8429-855577ec0063", + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-AppService-Apps-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ae44c1d1-0df2-4ca9-98fa-a3d3ae5b409d", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Apps-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a4af4a39-4135-47fb-b175-47fbdf85311d", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d6545c6b-dd9d-4265-91e6-0b451e2f1c50", + "parameters": { + "effect": { + "value": "[[parameters('appServiceTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-AppService-AppSlotTls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/014664e7-e348-41a3-aeb9-566e4ff6a9df", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FuncAppSlots-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5e5dbe3f-2702-4ffc-8b1e-0cae008a5c71", + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FunctionApp-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab", + "parameters": { + "effect": { + "value": "[[parameters('functionAppHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Slots-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ae1b9a8c-dfce-4605-bd91-69213b4a26fc", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotsHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerApps-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb", + "parameters": { + "effect": { + "value": "[[parameters('containerAppsHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-minTLS", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-minTLS", + "parameters": { + "effect": { + "value": "[[parameters('eventHubMinTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Managed-Tls-Version", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8793640-60f7-487c-b5c3-1d37215905c4", + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Db-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf", + "parameters": { + "effect": { + "value": "[[parameters('sqlDbTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Tls", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fe83a0eb-a853-422d-aac2-1bffd182c5d0", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Tls-Version", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cb3738a6-82a2-4a18-b87b-15217b9deff4", + "parameters": { + "effect": { + "value": "[[parameters('synapseTlsVersion')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.parameters.json new file mode 100644 index 000000000..c72426cc7 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-EncryptTransit_20240509.parameters.json @@ -0,0 +1,304 @@ +{ + "AKSIngressHttpsOnlyEffect": { + "parameters": { + "effect": { + "value": "[[parameters('AKSIngressHttpsOnlyEffect')]" + } + } + }, + "APIAppServiceHttpsEffect": { + "parameters": { + "effect": { + "value": "[[parameters('APIAppServiceHttpsEffect')]" + } + } + }, + "AppServiceHttpEffect": { + "parameters": { + "effect": { + "value": "[[parameters('AppServiceHttpEffect')]" + } + } + }, + "AppServiceminTlsVersion": { + "parameters": { + "effect": { + "value": "[[parameters('AppServiceTlsVersionEffect')]" + }, + "minTlsVersion": { + "value": "[[parameters('AppServiceminTlsVersion')]" + } + } + }, + "ContainerAppsHttpsOnlyEffect": { + "parameters": { + "effect": { + "value": "[[parameters('ContainerAppsHttpsOnlyEffect')]" + } + } + }, + "Deny-AppService-Apps-Https": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsHttps')]" + } + } + }, + "Deny-AppService-Slots-Https": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotsHttps')]" + } + } + }, + "Deny-AppService-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceTls')]" + } + } + }, + "Deny-ContainerApps-Https": { + "parameters": { + "effect": { + "value": "[[parameters('containerAppsHttps')]" + } + } + }, + "Deny-EH-minTLS": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubMinTls')]" + } + } + }, + "Deny-FuncAppSlots-Https": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsHttps')]" + } + } + }, + "Deny-FunctionApp-Https": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppHttps')]" + } + } + }, + "Deny-LogicApp-Without-Https": { + "parameters": { + "effect": { + "value": "[[parameters('logicAppHttpsEffect')]" + } + } + }, + "Deny-Sql-Db-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('sqlDbTls')]" + } + } + }, + "Deny-Sql-Managed-Tls-Version": { + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedTlsVersion')]" + } + } + }, + "Deny-Storage-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsTls')]" + } + } + }, + "Deny-Synapse-Tls-Version": { + "parameters": { + "effect": { + "value": "[[parameters('synapseTlsVersion')]" + } + } + }, + "Deploy-LogicApp-TLS": { + "parameters": { + "effect": { + "value": "[[parameters('LogicAppTlsEffect')]" + } + } + }, + "Dine-AppService-Apps-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsTls')]" + } + } + }, + "DINE-AppService-AppSlotTls": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotTls')]" + } + } + }, + "Dine-Function-Apps-Slots-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsTls')]" + } + } + }, + "Dine-FunctionApp-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('FunctionAppTlsEffect')]" + } + } + }, + "FunctionLatestTlsEffect": { + "parameters": { + "effect": { + "value": "[[parameters('FunctionLatestTlsEffect')]" + } + } + }, + "FunctionServiceHttpsEffect": { + "parameters": { + "effect": { + "value": "[[parameters('FunctionServiceHttpsEffect')]" + } + } + }, + "MySQLEnableSSLDeployEffect": { + "parameters": { + "effect": { + "value": "[[parameters('MySQLEnableSSLDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('MySQLminimalTlsVersion')]" + } + } + }, + "MySQLEnableSSLEffect": { + "parameters": { + "effect": { + "value": "[[parameters('MySQLEnableSSLEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('MySQLminimalTlsVersion')]" + } + } + }, + "PostgreSQLEnableSSLDeployEffect": { + "parameters": { + "effect": { + "value": "[[parameters('PostgreSQLEnableSSLDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('PostgreSQLminimalTlsVersion')]" + } + } + }, + "PostgreSQLEnableSSLEffect": { + "parameters": { + "effect": { + "value": "[[parameters('PostgreSQLEnableSSLEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('PostgreSQLminimalTlsVersion')]" + } + } + }, + "RedisDenyhttps": { + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('RedisMinTlsVersion')]" + } + } + }, + "RedisdisableNonSslPort": { + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSDeployEffect')]" + } + } + }, + "RedisTLSDeployEffect": { + "parameters": { + "effect": { + "value": "[[parameters('RedisTLSDeployEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('RedisMinTlsVersion')]" + } + } + }, + "SQLManagedInstanceTLSDeployEffect": { + "parameters": { + "effect": { + "value": "[[parameters('SQLManagedInstanceTLSDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLManagedInstanceMinTlsVersion')]" + } + } + }, + "SQLManagedInstanceTLSEffect": { + "parameters": { + "effect": { + "value": "[[parameters('SQLManagedInstanceTLSEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLManagedInstanceMinTlsVersion')]" + } + } + }, + "SQLServerTLSDeployEffect": { + "parameters": { + "effect": { + "value": "[[parameters('SQLServerTLSDeployEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLServerminTlsVersion')]" + } + } + }, + "SQLServerTLSEffect": { + "parameters": { + "effect": { + "value": "[[parameters('SQLServerTLSEffect')]" + }, + "minimalTlsVersion": { + "value": "[[parameters('SQLServerminTlsVersion')]" + } + } + }, + "StorageDeployHttpsEnabledEffect": { + "parameters": { + "effect": { + "value": "[[parameters('StorageDeployHttpsEnabledEffect')]" + }, + "minimumTlsVersion": { + "value": "[[parameters('StorageMinimumTlsVersion')]" + } + } + }, + "WebAppServiceHttpsEffect": { + "parameters": { + "effect": { + "value": "[[parameters('WebAppServiceHttpsEffect')]" + } + } + }, + "WebAppServiceLatestTlsEffect": { + "parameters": { + "effect": { + "value": "[[parameters('WebAppServiceLatestTlsEffect')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json index de1ef45b4..cbe71336a 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.json @@ -8,7 +8,7 @@ "displayName": "Deny or Audit resources without Encryption with a customer-managed key (CMK)", "description": "Deny or Audit resources without Encryption with a customer-managed key (CMK)", "metadata": { - "version": "2.0.0", + "version": "3.0.0", "category": "Encryption", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -22,7 +22,7 @@ "description": "Use customer-managed keys to manage the encryption at rest of the contents of your registries. By default, the data is encrypted at rest with service-managed keys, but customer-managed keys (CMK) are commonly required to meet regulatory compliance standards. CMKs enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about CMK encryption at https://aka.ms/acr/CMK." }, "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -35,7 +35,7 @@ "description": "Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. This is a common requirement in many regulatory and industry compliance standards." }, "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -44,7 +44,7 @@ }, "WorkspaceCMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -57,7 +57,7 @@ }, "CognitiveServicesCMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -70,7 +70,7 @@ }, "CosmosCMKEffect": { "type": "String", - "defaultValue": "audit", + "defaultValue": "deny", "allowedValues": [ "audit", "deny", @@ -83,7 +83,7 @@ }, "DataBoxCMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -96,7 +96,7 @@ }, "StreamAnalyticsCMKEffect": { "type": "String", - "defaultValue": "audit", + "defaultValue": "deny", "allowedValues": [ "audit", "deny", @@ -109,7 +109,7 @@ }, "SynapseWorkspaceCMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -158,7 +158,7 @@ }, "SqlServerTDECMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -183,7 +183,7 @@ }, "AzureBatchCMKEffect": { "type": "String", - "defaultValue": "Audit", + "defaultValue": "Deny", "allowedValues": [ "Audit", "Deny", @@ -205,6 +205,130 @@ "displayName": "Disk encryption should be applied on virtual machines", "description": "Virtual machines without an enabled disk encryption will be monitored by Azure Security Center as recommendations." } + }, + "AutomationAccountCmkEffect": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "BackupCmkEffect": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveSearchCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "osAndDataDiskCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerInstanceCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adxCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventHubNamespacesCmk": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "eventHubPremiumCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "serviceBusDenyCmk": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "sqlManagedCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageTableCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsEncryptionCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageQueueCmk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] } }, "policyDefinitions": [ @@ -357,6 +481,146 @@ } }, "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/56a5ee18-2ae6-4810-86f7-18e39ce5629b", + "parameters": { + "effect": { + "value": "[[parameters('AutomationAccountCmkEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Backup-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2e94d99a-8a36-4563-bc77-810d8893b671", + "parameters": { + "effect": { + "value": "[[parameters('BackupCmkEffect')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-CognitiveSearch-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/76a56461-9dc0-40f0-82f5-2453283afa2f", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-OsAndDataDisk-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/702dd420-7fcc-42c5-afe8-4026edd20fe0", + "parameters": { + "effect": { + "value": "[[parameters('osAndDataDiskCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerInstance-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0aa61e00-0a01-4a3c-9945-e93cffedf0e6", + "parameters": { + "effect": { + "value": "[[parameters('containerInstanceCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ADX-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/81e74cea-30fd-40d5-802f-d72103c2aaaa", + "parameters": { + "effect": { + "value": "[[parameters('adxCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Adf-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4ec52d6d-beb7-40c4-9a9e-fe753254690e", + "parameters": { + "effect": { + "value": "[[parameters('adfCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a1ad735a-e96f-45d2-a7b2-9a4932cab7ec", + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-Premium-CMK", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-Premium-CMK", + "parameters": { + "effect": { + "value": "[[parameters('eventHubPremiumCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sb-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/295fc8b1-dc9f-4f53-9c61-3f313ceab40a", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDenyCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Managed-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ac01ad65-10e5-46df-bdd9-6b0cad13e1d2", + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Table-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7c322315-e26d-4174-a99e-f49d351b4688", + "parameters": { + "effect": { + "value": "[[parameters('storageTableCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Encryption-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b5ec538c-daa0-4006-8596-35468b9148e8", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsEncryptionCmk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Queue-Cmk", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f0e5abd0-2554-4736-b7c0-4ffef23475ef", + "parameters": { + "effect": { + "value": "[[parameters('storageQueueCmk')]" + } + }, + "groupNames": [] } ], "policyDefinitionGroups": null diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json index 343d3d546..bb398c41e 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Encryption-CMK.parameters.json @@ -41,6 +41,104 @@ } } }, + "Deny-Aa-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('AutomationAccountCmkEffect')]" + } + } + }, + "Deny-Adf-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('adfCmk')]" + } + } + }, + "Deny-ADX-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('adxCmk')]" + } + } + }, + "Deny-Backup-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('BackupCmkEffect')]" + } + } + }, + "Deny-CognitiveSearch-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchCmk')]" + } + } + }, + "Deny-ContainerInstance-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('containerInstanceCmk')]" + } + } + }, + "Deny-EH-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesCmk')]" + } + } + }, + "Deny-EH-Premium-CMK": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubPremiumCmk')]" + } + } + }, + "Deny-OsAndDataDisk-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('osAndDataDiskCmk')]" + } + } + }, + "Deny-Sb-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDenyCmk')]" + } + } + }, + "Deny-Sql-Managed-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedCmk')]" + } + } + }, + "Deny-Storage-Encryption-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsEncryptionCmk')]" + } + } + }, + "Deny-Storage-Queue-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('storageQueueCmk')]" + } + } + }, + "Deny-Storage-Table-Cmk": { + "parameters": { + "effect": { + "value": "[[parameters('storageTableCmk')]" + } + } + }, "EncryptedVMDisksEffect": { "parameters": { "effect": { diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.json new file mode 100644 index 000000000..b412c27b4 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.json @@ -0,0 +1,234 @@ +{ + "name": "Enforce-Guardrails-APIM", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for API Management", + "description": "This policy initiative is a group of policies that ensures API Management is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "API Management", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "apiSubscriptionScope": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "minimumApiVersion": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimSkuVnet": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimDisablePublicNetworkAccess": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "apimApiBackendCertValidation": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimDirectApiEndpoint": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimCallApiAuthn": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimEncryptedProtocols": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimVnetUsage": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimSecrets": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "apimTls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Apim-without-Kv", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f1cc7827-022c-473e-836e-5a51cae0b249", + "parameters": { + "effect": { + "value": "[[parameters('apimSecrets')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-without-Vnet", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b", + "parameters": { + "effect": { + "value": "[[parameters('apimVnetUsage')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-APIM-TLS", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-APIM-TLS", + "parameters": { + "effect": { + "value": "[[parameters('apimTls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Protocols", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ee7495e7-3ba7-40b6-bfee-c29e22cc75d4", + "parameters": { + "effect": { + "value": "[[parameters('apimEncryptedProtocols')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Authn", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c15dcc82-b93c-4dcb-9332-fbf121685b54", + "parameters": { + "effect": { + "value": "[[parameters('apimCallApiAuthn')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Direct-Endpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b741306c-968e-4b67-b916-5675e5c709f4", + "parameters": { + "effect": { + "value": "[[parameters('apimDirectApiEndpoint')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Cert-Validation", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/92bb331d-ac71-416a-8c91-02f2cb734ce4", + "parameters": { + "effect": { + "value": "[[parameters('apimApiBackendCertValidation')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Apim-Public-NetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7ca8c8ac-3a6e-493d-99ba-c5fa35347ff2", + "parameters": { + "effect": { + "value": "[[parameters('apimDisablePublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Sku-Vnet", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/73ef9241-5d81-4cd4-b483-8443d1730fe5", + "parameters": { + "effect": { + "value": "[[parameters('apimSkuVnet')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Apim-Version", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/549814b6-3212-4203-bdc8-1548d342fb67", + "parameters": { + "effect": { + "value": "[[parameters('minimumApiVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Api-subscription-scope", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3aa03346-d8c5-4994-a5bc-7652c2a2aef1", + "parameters": { + "effect": { + "value": "[[parameters('apiSubscriptionScope')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.parameters.json new file mode 100644 index 000000000..a46d91043 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-APIM.parameters.json @@ -0,0 +1,79 @@ +{ + "Deny-Api-subscription-scope": { + "parameters": { + "effect": { + "value": "[[parameters('apiSubscriptionScope')]" + } + } + }, + "Deny-Apim-Authn": { + "parameters": { + "effect": { + "value": "[[parameters('apimCallApiAuthn')]" + } + } + }, + "Deny-Apim-Cert-Validation": { + "parameters": { + "effect": { + "value": "[[parameters('apimApiBackendCertValidation')]" + } + } + }, + "Deny-Apim-Direct-Endpoint": { + "parameters": { + "effect": { + "value": "[[parameters('apimDirectApiEndpoint')]" + } + } + }, + "Deny-Apim-Protocols": { + "parameters": { + "effect": { + "value": "[[parameters('apimEncryptedProtocols')]" + } + } + }, + "Deny-Apim-Sku-Vnet": { + "parameters": { + "effect": { + "value": "[[parameters('apimSkuVnet')]" + } + } + }, + "Deny-APIM-TLS": { + "parameters": { + "effect": { + "value": "[[parameters('apimTls')]" + } + } + }, + "Deny-Apim-Version": { + "parameters": { + "effect": { + "value": "[[parameters('minimumApiVersion')]" + } + } + }, + "Deny-Apim-without-Kv": { + "parameters": { + "effect": { + "value": "[[parameters('apimSecrets')]" + } + } + }, + "Deny-Apim-without-Vnet": { + "parameters": { + "effect": { + "value": "[[parameters('apimVnetUsage')]" + } + } + }, + "Dine-Apim-Public-NetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('apimDisablePublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.json new file mode 100644 index 000000000..14392505f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.json @@ -0,0 +1,367 @@ +{ + "name": "Enforce-Guardrails-AppServices", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for App Service", + "description": "This policy initiative is a group of policies that ensures App Service is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "App Service", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "functionAppDebugging": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceDisableLocalAuth": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceSkuPl": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceDisableLocalAuthFtp": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceRouting": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceScmAuth": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceRfc": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppsRfc": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppsVnetRouting": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceEnvLatestVersion": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appServiceAppSlotsRemoteDebugging": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceAppsRemoteDebugging": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "appServiceByoc": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "functionAppSlotsModifyHttps": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "appServiceAppHttps": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "functionAppSlotsModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "appServiceAppsModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "appServiceAppModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-AppService-Byoc", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppService-without-BYOC", + "parameters": { + "effect": { + "value": "[[parameters('appServiceByoc')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-AppService-Apps-Remote-Debugging", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsRemoteDebugging')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Slots-Remote-Debugging", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cca5adfe-626b-4cc6-8522-f5b6ed2391bd", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotsRemoteDebugging')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Latest-Version", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eb4d34ab-0929-491c-bbf3-61e13da19f9a", + "parameters": { + "effect": { + "value": "[[parameters('appServiceEnvLatestVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Vnet-Routing", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/801543d1-1953-4a90-b8b0-8cf6d41473a5", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsVnetRouting')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppService-Rfc", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f5c0bfb3-acea-47b1-b477-b0edcdf6edc1", + "parameters": { + "effect": { + "value": "[[parameters('appServiceRfc')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppServiceApps-Rfc", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a691eacb-474d-47e4-b287-b4813ca44222", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsRfc')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-FuncApp-Debugging", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/70adbb40-e092-42d5-a6f8-71c540a5efdb", + "parameters": { + "effect": { + "value": "[[parameters('functionAppDebugging')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-AppService-ScmAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5e97b776-f380-4722-a9a3-e7f0be029e79", + "parameters": { + "effect": { + "value": "[[parameters('appServiceScmAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppServ-Routing", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5747353b-1ca9-42c1-a4dd-b874b894f3d4", + "parameters": { + "effect": { + "value": "[[parameters('appServiceRouting')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppServ-FtpAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/572e342c-c920-4ef5-be2e-1ed3c6a51dc5", + "parameters": { + "effect": { + "value": "[[parameters('appServiceDisableLocalAuthFtp')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppServ-SkuPl", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/546fe8d2-368d-4029-a418-6af48a7f61e5", + "parameters": { + "effect": { + "value": "[[parameters('appServiceSkuPl')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-AppService-LocalAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2c034a29-2a5f-4857-b120-f800fe5549ae", + "parameters": { + "effect": { + "value": "[[parameters('appServiceDisableLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "DINE-AppService-Debugging", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/25a5046c-c423-4805-9235-e844ae9ef49b", + "parameters": { + "effect": { + "value": "[[parameters('functionAppDebugging')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Function-Apps-Slots-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/08cf2974-d178-48a0-b26d-f6b8e555748b", + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsModifyHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-AppService-Https", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0f98368e-36bc-4716-8ac2-8f8067203b63", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppHttps')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Function-Apps-Slots-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/242222f3-4985-4e99-b5ef-086d6a6cb01c", + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-AppService-Apps-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2374605e-3e0b-492b-9046-229af202562c", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-AppService-App-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c6c3e00e-d414-4ca4-914f-406699bb8eee", + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json new file mode 100644 index 000000000..031c6bd40 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-AppServices.parameters.json @@ -0,0 +1,135 @@ +{ + "Deny-AppServ-FtpAuth": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceDisableLocalAuthFtp')]" + } + } + }, + "Deny-AppServ-Routing": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceRouting')]" + } + } + }, + "Deny-AppServ-SkuPl": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceSkuPl')]" + } + } + }, + "Deny-AppService-Byoc": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceByoc')]" + } + } + }, + "Deny-AppService-Latest-Version": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceEnvLatestVersion')]" + } + } + }, + "Deny-AppService-Rfc": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceRfc')]" + } + } + }, + "Deny-AppService-Slots-Remote-Debugging": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppSlotsRemoteDebugging')]" + } + } + }, + "Deny-AppService-Vnet-Routing": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsVnetRouting')]" + } + } + }, + "Deny-AppServiceApps-Rfc": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsRfc')]" + } + } + }, + "Dine-AppService-Apps-Remote-Debugging": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsRemoteDebugging')]" + } + } + }, + "DINE-AppService-Debugging": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppDebugging')]" + } + } + }, + "DINE-AppService-LocalAuth": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceDisableLocalAuth')]" + } + } + }, + "DINE-AppService-ScmAuth": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceScmAuth')]" + } + } + }, + "DINE-FuncApp-Debugging": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppDebugging')]" + } + } + }, + "Modify-AppService-App-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppModifyPublicNetworkAccess')]" + } + } + }, + "Modify-AppService-Apps-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppsModifyPublicNetworkAccess')]" + } + } + }, + "Modify-AppService-Https": { + "parameters": { + "effect": { + "value": "[[parameters('appServiceAppHttps')]" + } + } + }, + "Modify-Function-Apps-Slots-Https": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsModifyHttps')]" + } + } + }, + "Modify-Function-Apps-Slots-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('functionAppSlotsModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json new file mode 100644 index 000000000..3ff72e052 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.json @@ -0,0 +1,137 @@ +{ + "name": "Enforce-Guardrails-Automation", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Automation Account", + "description": "This policy initiative is a group of policies that ensures Automation Account is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Automation", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "aaModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "aaVariablesEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "aaLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "aaManagedIdentity": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "autoHotPatch": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Disabled", + "Deny" + ] + }, + "aaModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Windows-Vm-HotPatch", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6d02d2f7-e38b-4bdc-96f3-adc0a8726abc", + "parameters": { + "effect": { + "value": "[[parameters('autoHotPatch')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Managed-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dea83a72-443c-4292-83d5-54a2f98749c0", + "parameters": { + "effect": { + "value": "[[parameters('aaManagedIdentity')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700", + "parameters": { + "effect": { + "value": "[[parameters('aaLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aa-Variables-Encrypt", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735", + "parameters": { + "effect": { + "value": "[[parameters('aaVariablesEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Aa-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81", + "parameters": { + "effect": { + "value": "[[parameters('aaModifyLocalAUth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Aa-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/23b36a7c-9d26-4288-a8fd-c1d2fa284d8c", + "parameters": { + "effect": { + "value": "[[parameters('aaModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json new file mode 100644 index 000000000..1bc6a2f51 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Automation.parameters.json @@ -0,0 +1,44 @@ +{ + "Deny-Aa-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('aaLocalAuth')]" + } + } + }, + "Deny-Aa-Managed-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('aaManagedIdentity')]" + } + } + }, + "Deny-Aa-Variables-Encrypt": { + "parameters": { + "effect": { + "value": "[[parameters('aaVariablesEncryption')]" + } + } + }, + "Deny-Windows-Vm-HotPatch": { + "parameters": { + "effect": { + "value": "[[parameters('autoHotPatch')]" + } + } + }, + "Modify-Aa-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('aaModifyLocalAUth')]" + } + } + }, + "Modify-Aa-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('aaModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.json new file mode 100644 index 000000000..e468d4919 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.json @@ -0,0 +1,118 @@ +{ + "name": "Enforce-Guardrails-CognitiveServices", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Cognitive Services", + "description": "This policy initiative is a group of policies that ensures Cognitive Services is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Cognitive Services", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "cognitiveSearchSku": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveSearchLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "modifyCognitiveSearchLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "modifyCognitiveSearchPublicEndpoint": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "cognitiveServicesModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-CognitiveSearch-SKU", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a049bf77-880b-470f-ba6d-9f21c530cf83", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchSku')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-CongitiveSearch-LocalAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6300012e-e9a4-4649-b41f-a85f5c43be91", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-CogntiveSearch-LocalAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4eb216f2-9dba-4979-86e6-5d7e63ce3b75", + "parameters": { + "effect": { + "value": "[[parameters('modifyCognitiveSearchLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-CogntiveSearch-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9cee519f-d9c1-4fd9-9f79-24ec3449ed30", + "parameters": { + "effect": { + "value": "[[parameters('modifyCognitiveSearchPublicEndpoint')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Cognitive-Services-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47ba1dd7-28d9-4b07-a8d5-9813bed64e0c", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.parameters.json new file mode 100644 index 000000000..df234f43e --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CognitiveServices.parameters.json @@ -0,0 +1,37 @@ +{ + "Deny-CognitiveSearch-SKU": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchSku')]" + } + } + }, + "Deny-CongitiveSearch-LocalAuth": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveSearchLocalAuth')]" + } + } + }, + "Modify-Cognitive-Services-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesModifyPublicNetworkAccess')]" + } + } + }, + "Modify-CogntiveSearch-LocalAuth": { + "parameters": { + "effect": { + "value": "[[parameters('modifyCognitiveSearchLocalAuth')]" + } + } + }, + "Modify-CogntiveSearch-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('modifyCognitiveSearchPublicEndpoint')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json new file mode 100644 index 000000000..5dda226f0 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.json @@ -0,0 +1,64 @@ +{ + "name": "Enforce-Guardrails-Compute", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Compute", + "description": "This policy initiative is a group of policies that ensures Compute is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Compute", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "diskDoubleEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "vmAndVmssEncryptionHost": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-VmAndVmss-Encryption-Host", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87", + "parameters": { + "effect": { + "value": "[[parameters('vmAndVmssEncryptionHost')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Disk-Double-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ca91455f-eace-4f96-be59-e6e2c35b4816", + "parameters": { + "effect": { + "value": "[[parameters('diskDoubleEncryption')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json new file mode 100644 index 000000000..88a10b95e --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Compute.parameters.json @@ -0,0 +1,16 @@ +{ + "Deny-Disk-Double-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('diskDoubleEncryption')]" + } + } + }, + "Deny-VmAndVmss-Encryption-Host": { + "parameters": { + "effect": { + "value": "[[parameters('vmAndVmssEncryptionHost')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.json new file mode 100644 index 000000000..e7627f471 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.json @@ -0,0 +1,64 @@ +{ + "name": "Enforce-Guardrails-ContainerApps", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Container Apps", + "description": "This policy initiative is a group of policies that ensures Container Apps is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Container Apps", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "containerAppsManagedIdentity": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerAppsVnetInjection": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-ContainerApp-Vnet-Injection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8b346db6-85af-419b-8557-92cee2c0f9bb", + "parameters": { + "effect": { + "value": "[[parameters('containerAppsVnetInjection')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerApps-Managed-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7", + "parameters": { + "effect": { + "value": "[[parameters('containerAppsManagedIdentity')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.parameters.json new file mode 100644 index 000000000..e00bc789d --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerApps.parameters.json @@ -0,0 +1,16 @@ +{ + "Deny-ContainerApp-Vnet-Injection": { + "parameters": { + "effect": { + "value": "[[parameters('containerAppsVnetInjection')]" + } + } + }, + "Deny-ContainerApps-Managed-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('containerAppsManagedIdentity')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.json new file mode 100644 index 000000000..5c54af455 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.json @@ -0,0 +1,45 @@ +{ + "name": "Enforce-Guardrails-ContainerInstance", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Container Instance", + "description": "This policy initiative is a group of policies that ensures Container Apps is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Container Instances", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "containerInstanceVnet": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-ContainerInstance-Vnet", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8af8f826-edcb-4178-b35f-851ea6fea615", + "parameters": { + "effect": { + "value": "[[parameters('containerInstanceVnet')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.parameters.json new file mode 100644 index 000000000..954db3f23 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerInstance.parameters.json @@ -0,0 +1,9 @@ +{ + "Deny-ContainerInstance-Vnet": { + "parameters": { + "effect": { + "value": "[[parameters('containerInstanceVnet')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.json new file mode 100644 index 000000000..1fe1ecf72 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.json @@ -0,0 +1,249 @@ +{ + "name": "Enforce-Guardrails-ContainerRegistry", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Container Registry", + "description": "This policy initiative is a group of policies that ensures Container Apps is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Container Registry", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "containerRegistryUnrestrictedNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryRepositoryToken": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryModifyRepositoryToken": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "containerRegistryLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "containerRegistryExports": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryAnAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryModifyAnAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "containerRegistrySkuPrivateLink": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryArmAudience": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "containerRegistryModifyArmAudience": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "containerRegistryModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Modify-ContainerRegistry-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/79fdfe03-ffcb-4e55-b4d0-b925b8241759", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ContainerRegistry-Repo-Token", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a9b426fe-8856-4945-8600-18c5dd1cca2a", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyRepositoryToken')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Arm-Audience", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/42781ec6-6127-4c30-bdfa-fb423a0047d3", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryArmAudience')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ContainerRegistry-Arm-Audience", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/785596ed-054f-41bc-aaec-7f3d0ba05725", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyArmAudience')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Sku-PrivateLink", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd560fc0-3c69-498a-ae9f-aa8eb7de0e13", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistrySkuPrivateLink')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ContainerRegistry-Anonymous-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cced2946-b08a-44fe-9fd9-e4ed8a779897", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyAnAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Anonymous-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9f2dea28-e834-476c-99c5-3507b4728395", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryAnAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Exports", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/524b0254-c285-4903-bee6-bb8126cde579", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryExports')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dc921057-6b28-4fbe-9b83-f7bec05db6c2", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Repo-Token", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ff05e24e-195c-447e-b322-5e90c9f9f366", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryRepositoryToken')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ContainerRegistry-Unrestricted-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryUnrestrictedNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ContainerRegistry-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a3701552-92ea-433e-9d17-33b7f1208fc9", + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.parameters.json new file mode 100644 index 000000000..65bbe84cb --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ContainerRegistry.parameters.json @@ -0,0 +1,86 @@ +{ + "Deny-ContainerRegistry-Anonymous-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryAnAuth')]" + } + } + }, + "Deny-ContainerRegistry-Arm-Audience": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryArmAudience')]" + } + } + }, + "Deny-ContainerRegistry-Exports": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryExports')]" + } + } + }, + "Deny-ContainerRegistry-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryLocalAuth')]" + } + } + }, + "Deny-ContainerRegistry-Repo-Token": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryRepositoryToken')]" + } + } + }, + "Deny-ContainerRegistry-Sku-PrivateLink": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistrySkuPrivateLink')]" + } + } + }, + "Deny-ContainerRegistry-Unrestricted-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryUnrestrictedNetworkAccess')]" + } + } + }, + "Modify-ContainerRegistry-Anonymous-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyAnAuth')]" + } + } + }, + "Modify-ContainerRegistry-Arm-Audience": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyArmAudience')]" + } + } + }, + "Modify-ContainerRegistry-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyLocalAuth')]" + } + } + }, + "Modify-ContainerRegistry-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyPublicNetworkAccess')]" + } + } + }, + "Modify-ContainerRegistry-Repo-Token": { + "parameters": { + "effect": { + "value": "[[parameters('containerRegistryModifyRepositoryToken')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.json new file mode 100644 index 000000000..d0b947f96 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.json @@ -0,0 +1,124 @@ +{ + "name": "Enforce-Guardrails-CosmosDb", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Cosmos DB", + "description": "This policy initiative is a group of policies that ensures Cosmos DB is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Cosmos DB", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "cosmosDbLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cosmosDbFwRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cosmosDbAtp": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "cosmosDbModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "cosmosDbModifyPublicAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Modify-CosmosDb-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dc2d41d1-4ab1-4666-a3e1-3d51c43e0049", + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-CosmosDb-Atp", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b5f04e03-92a3-4b09-9410-2cc5e5047656", + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbAtp')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-CosmosDb-Fw-Rules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb", + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbFwRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-CosmosDb-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5450f5bd-9c72-4390-a9c4-a7aba4edfdd2", + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Append-CosmosDb-Metadata", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4750c32b-89c0-46af-bfcb-2e4541a818d5", + "parameters": {}, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-CosmosDb-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/da69ba51-aaf1-41e5-8651-607cd0b37088", + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbModifyPublicAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.parameters.json new file mode 100644 index 000000000..732e0385b --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-CosmosDb.parameters.json @@ -0,0 +1,40 @@ +{ + "Append-CosmosDb-Metadata": { + "parameters": {} + }, + "Deny-CosmosDb-Fw-Rules": { + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbFwRules')]" + } + } + }, + "Deny-CosmosDb-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbLocalAuth')]" + } + } + }, + "Dine-CosmosDb-Atp": { + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbAtp')]" + } + } + }, + "Modify-CosmosDb-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbModifyLocalAuth')]" + } + } + }, + "Modify-CosmosDb-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('cosmosDbModifyPublicAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.json new file mode 100644 index 000000000..5fcdfc4e9 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.json @@ -0,0 +1,101 @@ +{ + "name": "Enforce-Guardrails-DataExplorer", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Data Explorer", + "description": "This policy initiative is a group of policies that ensures Data Explorer is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Azure Data Explorer", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "adxEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adxDoubleEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adxSku": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adxModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-ADX-Sku-without-PL-Support", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1fec9658-933f-4b3e-bc95-913ed22d012b", + "parameters": { + "effect": { + "value": "[[parameters('adxSku')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ADX-Double-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ec068d99-e9c7-401f-8cef-5bdde4e6ccf1", + "parameters": { + "effect": { + "value": "[[parameters('adxDoubleEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ADX-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f4b53539-8df9-40e4-86c6-6b607703bd4e", + "parameters": { + "effect": { + "value": "[[parameters('adxEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ADX-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7b32f193-cb28-4e15-9a98-b9556db0bafa", + "parameters": { + "effect": { + "value": "[[parameters('adxModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.parameters.json new file mode 100644 index 000000000..45a8872a8 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataExplorer.parameters.json @@ -0,0 +1,30 @@ +{ + "Deny-ADX-Double-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('adxDoubleEncryption')]" + } + } + }, + "Deny-ADX-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('adxEncryption')]" + } + } + }, + "Deny-ADX-Sku-without-PL-Support": { + "parameters": { + "effect": { + "value": "[[parameters('adxSku')]" + } + } + }, + "Modify-ADX-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('adxModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.json new file mode 100644 index 000000000..130aded41 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.json @@ -0,0 +1,120 @@ +{ + "name": "Enforce-Guardrails-DataFactory", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Data Factory", + "description": "This policy initiative is a group of policies that ensures Data Factory is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Data Factory", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "adfSqlIntegration": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfLinkedServiceKeyVault": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfGit": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfManagedIdentity": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "adfModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Adf-Managed-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f78ccdb4-7bf4-4106-8647-270491d2978a", + "parameters": { + "effect": { + "value": "[[parameters('adfManagedIdentity')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Adf-Git", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/77d40665-3120-4348-b539-3192ec808307", + "parameters": { + "effect": { + "value": "[[parameters('adfGit')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Adf-Linked-Service-Key-Vault", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/127ef6d7-242f-43b3-9eef-947faf1725d0", + "parameters": { + "effect": { + "value": "[[parameters('adfLinkedServiceKeyVault')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Adf-Sql-Integration", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0088bc63-6dee-4a9c-9d29-91cfdc848952", + "parameters": { + "effect": { + "value": "[[parameters('adfSqlIntegration')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Adf-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/08b1442b-7789-4130-8506-4f99a97226a7", + "parameters": { + "effect": { + "value": "[[parameters('adfModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.parameters.json new file mode 100644 index 000000000..cba67c431 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-DataFactory.parameters.json @@ -0,0 +1,37 @@ +{ + "Deny-Adf-Git": { + "parameters": { + "effect": { + "value": "[[parameters('adfGit')]" + } + } + }, + "Deny-Adf-Linked-Service-Key-Vault": { + "parameters": { + "effect": { + "value": "[[parameters('adfLinkedServiceKeyVault')]" + } + } + }, + "Deny-Adf-Managed-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('adfManagedIdentity')]" + } + } + }, + "Deny-Adf-Sql-Integration": { + "parameters": { + "effect": { + "value": "[[parameters('adfSqlIntegration')]" + } + } + }, + "Modify-Adf-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('adfModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.json new file mode 100644 index 000000000..d823b95ce --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.json @@ -0,0 +1,173 @@ +{ + "name": "Enforce-Guardrails-EventGrid", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Event Grid", + "description": "This policy initiative is a group of policies that ensures Event Grid is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Event Grid", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "eventGridLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventGridPartnerNamespaceLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventGridPartnerNamespaceModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "eventGridTopicLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventGridTopicModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "eventGridDomainModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "eventGridDomainModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "eventGridTopicModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Modify-EventGrid-Partner-Namespace-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2dd0e8b9-4289-4bb0-b813-1883298e9924", + "parameters": { + "effect": { + "value": "[[parameters('eventGridPartnerNamespaceModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-EventGrid-Domain-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8ac2748f-3bf1-4c02-a3b6-92ae68cf75b1", + "parameters": { + "effect": { + "value": "[[parameters('eventGridDomainModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EventGrid-Topic-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ae9fb87f-8a17-4428-94a4-8135d431055c", + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-EventGrid-Topic-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c8144d9-746a-4501-b08c-093c8d29ad04", + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EventGrid-Partner-Namespace-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8632b003-3545-4b29-85e6-b2b96773df1e", + "parameters": { + "effect": { + "value": "[[parameters('eventGridPartnerNamespaceLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EventGrid-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8bfadddb-ee1c-4639-8911-a38cb8e0b3bd", + "parameters": { + "effect": { + "value": "[[parameters('eventGridLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-EventGrid-Domain-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/898e9824-104c-4965-8e0e-5197588fa5d4", + "parameters": { + "effect": { + "value": "[[parameters('eventGridDomainModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-EventGrid-Topic-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/36ea4b4b-0f7f-4a54-89fa-ab18f555a172", + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.parameters.json new file mode 100644 index 000000000..045b9ceae --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventGrid.parameters.json @@ -0,0 +1,58 @@ +{ + "Deny-EventGrid-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridLocalAuth')]" + } + } + }, + "Deny-EventGrid-Partner-Namespace-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridPartnerNamespaceLocalAuth')]" + } + } + }, + "Deny-EventGrid-Topic-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicLocalAuth')]" + } + } + }, + "Modify-EventGrid-Domain-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridDomainModifyLocalAuth')]" + } + } + }, + "Modify-EventGrid-Domain-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridDomainModifyPublicNetworkAccess')]" + } + } + }, + "Modify-EventGrid-Partner-Namespace-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridPartnerNamespaceModifyLocalAuth')]" + } + } + }, + "Modify-EventGrid-Topic-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicModifyLocalAuth')]" + } + } + }, + "Modify-EventGrid-Topic-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('eventGridTopicModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.json new file mode 100644 index 000000000..281bd150f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.json @@ -0,0 +1,101 @@ +{ + "name": "Enforce-Guardrails-EventHub", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Event Hub", + "description": "This policy initiative is a group of policies that ensures Event Hub is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Event Hub", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "eventHubAuthRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventHubNamespacesLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "eventHubNamespacesModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "eventHubNamespacesDoubleEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-EH-Double-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/836cd60e-87f3-4e6a-a27c-29d687f01a4c", + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesDoubleEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-EH-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/57f35901-8389-40bb-ac49-3ba4f86d889d", + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5d4e3c65-4873-47be-94f3-6f8b953a3598", + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-EH-Auth-Rules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b278e460-7cfc-4451-8294-cccc40a940d7", + "parameters": { + "effect": { + "value": "[[parameters('eventHubAuthRules')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.parameters.json new file mode 100644 index 000000000..8269b0f14 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-EventHub.parameters.json @@ -0,0 +1,30 @@ +{ + "Deny-EH-Auth-Rules": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubAuthRules')]" + } + } + }, + "Deny-EH-Double-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesDoubleEncryption')]" + } + } + }, + "Deny-EH-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesLocalAuth')]" + } + } + }, + "Modify-EH-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('eventHubNamespacesModifyLocalAuth')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.json new file mode 100644 index 000000000..5f3bb0d60 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.json @@ -0,0 +1,62 @@ +{ + "name": "Enforce-Guardrails-KeyVault-Sup", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce additional recommended guardrails for Key Vault", + "description": "This policy initiative is a group of policies that ensures Key Vault is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Key Vault", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "keyVaultManagedHsmDisablePublicNetworkModify": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "keyVaultModifyFw": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Modify-KV-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/84d327c3-164a-4685-b453-900478614456", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmDisablePublicNetworkModify')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-KV-Fw", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ac673a9a-f77d-4846-b2d8-a57f8e1c01dc", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultModifyFw')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.parameters.json new file mode 100644 index 000000000..793faa2d8 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault-Sup.parameters.json @@ -0,0 +1,16 @@ +{ + "Modify-KV-Fw": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultModifyFw')]" + } + } + }, + "Modify-KV-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmDisablePublicNetworkModify')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json index 89c3e3007..7691b68e1 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.json @@ -8,7 +8,7 @@ "displayName": "Enforce recommended guardrails for Azure Key Vault", "description": "Enforce recommended guardrails for Azure Key Vault.", "metadata": { - "version": "1.0.0", + "version": "2.0.0", "category": "Key Vault", "source": "https://github.com/Azure/Enterprise-Scale/", "alzCloudEnvironments": [ @@ -156,6 +156,292 @@ "description": "Enter the days before expiration of the certificate when you want to trigger the policy action. For example, to trigger a policy action 90 days before the certificate's expiration, enter '90'." }, "defaultValue": 90 + }, + "keyVaultCheckMinimumRSACertificateSize": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultMinimumRSACertificateSizeValue": { + "type": "integer", + "defaultValue": 2048, + "allowedValues": [ + 2048, + 3072, + 4096 + ] + }, + "keyVaultManagedHsmCheckMinimumRSAKeySize": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultManagedHsmMinimumRSAKeySizeValue": { + "type": "integer", + "defaultValue": 2048, + "allowedValues": [ + 2048, + 3072, + 4096 + ] + }, + "keyVaultCheckMinimumRSAKeySize": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultMinimumRSAKeySizeValue": { + "type": "integer", + "defaultValue": 2048, + "allowedValues": [ + 2048, + 3072, + 4096 + ] + }, + "keyVaultArmRbac": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultHmsPurgeProtection": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultCertificatesPeriod": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultCertValidPeriod": { + "type": "integer", + "defaultValue": 12 + }, + "keyVaultHmsKeysExpiration": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keysValidPeriod": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keysValidityInDays": { + "type": "integer", + "defaultValue": 90 + }, + "secretsValidPeriod": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "secretsValidityInDays": { + "type": "integer", + "defaultValue": 90 + }, + "keyVaultCertKeyTypes": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultEllipticCurve": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultCryptographicType": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keysActive": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keysActiveInDays": { + "type": "integer", + "defaultValue": 90 + }, + "keysCurveNames": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "secretsActiveInDays": { + "type": "integer", + "defaultValue": 90 + }, + "secretsActive": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultSecretContentType": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultNonIntegratedCa": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultNonIntegratedCaValue": { + "type": "string", + "defaultValue": "", + "metadata": { + "displayName": "The common name of the certificate authority", + "description": "The common name (CN) of the Certificate Authority (CA) provider. For example, for an issuer CN = Contoso, OU = .., DC = .., you can specify Contoso" + } + }, + "keyVaultIntegratedCa": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultIntegratedCaValue": { + "type": "array", + "defaultValue": [ + "DigiCert", + "GlobalSign" + ] + }, + "keyVaultHsmMinimumDaysBeforeExpiration": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultHsmMinimumDaysBeforeExpirationValue": { + "type": "integer", + "defaultValue": 90 + }, + "keyVaultHmsCurveNames": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "keyVaultHmsCurveNamesValue": { + "type": "array", + "defaultValue": [ + "P-256", + "P-256K", + "P-384", + "P-521" + ] + }, + "keyVaultCertificateNotExpireWithinSpecifiedNumberOfDays": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "audit", + "Audit", + "deny", + "Deny", + "disabled", + "Disabled" + ] + }, + "keyVaultCertificateNotExpireWithinSpecifiedNumberOfDaysValue": { + "type": "integer", + "defaultValue": 90 } }, "policyDefinitions": [ @@ -250,6 +536,255 @@ } }, "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-RSA-Keys-without-MinCertSize", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cee51871-e572-4576-855c-047c820360f0", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCheckMinimumRSACertificateSize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultMinimumRSACertificateSizeValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86810a98-8e91-4a44-8386-ec66d0de5d57", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmCheckMinimumRSAKeySize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultManagedHsmMinimumRSAKeySizeValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-RSA-Keys-without-MinKeySize", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/82067dbb-e53b-4e06-b631-546d197452d9", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCheckMinimumRSAKeySize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultMinimumRSAKeySizeValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-without-ArmRbac", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultArmRbac')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Hms-PurgeProtection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c39ba22d-4428-4149-b981-70acb31fc383", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsPurgeProtection')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Cert-Period", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a075868-4c26-42ef-914c-5bc007359560", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertificatesPeriod')]" + }, + "maximumValidityInMonths": { + "value": "[[parameters('keyVaultCertValidPeriod')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Hms-Key-Expire", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1d478a74-21ba-4b9f-9d8f-8e6fced0eec5", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsKeysExpiration')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Keys-Expire", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/49a22571-d204-4c91-a7b6-09b1a586fbc9", + "parameters": { + "effect": { + "value": "[[parameters('keysValidPeriod')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('keysValidityInDays')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Secrets-ValidityDays", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/342e8053-e12e-4c44-be01-c3c2f318400f", + "parameters": { + "effect": { + "value": "[[parameters('secretsValidPeriod')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('secretsValidityInDays')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Key-Types", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1151cede-290b-4ba0-8b38-0ad145ac888f", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertKeyTypes')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Elliptic-Curve", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd78111f-4953-4367-9fd5-7e08808b54bf", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultEllipticCurve')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Cryptographic-Type", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/75c4f823-d65c-4f29-a733-01d0077fdbcb", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCryptographicType')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Key-Active", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c26e4b24-cf98-4c67-b48b-5a25c4c69eb9", + "parameters": { + "effect": { + "value": "[[parameters('keysActive')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('keysActiveInDays')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Curve-Names", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ff25f3c8-b739-4538-9d07-3d6d25cfb255", + "parameters": { + "effect": { + "value": "[[parameters('keysCurveNames')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-KV-Secret-ActiveDays", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e8d99835-8a06-45ae-a8e0-87a91941ccfe", + "parameters": { + "effect": { + "value": "[[parameters('secretsActive')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('secretsActiveInDays')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Secret-Content-Type", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/75262d3e-ba4a-4f43-85f8-9f72c090e5e3", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultSecretContentType')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Non-Integrated-Ca", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a22f4a40-01d3-4c7d-8071-da157eeff341", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultNonIntegratedCa')]" + }, + "caCommonName": { + "value": "[[parameters('keyVaultNonIntegratedCaValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Integrated-Ca", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8e826246-c976-48f6-b03e-619bb92b3d82", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultIntegratedCa')]" + }, + "allowedCAs": { + "value": "[[parameters('keyVaultIntegratedCaValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Hsm-MinimumDays-Before-Expiration", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ad27588c-0198-4c84-81ef-08efd0274653", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHsmMinimumDaysBeforeExpiration')]" + }, + "minimumDaysBeforeExpiration": { + "value": "[[parameters('keyVaultHsmMinimumDaysBeforeExpirationValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Hsm-Curve-Names", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e58fd0c1-feac-4d12-92db-0a7e9421f53e", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsCurveNames')]" + }, + "allowedECNames": { + "value": "[[parameters('keyVaultHmsCurveNamesValue')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Kv-Cert-Expiration-Within-Specific-Number-Days", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f772fb64-8e40-40ad-87bc-7706e1949427", + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertificateNotExpireWithinSpecifiedNumberOfDays')]" + }, + "daysToExpire": { + "value": "[[parameters('keyVaultCertificateNotExpireWithinSpecifiedNumberOfDaysValue')]" + } + }, + "groupNames": [] } ], "policyDefinitionGroups": null diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json index d57fe5555..6b771252d 100644 --- a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-KeyVault.parameters.json @@ -1,4 +1,190 @@ { + "Deny-keyVaultManagedHsm-RSA-Keys-without-MinKeySize": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultManagedHsmCheckMinimumRSAKeySize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultManagedHsmMinimumRSAKeySizeValue')]" + } + } + }, + "Deny-Kv-Cert-Expiration-Within-Specific-Number-Days": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertificateNotExpireWithinSpecifiedNumberOfDays')]" + }, + "daysToExpire": { + "value": "[[parameters('keyVaultCertificateNotExpireWithinSpecifiedNumberOfDaysValue')]" + } + } + }, + "Deny-KV-Cert-Period": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertificatesPeriod')]" + }, + "maximumValidityInMonths": { + "value": "[[parameters('keyVaultCertValidPeriod')]" + } + } + }, + "Deny-KV-Cryptographic-Type": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCryptographicType')]" + } + } + }, + "Deny-KV-Curve-Names": { + "parameters": { + "effect": { + "value": "[[parameters('keysCurveNames')]" + } + } + }, + "Deny-KV-Elliptic-Curve": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultEllipticCurve')]" + } + } + }, + "Deny-KV-Hms-Key-Expire": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsKeysExpiration')]" + } + } + }, + "Deny-KV-Hms-PurgeProtection": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsPurgeProtection')]" + } + } + }, + "Deny-Kv-Hsm-Curve-Names": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHmsCurveNames')]" + }, + "allowedECNames": { + "value": "[[parameters('keyVaultHmsCurveNamesValue')]" + } + } + }, + "Deny-Kv-Hsm-MinimumDays-Before-Expiration": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultHsmMinimumDaysBeforeExpiration')]" + }, + "minimumDaysBeforeExpiration": { + "value": "[[parameters('keyVaultHsmMinimumDaysBeforeExpirationValue')]" + } + } + }, + "Deny-Kv-Integrated-Ca": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultIntegratedCa')]" + }, + "allowedCAs": { + "value": "[[parameters('keyVaultIntegratedCaValue')]" + } + } + }, + "Deny-KV-Key-Active": { + "parameters": { + "effect": { + "value": "[[parameters('keysActive')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('keysActiveInDays')]" + } + } + }, + "Deny-KV-Key-Types": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCertKeyTypes')]" + } + } + }, + "Deny-KV-Keys-Expire": { + "parameters": { + "effect": { + "value": "[[parameters('keysValidPeriod')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('keysValidityInDays')]" + } + } + }, + "Deny-Kv-Non-Integrated-Ca": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultNonIntegratedCa')]" + }, + "caCommonName": { + "value": "[[parameters('keyVaultNonIntegratedCaValue')]" + } + } + }, + "Deny-KV-RSA-Keys-without-MinCertSize": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCheckMinimumRSACertificateSize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultMinimumRSACertificateSizeValue')]" + } + } + }, + "Deny-KV-RSA-Keys-without-MinKeySize": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultCheckMinimumRSAKeySize')]" + }, + "minimumRSAKeySize": { + "value": "[[parameters('keyVaultMinimumRSAKeySizeValue')]" + } + } + }, + "Deny-KV-Secret-ActiveDays": { + "parameters": { + "effect": { + "value": "[[parameters('secretsActive')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('secretsActiveInDays')]" + } + } + }, + "Deny-Kv-Secret-Content-Type": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultSecretContentType')]" + } + } + }, + "Deny-KV-Secrets-ValidityDays": { + "parameters": { + "effect": { + "value": "[[parameters('secretsValidPeriod')]" + }, + "maximumValidityInDays": { + "value": "[[parameters('secretsValidityInDays')]" + } + } + }, + "Deny-KV-without-ArmRbac": { + "parameters": { + "effect": { + "value": "[[parameters('keyVaultArmRbac')]" + } + } + }, "KvCertLifetime": { "parameters": { "effect": { diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.json new file mode 100644 index 000000000..9ea87816f --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.json @@ -0,0 +1,326 @@ +{ + "name": "Enforce-Guardrails-Kubernetes", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Kubernetes", + "description": "This policy initiative is a group of policies that ensures Kubernetes is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Kubernetes", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "aksKms": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "aksCni": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "aksLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksPrivateCluster": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksPolicy": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "aksCommandInvoke": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "aksReadinessOrLivenessProbes": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksPrivContainers": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksPrivEscalation": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksAllowedCapabilities": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksTempDisk": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksInternalLb": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksDefaultNamespace": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksNakedPods": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksShareHostProcessAndNamespace": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "aksWindowsContainerAdministrator": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Aks-Windows-Container-Administrator", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5485eac0-7e8f-4964-998b-a44f4f0c1e75", + "parameters": { + "effect": { + "value": "[[parameters('aksWindowsContainerAdministrator')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Shared-Host-Process-Namespace", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8", + "parameters": { + "effect": { + "value": "[[parameters('aksShareHostProcessAndNamespace')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Naked-Pods", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/65280eef-c8b4-425e-9aec-af55e55bf581", + "parameters": { + "effect": { + "value": "[[parameters('aksNakedPods')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Default-Namespace", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373", + "parameters": { + "effect": { + "value": "[[parameters('aksDefaultNamespace')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Internal-Lb", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3fc4dc25-5baf-40d8-9b05-7fe74c1bc64e", + "parameters": { + "effect": { + "value": "[[parameters('aksInternalLb')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Temp-Disk-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/41425d9f-d1a5-499a-9932-f8ed8453932c", + "parameters": { + "effect": { + "value": "[[parameters('aksTempDisk')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Allowed-Capabilities", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c", + "parameters": { + "effect": { + "value": "[[parameters('aksAllowedCapabilities')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Priv-Escalation", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99", + "parameters": { + "effect": { + "value": "[[parameters('aksPrivEscalation')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Priv-Containers", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4", + "parameters": { + "effect": { + "value": "[[parameters('aksPrivContainers')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-ReadinessOrLiveness-Probes", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b1a9997f-2883-4f12-bdff-2280f99b5915", + "parameters": { + "effect": { + "value": "[[parameters('aksReadinessOrLivenessProbes')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Aks-Command-Invoke", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b708b0a-3380-40e9-8b79-821f9fa224cc", + "parameters": { + "effect": { + "value": "[[parameters('aksCommandInvoke')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Aks-Policy", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7", + "parameters": { + "effect": { + "value": "[[parameters('aksPolicy')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Private-Cluster", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/040732e8-d947-40b8-95d6-854c95024bf8", + "parameters": { + "effect": { + "value": "[[parameters('aksPrivateCluster')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/993c2fcd-2b29-49d2-9eb0-df2c3a730c32", + "parameters": { + "effect": { + "value": "[[parameters('aksLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Kms", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dbbdc317-9734-4dd8-9074-993b29c69008", + "parameters": { + "effect": { + "value": "[[parameters('aksKms')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Aks-Cni", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/46238e2f-3f6f-4589-9f3f-77bed4116e67", + "parameters": { + "effect": { + "value": "[[parameters('aksCni')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.parameters.json new file mode 100644 index 000000000..4433bbb45 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Kubernetes.parameters.json @@ -0,0 +1,114 @@ +{ + "Deny-Aks-Allowed-Capabilities": { + "parameters": { + "effect": { + "value": "[[parameters('aksAllowedCapabilities')]" + } + } + }, + "Deny-Aks-Cni": { + "parameters": { + "effect": { + "value": "[[parameters('aksCni')]" + } + } + }, + "Deny-Aks-Default-Namespace": { + "parameters": { + "effect": { + "value": "[[parameters('aksDefaultNamespace')]" + } + } + }, + "Deny-Aks-Internal-Lb": { + "parameters": { + "effect": { + "value": "[[parameters('aksInternalLb')]" + } + } + }, + "Deny-Aks-Kms": { + "parameters": { + "effect": { + "value": "[[parameters('aksKms')]" + } + } + }, + "Deny-Aks-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('aksLocalAuth')]" + } + } + }, + "Deny-Aks-Naked-Pods": { + "parameters": { + "effect": { + "value": "[[parameters('aksNakedPods')]" + } + } + }, + "Deny-Aks-Priv-Containers": { + "parameters": { + "effect": { + "value": "[[parameters('aksPrivContainers')]" + } + } + }, + "Deny-Aks-Priv-Escalation": { + "parameters": { + "effect": { + "value": "[[parameters('aksPrivEscalation')]" + } + } + }, + "Deny-Aks-Private-Cluster": { + "parameters": { + "effect": { + "value": "[[parameters('aksPrivateCluster')]" + } + } + }, + "Deny-Aks-ReadinessOrLiveness-Probes": { + "parameters": { + "effect": { + "value": "[[parameters('aksReadinessOrLivenessProbes')]" + } + } + }, + "Deny-Aks-Shared-Host-Process-Namespace": { + "parameters": { + "effect": { + "value": "[[parameters('aksShareHostProcessAndNamespace')]" + } + } + }, + "Deny-Aks-Temp-Disk-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('aksTempDisk')]" + } + } + }, + "Deny-Aks-Windows-Container-Administrator": { + "parameters": { + "effect": { + "value": "[[parameters('aksWindowsContainerAdministrator')]" + } + } + }, + "Dine-Aks-Command-Invoke": { + "parameters": { + "effect": { + "value": "[[parameters('aksCommandInvoke')]" + } + } + }, + "Dine-Aks-Policy": { + "parameters": { + "effect": { + "value": "[[parameters('aksPolicy')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.json new file mode 100644 index 000000000..e723eeebe --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.json @@ -0,0 +1,118 @@ +{ + "name": "Enforce-Guardrails-MachineLearning", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Machine Learning", + "description": "This policy initiative is a group of policies that ensures Machine Learning is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Machine Learning", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "mlUserAssignedIdentity": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "mlModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "mlLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "mlOutdatedOS": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Disabled" + ] + }, + "mlModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-ML-Outdated-Os", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f110a506-2dcb-422e-bcea-d533fc8c35e2", + "parameters": { + "effects": { + "value": "[[parameters('mlOutdatedOS')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ML-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f", + "parameters": { + "effect": { + "value": "[[parameters('mlLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ML-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a6f9a2d0-cff7-4855-83ad-4cd750666512", + "parameters": { + "effect": { + "value": "[[parameters('mlModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-ML-User-Assigned-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5f0c7d88-c7de-45b8-ac49-db49e72eaa78", + "parameters": { + "effect": { + "value": "[[parameters('mlUserAssignedIdentity')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-ML-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a10ee784-7409-4941-b091-663697637c0f", + "parameters": { + "effect": { + "value": "[[parameters('mlModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.parameters.json new file mode 100644 index 000000000..fb3ec82cd --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MachineLearning.parameters.json @@ -0,0 +1,37 @@ +{ + "Deny-ML-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('mlLocalAuth')]" + } + } + }, + "Deny-ML-Outdated-Os": { + "parameters": { + "effects": { + "value": "[[parameters('mlOutdatedOS')]" + } + } + }, + "Deny-ML-User-Assigned-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('mlUserAssignedIdentity')]" + } + } + }, + "Modify-ML-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('mlModifyLocalAuth')]" + } + } + }, + "Modify-ML-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('mlModifyPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.json new file mode 100644 index 000000000..ac1d42ff5 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.json @@ -0,0 +1,63 @@ +{ + "name": "Enforce-Guardrails-MySQL", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for MySQL", + "description": "This policy initiative is a group of policies that ensures MySQL is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "MySQL", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "mySqlInfraEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "mySqlAdvThreatProtection": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Dine-MySql-Adv-Threat-Protection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/80ed5239-4122-41ed-b54a-6f1fa7552816", + "parameters": { + "effect": { + "value": "[[parameters('mySqlAdvThreatProtection')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-MySql-Infra-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3a58212a-c829-4f13-9872-6371df2fd0b4", + "parameters": { + "effect": { + "value": "[[parameters('mySqlInfraEncryption')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.parameters.json new file mode 100644 index 000000000..42fb85658 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-MySQL.parameters.json @@ -0,0 +1,16 @@ +{ + "Deny-MySql-Infra-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('mySqlInfraEncryption')]" + } + } + }, + "Dine-MySql-Adv-Threat-Protection": { + "parameters": { + "effect": { + "value": "[[parameters('mySqlAdvThreatProtection')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.json new file mode 100644 index 000000000..3ecf3e359 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.json @@ -0,0 +1,525 @@ +{ + "name": "Enforce-Guardrails-Network", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Network and Networking services", + "description": "This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Network", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "subnetUdr": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "subnetNsg": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "subnetServiceEndpoint": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appGwWaf": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "vnetModifyDdos": { + "type": "string", + "defaultValue": "Modify" + }, + "ddosPlanResourceId": { + "type": "string", + "defaultValue": "" + }, + "wafMode": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "wafModeRequirement": { + "type": "string", + "defaultValue": "Prevention" + }, + "wafFwRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "wafModeAppGw": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "wafModeAppGwRequirement": { + "type": "string", + "defaultValue": "Prevention" + }, + "denyMgmtFromInternet": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "denyMgmtFromInternetPorts": { + "type": "Array", + "metadata": { + "displayName": "Ports", + "description": "Ports to be blocked" + }, + "defaultValue": [ + "22", + "3389" + ] + }, + "afwEnbaleTlsForAllAppRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "afwEnableTlsInspection": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "afwEmptyIDPSBypassList": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "afwEnableAllIDPSSignatureRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "afwEnableIDPS": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "wafAfdEnabled": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "vpnAzureAD": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "appGwTlsVersion": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "modifyUdr": { + "type": "string", + "defaultValue": "Disabled" + }, + "modifyUdrNextHopIpAddress": { + "type": "string", + "defaultValue": "" + }, + "modifyUdrNextHopType": { + "type": "string", + "defaultValue": "None" + }, + "modifyUdrAddressPrefix": { + "type": "string", + "defaultValue": "0.0.0.0/0" + }, + "modifyNsg": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "modifyNsgRuleName": { + "type": "string", + "defaultValue": "DenyAnyInternetOutbound" + }, + "modifyNsgRulePriority": { + "type": "integer", + "defaultValue": 1000 + }, + "modifyNsgRuleDirection": { + "type": "string", + "defaultValue": "Outbound" + }, + "modifyNsgRuleAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "modifyNsgRuleProtocol": { + "type": "string", + "defaultValue": "*" + }, + "modifyNsgRuleSourceAddressPrefix": { + "type": "string", + "defaultValue": "*" + }, + "modifyNsgRuleSourcePortRange": { + "type": "string", + "defaultValue": "*" + }, + "modifyNsgRuleDestinationAddressPrefix": { + "type": "string", + "defaultValue": "Internet" + }, + "modifyNsgRuleDestinationPortRange": { + "type": "string", + "defaultValue": "*" + }, + "modifyNsgRuleDescription": { + "type": "string", + "defaultValue": "Deny any outbound traffic to the Internet" + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Nsg-GW-subnet", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010", + "parameters": {}, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-VPN-AzureAD", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7", + "parameters": { + "effect": { + "value": "[[parameters('vpnAzureAD')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Waf-Afd-Enabled", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c", + "parameters": { + "effect": { + "value": "[[parameters('wafAfdEnabled')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Waf-IDPS", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6484db87-a62d-4327-9f07-80a2cbdf333a", + "parameters": { + "effect": { + "value": "[[parameters('afwEnableIDPS')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FW-AllIDPSS", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/610b6183-5f00-4d68-86d2-4ab4cb3a67a5", + "parameters": { + "effect": { + "value": "[[parameters('afwEnableAllIDPSSignatureRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FW-EmpIDPSBypass", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f516dc7a-4543-4d40-aad6-98f76a706b50", + "parameters": { + "effect": { + "value": "[[parameters('afwEmptyIDPSBypassList')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FW-TLS-Inspection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/711c24bb-7f18-4578-b192-81a6161e1f17", + "parameters": { + "effect": { + "value": "[[parameters('afwEnableTlsInspection')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-FW-TLS-AllApp", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a58ac66d-92cb-409c-94b8-8e48d7a96596", + "parameters": { + "effect": { + "value": "[[parameters('afwEnbaleTlsForAllAppRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Waf-AppGw-mode", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/12430be1-6cc8-4527-a9a8-e3d38f250096", + "parameters": { + "effect": { + "value": "[[parameters('wafModeAppGw')]" + }, + "modeRequirement": { + "value": "[[parameters('wafModeAppGwRequirement')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Waf-Fw-rules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/632d3993-e2c0-44ea-a7db-2eca131f356d", + "parameters": { + "effect": { + "value": "[[parameters('wafFwRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Waf-mode", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/425bea59-a659-4cbb-8d31-34499bd030b8", + "parameters": { + "effect": { + "value": "[[parameters('wafMode')]" + }, + "modeRequirement": { + "value": "[[parameters('wafModeRequirement')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-vNet-DDoS", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/94de2ad3-e0c1-4caf-ad78-5d47bbc83d3d", + "parameters": { + "effect": { + "value": "[[parameters('vnetModifyDdos')]" + }, + "ddosPlan": { + "value": "[[parameters('ddosPlanResourceId')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Ip-Forwarding", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900", + "parameters": {}, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-vNic-Pip", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114", + "parameters": {}, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppGw-Without-Waf", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66", + "parameters": { + "effect": { + "value": "[[parameters('appGwWaf')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Subnet-Without-Udr", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr", + "parameters": { + "effect": { + "value": "[[parameters('subnetUdr')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Subnet-Without-NSG", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Nsg", + "parameters": { + "effect": { + "value": "[[parameters('subnetNsg')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Subnet-with-Service-Endpoints", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Service-Endpoints", + "parameters": { + "effect": { + "value": "[[parameters('subnetServiceEndpoint')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Mgmt-From-Internet", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-MgmtPorts-From-Internet", + "parameters": { + "effect": { + "value": "[[parameters('denyMgmtFromInternet')]" + }, + "ports": { + "value": "[[parameters('denyMgmtFromInternetPorts')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-AppGw-Without-Tls", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-AppGw-Without-Tls", + "parameters": { + "effect": { + "value": "[[parameters('appGwTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Udr", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-UDR", + "parameters": { + "effect": { + "value": "[[parameters('modifyUdr')]" + }, + "nextHopIpAddress": { + "value": "[[parameters('modifyUdrNextHopIpAddress')]" + }, + "nextHopType": { + "value": "[[parameters('modifyUdrNextHopType')]" + }, + "addressPrefix": { + "value": "[[parameters('modifyUdrAddressPrefix')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Nsg", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Modify-NSG", + "parameters": { + "effect": { + "value": "[[parameters('modifyNsg')]" + }, + "nsgRuleName": { + "value": "[[parameters('modifyNsgRuleName')]" + }, + "nsgRulePriority": { + "value": "[[parameters('modifyNsgRulePriority')]" + }, + "nsgRuleDirection": { + "value": "[[parameters('modifyNsgRuleDirection')]" + }, + "nsgRuleAccess": { + "value": "[[parameters('modifyNsgRuleAccess')]" + }, + "nsgRuleProtocol": { + "value": "[[parameters('modifyNsgRuleProtocol')]" + }, + "nsgRuleSourceAddressPrefix": { + "value": "[[parameters('modifyNsgRuleSourceAddressPrefix')]" + }, + "nsgRuleSourcePortRange": { + "value": "[[parameters('modifyNsgRuleSourcePortRange')]" + }, + "nsgRuleDestinationAddressPrefix": { + "value": "[[parameters('modifyNsgRuleDestinationAddressPrefix')]" + }, + "nsgRuleDestinationPortRange": { + "value": "[[parameters('modifyNsgRuleDestinationPortRange')]" + }, + "nsgRuleDescription": { + "value": "[[parameters('modifyNsgRuleDescription')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.parameters.json new file mode 100644 index 000000000..5e71095b9 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Network.parameters.json @@ -0,0 +1,195 @@ +{ + "Deny-AppGw-Without-Tls": { + "parameters": { + "effect": { + "value": "[[parameters('appGwTlsVersion')]" + } + } + }, + "Deny-AppGw-Without-Waf": { + "parameters": { + "effect": { + "value": "[[parameters('appGwWaf')]" + } + } + }, + "Deny-FW-AllIDPSS": { + "parameters": { + "effect": { + "value": "[[parameters('afwEnableAllIDPSSignatureRules')]" + } + } + }, + "Deny-FW-EmpIDPSBypass": { + "parameters": { + "effect": { + "value": "[[parameters('afwEmptyIDPSBypassList')]" + } + } + }, + "Deny-FW-TLS-AllApp": { + "parameters": { + "effect": { + "value": "[[parameters('afwEnbaleTlsForAllAppRules')]" + } + } + }, + "Deny-FW-TLS-Inspection": { + "parameters": { + "effect": { + "value": "[[parameters('afwEnableTlsInspection')]" + } + } + }, + "Deny-Ip-Forwarding": { + "parameters": {} + }, + "Deny-Mgmt-From-Internet": { + "parameters": { + "effect": { + "value": "[[parameters('denyMgmtFromInternet')]" + }, + "ports": { + "value": "[[parameters('denyMgmtFromInternetPorts')]" + } + } + }, + "Deny-Nsg-GW-subnet": { + "parameters": {} + }, + "Deny-Subnet-with-Service-Endpoints": { + "parameters": { + "effect": { + "value": "[[parameters('subnetServiceEndpoint')]" + } + } + }, + "Deny-Subnet-Without-NSG": { + "parameters": { + "effect": { + "value": "[[parameters('subnetNsg')]" + } + } + }, + "Deny-Subnet-Without-Udr": { + "parameters": { + "effect": { + "value": "[[parameters('subnetUdr')]" + } + } + }, + "Deny-vNic-Pip": { + "parameters": {} + }, + "Deny-VPN-AzureAD": { + "parameters": { + "effect": { + "value": "[[parameters('vpnAzureAD')]" + } + } + }, + "Deny-Waf-Afd-Enabled": { + "parameters": { + "effect": { + "value": "[[parameters('wafAfdEnabled')]" + } + } + }, + "Deny-Waf-AppGw-mode": { + "parameters": { + "effect": { + "value": "[[parameters('wafModeAppGw')]" + }, + "modeRequirement": { + "value": "[[parameters('wafModeAppGwRequirement')]" + } + } + }, + "Deny-Waf-Fw-rules": { + "parameters": { + "effect": { + "value": "[[parameters('wafFwRules')]" + } + } + }, + "Deny-Waf-IDPS": { + "parameters": { + "effect": { + "value": "[[parameters('afwEnableIDPS')]" + } + } + }, + "Deny-Waf-mode": { + "parameters": { + "effect": { + "value": "[[parameters('wafMode')]" + }, + "modeRequirement": { + "value": "[[parameters('wafModeRequirement')]" + } + } + }, + "Modify-Nsg": { + "parameters": { + "effect": { + "value": "[[parameters('modifyNsg')]" + }, + "nsgRuleName": { + "value": "[[parameters('modifyNsgRuleName')]" + }, + "nsgRulePriority": { + "value": "[[parameters('modifyNsgRulePriority')]" + }, + "nsgRuleDirection": { + "value": "[[parameters('modifyNsgRuleDirection')]" + }, + "nsgRuleAccess": { + "value": "[[parameters('modifyNsgRuleAccess')]" + }, + "nsgRuleProtocol": { + "value": "[[parameters('modifyNsgRuleProtocol')]" + }, + "nsgRuleSourceAddressPrefix": { + "value": "[[parameters('modifyNsgRuleSourceAddressPrefix')]" + }, + "nsgRuleSourcePortRange": { + "value": "[[parameters('modifyNsgRuleSourcePortRange')]" + }, + "nsgRuleDestinationAddressPrefix": { + "value": "[[parameters('modifyNsgRuleDestinationAddressPrefix')]" + }, + "nsgRuleDestinationPortRange": { + "value": "[[parameters('modifyNsgRuleDestinationPortRange')]" + }, + "nsgRuleDescription": { + "value": "[[parameters('modifyNsgRuleDescription')]" + } + } + }, + "Modify-Udr": { + "parameters": { + "effect": { + "value": "[[parameters('modifyUdr')]" + }, + "nextHopIpAddress": { + "value": "[[parameters('modifyUdrNextHopIpAddress')]" + }, + "nextHopType": { + "value": "[[parameters('modifyUdrNextHopType')]" + }, + "addressPrefix": { + "value": "[[parameters('modifyUdrAddressPrefix')]" + } + } + }, + "Modify-vNet-DDoS": { + "parameters": { + "effect": { + "value": "[[parameters('vnetModifyDdos')]" + }, + "ddosPlan": { + "value": "[[parameters('ddosPlanResourceId')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.json new file mode 100644 index 000000000..34e8b5ce8 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.json @@ -0,0 +1,139 @@ +{ + "name": "Enforce-Guardrails-OpenAI", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Open AI (Cognitive Service)", + "description": "This policy initiative is a group of policies that ensures Open AI (Cognitive Service) is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Cognitive Services", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "cognitiveServicesOutboundNetworkAccess": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesNetworkAcls": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesModifyDisableLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "cognitiveServicesDisableLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesCustomerStorage": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "cognitiveServicesManagedIdentity": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-OpenAi-OutboundNetworkAccess", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-RestrictOutboundNetworkAccess", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesOutboundNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-OpenAi-NetworkAcls", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-NetworkAcls", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesNetworkAcls')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Cognitive-Services-Managed-Identity", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fe3fd216-4f83-4fc1-8984-2bbec80a3418", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesManagedIdentity')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Cognitive-Services-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesDisableLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Cognitive-Services-Cust-Storage", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/46aa9b05-0e60-4eae-a88b-1e9d374fa515", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesCustomerStorage')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Cognitive-Services-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555", + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesModifyDisableLocalAuth')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.parameters.json new file mode 100644 index 000000000..3281f8172 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-OpenAI.parameters.json @@ -0,0 +1,44 @@ +{ + "Deny-Cognitive-Services-Cust-Storage": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesCustomerStorage')]" + } + } + }, + "Deny-Cognitive-Services-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesDisableLocalAuth')]" + } + } + }, + "Deny-Cognitive-Services-Managed-Identity": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesManagedIdentity')]" + } + } + }, + "Deny-OpenAi-NetworkAcls": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesNetworkAcls')]" + } + } + }, + "Deny-OpenAi-OutboundNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesOutboundNetworkAccess')]" + } + } + }, + "Modify-Cognitive-Services-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('cognitiveServicesModifyDisableLocalAuth')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.json new file mode 100644 index 000000000..22963ce2a --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.json @@ -0,0 +1,44 @@ +{ + "name": "Enforce-Guardrails-PostgreSQL", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for PostgreSQL", + "description": "This policy initiative is a group of policies that ensures PostgreSQL is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "PostgreSQL", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "postgreSqlAdvThreatProtection": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Dine-PostgreSql-Adv-Threat-Protection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/db048e65-913c-49f9-bb5f-1084184671d3", + "parameters": { + "effect": { + "value": "[[parameters('postgreSqlAdvThreatProtection')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.parameters.json new file mode 100644 index 000000000..dac08e677 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-PostgreSQL.parameters.json @@ -0,0 +1,9 @@ +{ + "Dine-PostgreSql-Adv-Threat-Protection": { + "parameters": { + "effect": { + "value": "[[parameters('postgreSqlAdvThreatProtection')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.json new file mode 100644 index 000000000..857ae7665 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.json @@ -0,0 +1,106 @@ +{ + "name": "Enforce-Guardrails-SQL", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for SQL and SQL Managed Instance", + "description": "This policy initiative is a group of policies that ensures SQL and SQL Managed Instance is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "SQL", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "sqlManagedAadOnly": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "sqlAadOnly": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "sqlManagedDefender": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "modifySqlPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Dine-Sql-Managed-Defender", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c5a62eb0-c65a-4220-8a4d-f70dd4ca95dd", + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedDefender')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Aad-Only", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abda6d70-9778-44e7-84a8-06713e6db027", + "parameters": { + "effect": { + "value": "[[parameters('sqlAadOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sql-Managed-Aad-Only", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/78215662-041e-49ed-a9dd-5385911b3a1f", + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedAadOnly')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Sql-Adv-Data", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6134c3db-786f-471e-87bc-8f479dc890f6", + "parameters": {}, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Sql-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/28b0b1e5-17ba-4963-a7a4-5a1ab4400a0b", + "parameters": { + "effect": { + "value": "[[parameters('modifySqlPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.parameters.json new file mode 100644 index 000000000..626e975c8 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-SQL.parameters.json @@ -0,0 +1,33 @@ +{ + "Deny-Sql-Aad-Only": { + "parameters": { + "effect": { + "value": "[[parameters('sqlAadOnly')]" + } + } + }, + "Deny-Sql-Managed-Aad-Only": { + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedAadOnly')]" + } + } + }, + "Dine-Sql-Adv-Data": { + "parameters": {} + }, + "Dine-Sql-Managed-Defender": { + "parameters": { + "effect": { + "value": "[[parameters('sqlManagedDefender')]" + } + } + }, + "Modify-Sql-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('modifySqlPublicNetworkAccess')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.json new file mode 100644 index 000000000..7582604ae --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.json @@ -0,0 +1,101 @@ +{ + "name": "Enforce-Guardrails-ServiceBus", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Service Bus", + "description": "This policy initiative is a group of policies that ensures Service Bus is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Service Bus", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "serviceBusModifyDisableLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "serviceBusDenyDisabledLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "serviceBusDoubleEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "serviceBusAuthzRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Sb-Authz-Rules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a1817ec0-a368-432a-8057-8371e17ac6ee", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusAuthzRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sb-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ebaf4f25-a4e8-415f-86a8-42d9155bef0b", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDoubleEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Sb-LocalAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cfb11c26-f069-4c14-8e36-56c394dae5af", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDenyDisabledLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Sb-LocalAuth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/910711a6-8aa2-4f15-ae62-1e5b2ed3ef9e", + "parameters": { + "effect": { + "value": "[[parameters('serviceBusModifyDisableLocalAuth')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.parameters.json new file mode 100644 index 000000000..6f07aa36a --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-ServiceBus.parameters.json @@ -0,0 +1,30 @@ +{ + "Deny-Sb-Authz-Rules": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusAuthzRules')]" + } + } + }, + "Deny-Sb-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDoubleEncryption')]" + } + } + }, + "Deny-Sb-LocalAuth": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusDenyDisabledLocalAuth')]" + } + } + }, + "Modify-Sb-LocalAuth": { + "parameters": { + "effect": { + "value": "[[parameters('serviceBusModifyDisableLocalAuth')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.json new file mode 100644 index 000000000..931f6fafe --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.json @@ -0,0 +1,463 @@ +{ + "name": "Enforce-Guardrails-Storage", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Storage Account", + "description": "This policy initiative is a group of policies that ensures Storage is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Storage", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "storageKeysExpiration": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountNetworkRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountRestrictNetworkRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageThreatProtection": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "storageClassicToArm": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsInfraEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountSharedKey": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsCrossTenant": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsDoubleEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsCopyScope": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAccountsAllowedCopyScope": { + "type": "string", + "defaultValue": "AAD" + }, + "storageServicesEncryption": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageLocalUser": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageSftp": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageNetworkAclsBypass": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageAllowedNetworkAclsBypass": { + "type": "array", + "defaultValue": [ + "None" + ] + }, + "storageResourceAccessRulesTenantId": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageResourceAccessRulesResourceId": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageNetworkAclsVirtualNetworkRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageContainerDeleteRetentionPolicy": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "storageMinContainerDeleteRetentionInDays": { + "type": "Integer", + "defaultValue": 7 + }, + "storageCorsRules": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "modifyStorageFileSyncPublicEndpoint": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "modifyStorageAccountPublicEndpoint": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "storageAccountsModifyDisablePublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Deny-Storage-CopyScope", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CopyScope", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsCopyScope')]" + }, + "allowedCopyScope": { + "value": "[[parameters('storageAccountsAllowedCopyScope')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-ServicesEncryption", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ServicesEncryption", + "parameters": { + "effect": { + "value": "[[parameters('storageServicesEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-LocalUser", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-LocalUser", + "parameters": { + "effect": { + "value": "[[parameters('storageLocalUser')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-SFTP", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP", + "parameters": { + "effect": { + "value": "[[parameters('storageSftp')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-NetworkAclsBypass", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsBypass", + "parameters": { + "effect": { + "value": "[[parameters('storageNetworkAclsBypass')]" + }, + "allowedBypassOptions": { + "value": "[[parameters('storageAllowedNetworkAclsBypass')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-ResourceAccessRulesTenantId", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesTenantId", + "parameters": { + "effect": { + "value": "[[parameters('storageResourceAccessRulesTenantId')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-ResourceAccessRulesResourceId", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ResourceAccessRulesResourceId", + "parameters": { + "effect": { + "value": "[[parameters('storageResourceAccessRulesResourceId')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-NetworkAclsVirtualNetworkRules", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-NetworkAclsVirtualNetworkRules", + "parameters": { + "effect": { + "value": "[[parameters('storageNetworkAclsVirtualNetworkRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-ContainerDeleteRetentionPolicy", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-ContainerDeleteRetentionPolicy", + "parameters": { + "effect": { + "value": "[[parameters('storageContainerDeleteRetentionPolicy')]" + }, + "minContainerDeleteRetentionInDays": { + "value": "[[parameters('storageMinContainerDeleteRetentionInDays')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-CorsRules", + "policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-CorsRules", + "parameters": { + "effect": { + "value": "[[parameters('storageCorsRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Account-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsDoubleEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Cross-Tenant", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/92a89a79-6c52-4a7e-a03f-61306fc49312", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsCrossTenant')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Shared-Key", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountSharedKey')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Infra-Encryption", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4733ea7b-a883-42fe-8cac-97454c2a9e4a", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsInfraEncryption')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Classic", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/37e0d2fe-28a5-43d6-a273-67d37d1f5606", + "parameters": { + "effect": { + "value": "[[parameters('storageClassicToArm')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Dine-Storage-Threat-Protection", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/361c2074-3595-4e5d-8cab-4f21dffc835c", + "parameters": { + "effect": { + "value": "[[parameters('storageThreatProtection')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Restrict-NetworkRules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountRestrictNetworkRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-NetworkRules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2a1a9cdf-e04d-429a-8416-3bfb72a1b26f", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountNetworkRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Storage-Account-Keys-Expire", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/044985bb-afe1-42cd-8a36-9d5d42424537", + "parameters": { + "effect": { + "value": "[[parameters('storageKeysExpiration')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Storage-FileSync-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e07b2e9-6cd9-4c40-9ccb-52817b95133b", + "parameters": { + "effect": { + "value": "[[parameters('modifyStorageFileSyncPublicEndpoint')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Blob-Storage-Account-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b", + "parameters": { + "effect": { + "value": "[[parameters('modifyStorageAccountPublicEndpoint')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Storage-Account-PublicEndpoint", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a06d0189-92e8-4dba-b0c4-08d7669fce7d", + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsModifyDisablePublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.parameters.json new file mode 100644 index 000000000..f3d767d08 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Storage.parameters.json @@ -0,0 +1,165 @@ +{ + "Deny-Storage-Account-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsDoubleEncryption')]" + } + } + }, + "Deny-Storage-Account-Keys-Expire": { + "parameters": { + "effect": { + "value": "[[parameters('storageKeysExpiration')]" + } + } + }, + "Deny-Storage-Classic": { + "parameters": { + "effect": { + "value": "[[parameters('storageClassicToArm')]" + } + } + }, + "Deny-Storage-ContainerDeleteRetentionPolicy": { + "parameters": { + "effect": { + "value": "[[parameters('storageContainerDeleteRetentionPolicy')]" + }, + "minContainerDeleteRetentionInDays": { + "value": "[[parameters('storageMinContainerDeleteRetentionInDays')]" + } + } + }, + "Deny-Storage-CopyScope": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsCopyScope')]" + }, + "allowedCopyScope": { + "value": "[[parameters('storageAccountsAllowedCopyScope')]" + } + } + }, + "Deny-Storage-CorsRules": { + "parameters": { + "effect": { + "value": "[[parameters('storageCorsRules')]" + } + } + }, + "Deny-Storage-Cross-Tenant": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsCrossTenant')]" + } + } + }, + "Deny-Storage-Infra-Encryption": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsInfraEncryption')]" + } + } + }, + "Deny-Storage-LocalUser": { + "parameters": { + "effect": { + "value": "[[parameters('storageLocalUser')]" + } + } + }, + "Deny-Storage-NetworkAclsBypass": { + "parameters": { + "effect": { + "value": "[[parameters('storageNetworkAclsBypass')]" + }, + "allowedBypassOptions": { + "value": "[[parameters('storageAllowedNetworkAclsBypass')]" + } + } + }, + "Deny-Storage-NetworkAclsVirtualNetworkRules": { + "parameters": { + "effect": { + "value": "[[parameters('storageNetworkAclsVirtualNetworkRules')]" + } + } + }, + "Deny-Storage-NetworkRules": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountNetworkRules')]" + } + } + }, + "Deny-Storage-ResourceAccessRulesResourceId": { + "parameters": { + "effect": { + "value": "[[parameters('storageResourceAccessRulesResourceId')]" + } + } + }, + "Deny-Storage-ResourceAccessRulesTenantId": { + "parameters": { + "effect": { + "value": "[[parameters('storageResourceAccessRulesTenantId')]" + } + } + }, + "Deny-Storage-Restrict-NetworkRules": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountRestrictNetworkRules')]" + } + } + }, + "Deny-Storage-ServicesEncryption": { + "parameters": { + "effect": { + "value": "[[parameters('storageServicesEncryption')]" + } + } + }, + "Deny-Storage-SFTP": { + "parameters": { + "effect": { + "value": "[[parameters('storageSftp')]" + } + } + }, + "Deny-Storage-Shared-Key": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountSharedKey')]" + } + } + }, + "Dine-Storage-Threat-Protection": { + "parameters": { + "effect": { + "value": "[[parameters('storageThreatProtection')]" + } + } + }, + "Modify-Blob-Storage-Account-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('modifyStorageAccountPublicEndpoint')]" + } + } + }, + "Modify-Storage-Account-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('storageAccountsModifyDisablePublicNetworkAccess')]" + } + } + }, + "Modify-Storage-FileSync-PublicEndpoint": { + "parameters": { + "effect": { + "value": "[[parameters('modifyStorageFileSyncPublicEndpoint')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.json new file mode 100644 index 000000000..160708a26 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.json @@ -0,0 +1,202 @@ +{ + "name": "Enforce-Guardrails-Synapse", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Synapse workspaces", + "description": "This policy initiative is a group of policies that ensures Synapse workspaces is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Synapse", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "synapseLocalAuth": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseManagedVnet": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseDataTraffic": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseTenants": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseAllowedTenantIds": { + "type": "array", + "defaultValue": [ + "[[subscription().tenantId]" + ] + }, + "synapseFwRules": { + "type": "string", + "defaultValue": "Audit", + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ] + }, + "synapseModifyLocalAuth": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "synapseDefender": { + "type": "string", + "defaultValue": "DeployIfNotExists", + "allowedValues": [ + "DeployIfNotExists", + "Disabled" + ] + }, + "synapseModifyTlsVersion": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "synapseModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Dine-Synapse-Defender", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/951c1558-50a5-4ca3-abb6-a93e3e2367a6", + "parameters": { + "effect": { + "value": "[[parameters('synapseDefender')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Synapse-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c3624673-d2ff-48e0-b28c-5de1c6767c3c", + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Fw-Rules", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/56fd377d-098c-4f02-8406-81eb055902b8", + "parameters": { + "effect": { + "value": "[[parameters('synapseFwRules')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Tenant-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3a003702-13d2-4679-941b-937e58c443f0", + "parameters": { + "effect": { + "value": "[[parameters('synapseTenants')]" + }, + "allowedTenantIds": { + "value": "[[parameters('synapseAllowedTenantIds')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Data-Traffic", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3484ce98-c0c5-4c83-994b-c5ac24785218", + "parameters": { + "effect": { + "value": "[[parameters('synapseDataTraffic')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Managed-Vnet", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2d9dbfa3-927b-4cf0-9d0f-08747f971650", + "parameters": { + "effect": { + "value": "[[parameters('synapseManagedVnet')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Deny-Synapse-Local-Auth", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2158ddbe-fefa-408e-b43f-d4faef8ff3b8", + "parameters": { + "effect": { + "value": "[[parameters('synapseLocalAuth')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Synapse-Tls-Version", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8b5c654c-fb07-471b-aa8f-15fea733f140", + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyTlsVersion')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Synapse-Public-Network-Access", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5c8cad01-ef30-4891-b230-652dadb4876a", + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.parameters.json new file mode 100644 index 000000000..bedd39339 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-Synapse.parameters.json @@ -0,0 +1,68 @@ +{ + "Deny-Synapse-Data-Traffic": { + "parameters": { + "effect": { + "value": "[[parameters('synapseDataTraffic')]" + } + } + }, + "Deny-Synapse-Fw-Rules": { + "parameters": { + "effect": { + "value": "[[parameters('synapseFwRules')]" + } + } + }, + "Deny-Synapse-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('synapseLocalAuth')]" + } + } + }, + "Deny-Synapse-Managed-Vnet": { + "parameters": { + "effect": { + "value": "[[parameters('synapseManagedVnet')]" + } + } + }, + "Deny-Synapse-Tenant-Access": { + "parameters": { + "effect": { + "value": "[[parameters('synapseTenants')]" + }, + "allowedTenantIds": { + "value": "[[parameters('synapseAllowedTenantIds')]" + } + } + }, + "Dine-Synapse-Defender": { + "parameters": { + "effect": { + "value": "[[parameters('synapseDefender')]" + } + } + }, + "Modify-Synapse-Local-Auth": { + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyLocalAuth')]" + } + } + }, + "Modify-Synapse-Public-Network-Access": { + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyPublicNetworkAccess')]" + } + } + }, + "Modify-Synapse-Tls-Version": { + "parameters": { + "effect": { + "value": "[[parameters('synapseModifyTlsVersion')]" + } + } + } +} diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.json new file mode 100644 index 000000000..faa9fa8f9 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.json @@ -0,0 +1,62 @@ +{ + "name": "Enforce-Guardrails-VirtualDesktop", + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "scope": null, + "properties": { + "policyType": "Custom", + "displayName": "Enforce recommended guardrails for Virtual Desktop", + "description": "This policy initiative is a group of policies that ensures Virtual Desktop is compliant per regulated Landing Zones.", + "metadata": { + "version": "1.0.0", + "category": "Desktop Virtualization", + "source": "https://github.com/Azure/Enterprise-Scale/", + "alzCloudEnvironments": [ + "AzureCloud", + "AzureChinaCloud", + "AzureUSGovernment" + ] + }, + "parameters": { + "avdWorkspaceModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + }, + "avdHostPoolModifyPublicNetworkAccess": { + "type": "string", + "defaultValue": "Modify", + "allowedValues": [ + "Modify", + "Disabled" + ] + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "Modify-Workspace-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ce6ebf1d-0b94-4df9-9257-d8cacc238b4f", + "parameters": { + "effect": { + "value": "[[parameters('avdWorkspaceModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + }, + { + "policyDefinitionReferenceId": "Modify-Hostpool-PublicNetworkAccess", + "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2a0913ff-51e7-47b8-97bb-ea17127f7c8d", + "parameters": { + "effect": { + "value": "[[parameters('avdHostPoolModifyPublicNetworkAccess')]" + } + }, + "groupNames": [] + } + ], + "policyDefinitionGroups": null + } +} \ No newline at end of file diff --git a/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.parameters.json b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.parameters.json new file mode 100644 index 000000000..932234af2 --- /dev/null +++ b/infra-as-code/bicep/modules/policy/definitions/lib/policy_set_definitions/policy_set_definition_es_Enforce-Guardrails-VirtualDesktop.parameters.json @@ -0,0 +1,16 @@ +{ + "Modify-Hostpool-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('avdHostPoolModifyPublicNetworkAccess')]" + } + } + }, + "Modify-Workspace-PublicNetworkAccess": { + "parameters": { + "effect": { + "value": "[[parameters('avdWorkspaceModifyPublicNetworkAccess')]" + } + } + } +}