GH 1423 - Policy PaaS should Disable Public Access for Container Apps

docs/wiki/Whats-new.md

@@ -43,6 +43,8 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
 
 #### Policy
 
+- Added ['Container Apps environment should disable public network access'](https://www.azadvertizer.net/azpolicyadvertizer/d074ddf8-01a5-4b5e-a2b8-964aed452c0a.html) to ['Deny-PublicPaaSEndpoints'.](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deny-PublicPaaSEndpoints.html)
+- Added ['Container Apps should only be accessible over HTTPS'](https://www.azadvertizer.net/azpolicyadvertizer/0e80e269-43a4-4ae9-b5bc-178126b8a5cb.html) to this ['Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit'.](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Enforce-EncryptTransit.html)
 - The portal accelerator experience has been updated to include deployment of Azure Monitor baseline alerts. Details on the policies deployed can be found [here](https://aka.ms/amba/alz).
 - Fixed issue with couple of Policy file names to align with the actual name of the policies
 - Bug fix for [Deploy-MDFC-Config](https://www.azadvertizer.net/azpolicyinitiativesadvertizer/Deploy-MDFC-Config.html) version

src/resources/Microsoft.Authorization/policySetDefinitions/Deny-PublicPaaSEndpoints.json

@@ -8,7 +8,7 @@
     "displayName": "Public network access should be disabled for PaaS services",
     "description": "This policy initiative is a group of policies that prevents creation of Azure PaaS services with exposed public endpoints",
     "metadata": {
-      "version": "3.1.0",
+      "version": "3.2.0",
       "category": "Network",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -274,6 +274,19 @@
           "Disabled"
         ],
         "defaultValue": "AuditIfNotExists"
+      },
+      "ContainerAppsEnvironmentDenyEffect" : {
+        "type": "String",
+        "metadata": {
+          "displayName": "Container Apps environment should disable public network access",
+          "description": "This policy denies creation of Container Apps Environment with exposed public endpoints"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Deny"
       }
     },
     "policyDefinitions": [
@@ -476,8 +489,18 @@
           }
         },
         "groupNames": []
+      },
+      {
+        "policyDefinitionReferenceId": "ContainerAppsEnvironmentDenyPublicIP",
+        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d074ddf8-01a5-4b5e-a2b8-964aed452c0a",
+        "parameters": {
+          "effect": {
+            "value": "[[parameters('ContainerAppsEnvironmentDenyEffect')]"
+          }
+        },
+        "groupNames": []
       }
     ],
     "policyDefinitionGroups": null
   }
-}
+}

src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit.json

@@ -360,6 +360,19 @@
           "Deny",
           "Disabled"
         ]
+      },
+      "ContainerAppsHttpsOnlyEffect": {
+        "metadata": {
+          "displayName": "Container Apps should only be accessible over HTTPS",
+          "description": "Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Disabling 'allowInsecure' will result in the automatic redirection of requests from HTTP to HTTPS connections for container apps."
+        },
+        "type": "String",
+        "defaultValue": "Deny",
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ]
       }
     },
     "policyDefinitions": [
@@ -611,8 +624,18 @@
           }
         },
         "groupNames": []
+      },
+      {
+        "policyDefinitionReferenceId": "ContainerAppsHttpsOnlyEffect",
+        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb",
+        "parameters": {
+          "effect": {
+            "value": "[[parameters('ContainerAppsHttpsOnlyEffect')]"
+          }
+        },
+        "groupNames": []
       }
     ],
     "policyDefinitionGroups": null
   }
-}
+}