-
Notifications
You must be signed in to change notification settings - Fork 1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
PR for User Stories 28607-28609-28620 (#1339)
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Sacha Narinx <Springstone@users.noreply.github.com>
- Loading branch information
3 people
authored
Jun 13, 2023
1 parent
c273ebf
commit 973126f
Showing
6 changed files
with
409 additions
and
153 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
312 changes: 159 additions & 153 deletions
312
eslzArm/managementGroupTemplates/policyDefinitions/policies.json
Large diffs are not rendered by default.
Oops, something went wrong.
54 changes: 54 additions & 0 deletions
54
src/resources/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| { | ||
| "name": "Deny-Storage-SFTP", | ||
| "type": "Microsoft.Authorization/policyDefinitions", | ||
| "apiVersion": "2021-06-01", | ||
| "scope": null, | ||
| "properties": { | ||
| "policyType": "Custom", | ||
| "mode": "Indexed", | ||
| "displayName": "Storage Accounts with SFTP enabled should be denied", | ||
| "description": "This policy denies the creation of Storage Accounts with SFTP enabled for Blob Storage.", | ||
| "metadata": { | ||
| "version": "1.0.0", | ||
| "category": "Storage", | ||
| "source": "https://github.com/Azure/Enterprise-Scale/", | ||
| "alzCloudEnvironments": [ | ||
| "AzureCloud", | ||
| "AzureChinaCloud", | ||
| "AzureUSGovernment" | ||
| ] | ||
| }, | ||
| "parameters": { | ||
| "effect": { | ||
| "type": "String", | ||
| "defaultValue": "Deny", | ||
| "allowedValues": [ | ||
| "Audit", | ||
| "Deny", | ||
| "Disabled" | ||
| ], | ||
| "metadata": { | ||
| "displayName": "Effect", | ||
| "description": "The effect determines what happens when the policy rule is evaluated to match" | ||
| } | ||
| } | ||
| }, | ||
| "policyRule": { | ||
| "if": { | ||
| "allOf": [ | ||
| { | ||
| "field": "type", | ||
| "equals": "Microsoft.Storage/storageAccounts" | ||
| }, | ||
| { | ||
| "field": "Microsoft.Storage/storageAccounts/isSftpEnabled", | ||
| "equals": "true" | ||
| } | ||
| ] | ||
| }, | ||
| "then": { | ||
| "effect": "[[parameters('effect')]" | ||
| } | ||
| } | ||
| } | ||
| } |
101 changes: 101 additions & 0 deletions
101
src/resources/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Penp.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| { | ||
| "name": "Deny-Subnet-Without-Penp", | ||
| "type": "Microsoft.Authorization/policyDefinitions", | ||
| "apiVersion": "2021-06-01", | ||
| "scope": null, | ||
| "properties": { | ||
| "policyType": "Custom", | ||
| "mode": "All", | ||
| "displayName": "Subnets without Private Endpoint Network Policies enabled should be denied", | ||
| "description": "This policy denies the creation of a subnet without Private Endpoint Netwotk Policies enabled. This policy is intended for 'workload' subnets, not 'central infrastructure' (aka, 'hub') subnets.", | ||
| "metadata": { | ||
| "version": "1.0.0", | ||
| "category": "Network", | ||
| "source": "https://github.com/Azure/Enterprise-Scale/", | ||
| "alzCloudEnvironments": [ | ||
| "AzureCloud", | ||
| "AzureChinaCloud", | ||
| "AzureUSGovernment" | ||
| ] | ||
| }, | ||
| "parameters": { | ||
| "effect": { | ||
| "type": "String", | ||
| "allowedValues": [ | ||
| "Audit", | ||
| "Deny", | ||
| "Disabled" | ||
| ], | ||
| "defaultValue": "Deny", | ||
| "metadata": { | ||
| "displayName": "Effect", | ||
| "description": "The effect determines what happens when the policy rule is evaluated to match" | ||
| } | ||
| }, | ||
| "excludedSubnets": { | ||
| "type": "Array", | ||
| "metadata": { | ||
| "displayName": "Excluded Subnets", | ||
| "description": "Array of subnet names that are excluded from this policy" | ||
| }, | ||
| "defaultValue": [ | ||
| "GatewaySubnet", | ||
| "AzureFirewallSubnet", | ||
| "AzureFirewallManagementSubnet", | ||
| "AzureBastionSubnet" | ||
| ] | ||
| } | ||
| }, | ||
| "policyRule": { | ||
| "if": { | ||
| "anyOf": [ | ||
| { | ||
| "allOf": [ | ||
| { | ||
| "equals": "Microsoft.Network/virtualNetworks", | ||
| "field": "type" | ||
| }, | ||
| { | ||
| "count": { | ||
| "field": "Microsoft.Network/virtualNetworks/subnets[*]", | ||
| "where": { | ||
| "allOf": [ | ||
| { | ||
| "field": "Microsoft.Network/virtualNetworks/subnets[*].privateEndpointNetworkPolicies", | ||
| "notEquals": "Enabled" | ||
| }, | ||
| { | ||
| "field": "Microsoft.Network/virtualNetworks/subnets[*].name", | ||
| "notIn": "[[parameters('excludedSubnets')]" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "notEquals": 0 | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "allOf": [ | ||
| { | ||
| "field": "type", | ||
| "equals": "Microsoft.Network/virtualNetworks/subnets" | ||
| }, | ||
| { | ||
| "field": "name", | ||
| "notIn": "[[parameters('excludedSubnets')]" | ||
| }, | ||
| { | ||
| "field": "Microsoft.Network/virtualNetworks/subnets/privateEndpointNetworkPolicies", | ||
| "notEquals": "Enabled" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "then": { | ||
| "effect": "[[parameters('effect')]" | ||
| } | ||
| } | ||
| } | ||
| } |
87 changes: 87 additions & 0 deletions
87
src/resources/Microsoft.Authorization/policyDefinitions/Deny-UDR-With-Specific-NextHop.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| { | ||
| "name": "Deny-UDR-With-Specific-NextHop", | ||
| "type": "Microsoft.Authorization/policyDefinitions", | ||
| "apiVersion": "2021-06-01", | ||
| "scope": null, | ||
| "properties": { | ||
| "policyType": "Custom", | ||
| "mode": "All", | ||
| "displayName": "User Defined Routes with 'Next Hop Type' set to 'Internet' or 'VirtualNetworkGateway' should be denied", | ||
| "description": "This policy denies the creation of a User Defined Route with 'Next Hop Type' set to 'Internet' or 'VirtualNetworkGateway'.", | ||
| "metadata": { | ||
| "version": "1.0.0", | ||
| "category": "Network", | ||
| "source": "https://github.com/Azure/Enterprise-Scale/", | ||
| "alzCloudEnvironments": [ | ||
| "AzureCloud", | ||
| "AzureChinaCloud", | ||
| "AzureUSGovernment" | ||
| ] | ||
| }, | ||
| "parameters": { | ||
| "effect": { | ||
| "type": "String", | ||
| "metadata": { | ||
| "displayName": "Effect", | ||
| "description": "The effect determines what happens when the policy rule is evaluated to match" | ||
| }, | ||
| "allowedValues": [ | ||
| "Audit", | ||
| "Deny", | ||
| "Disabled" | ||
| ], | ||
| "defaultValue": "Deny" | ||
| }, | ||
| "excludedDestinations": { | ||
| "type": "Array", | ||
| "metadata": { | ||
| "displayName": "Excluded Destinations", | ||
| "description": "Array of route destinations that are to be denied" | ||
| }, | ||
| "defaultValue": [ | ||
| "Internet", | ||
| "VirtualNetworkGateway" | ||
| ] | ||
| } | ||
| }, | ||
| "policyRule": { | ||
| "if": { | ||
| "anyOf": [ | ||
| { | ||
| "allOf": [ | ||
| { | ||
| "equals": "Microsoft.Network/routeTables", | ||
| "field": "type" | ||
| }, | ||
| { | ||
| "count": { | ||
| "field": "Microsoft.Network/routeTables/routes[*]", | ||
| "where": { | ||
| "field": "Microsoft.Network/routeTables/routes[*].nextHopType", | ||
| "in": "[[parameters('excludedDestinations')]" | ||
| } | ||
| }, | ||
| "notEquals": 0 | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "allOf": [ | ||
| { | ||
| "field": "type", | ||
| "equals": "Microsoft.Network/routeTables/routes" | ||
| }, | ||
| { | ||
| "field": "Microsoft.Network/routeTables/routes/nextHopType", | ||
| "in": "[[parameters('excludedDestinations')]" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "then": { | ||
| "effect": "[[parameters('effect')]" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters