Skip to content

Commit e369a22

Browse files
pilorAzure Policy Bot
pilor
and
Azure Policy Bot
authored
Built-in Policy Release 2ee49b41 (#1233)
Co-authored-by: Azure Policy Bot <azgovpolicy@microsoft.com>
1 parent 63cb496 commit e369a22

12 files changed

+187
-60
lines changed

‎built-in-policies/policyDefinitions/Data Factory/SSISIR_JoinVirtualNetwork_Audit.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "All",
66
"description": "Azure Virtual Network deployment provides enhanced security and isolation for your SQL Server Integration Services integration runtimes on Azure Data Factory, as well as subnets, access control policies, and other features to further restrict access.",
77
"metadata": {
8-
"version": "2.1.0",
8+
"version": "2.2.0",
99
"category": "Data Factory"
1010
},
11-
"version": "2.1.0",
11+
"version": "2.2.0",
1212
"parameters": {
1313
"effect": {
1414
"type": "string",
@@ -41,6 +41,10 @@
4141
"field": "Microsoft.DataFactory/factories/integrationRuntimes/Managed.typeProperties.computeProperties.vnetProperties.vnetId",
4242
"exists": "false"
4343
},
44+
{
45+
"field": "Microsoft.DataFactory/factories/integrationRuntimes/Managed.typeProperties.computeProperties.vNetProperties.subnetId",
46+
"exists": "false"
47+
},
4448
{
4549
"field": "Microsoft.DataFactory/factories/integrationRuntimes/Managed.typeProperties.customerVirtualNetwork.subnetId",
4650
"exists": "false"

‎built-in-policies/policyDefinitions/General/ResourceType_denyActionDelete.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"properties": {
3+
"displayName": "[Preview]: Do not allow deletion of resource types",
4+
"policyType": "BuiltIn",
5+
"mode": "All",
6+
"description": "This policy enables you to specify the resource types that your organization can protect from accidentals deletion by blocking delete calls using deny action effect.",
7+
"metadata": {
8+
"version": "1.0.0-preview",
9+
"category": "General",
10+
"preview": true
11+
},
12+
"version": "1.0.0-preview",
13+
"parameters": {
14+
"listOfResourceTypesDisallowedForDeletion": {
15+
"type": "Array",
16+
"metadata": {
17+
"displayName": "Resource types that cannot be deleted",
18+
"description": "The list of resource types that cannot be deleted.",
19+
"strongType": "resourceTypes"
20+
}
21+
},
22+
"effect": {
23+
"type": "String",
24+
"metadata": {
25+
"displayName": "Effect",
26+
"description": "Enable or disable the execution of the policy"
27+
},
28+
"allowedValues": [
29+
"DenyAction",
30+
"Disabled"
31+
],
32+
"defaultValue": "DenyAction"
33+
}
34+
},
35+
"policyRule": {
36+
"if": {
37+
"field": "type",
38+
"in": "[parameters('listOfResourceTypesDisallowedForDeletion')]"
39+
},
40+
"then": {
41+
"effect": "[parameters('effect')]",
42+
"details": {
43+
"actionNames": [
44+
"delete"
45+
]
46+
}
47+
}
48+
}
49+
},
50+
"id": "/providers/Microsoft.Authorization/policyDefinitions/78460a36-508a-49a4-b2b2-2f5ec564f4bb",
51+
"name": "78460a36-508a-49a4-b2b2-2f5ec564f4bb"
52+
}

‎built-in-policies/policyDefinitions/Kubernetes/AKS_AAD_AdminGroup_Deploy.json

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"properties": {
33
"policyType": "BuiltIn",
4-
"displayName": "Configure AAD integrated Azure Kubernetes Service Clusters with required Admin Group Access",
5-
"description": "Ensure to improve cluster security by centrally govern Administrator access to Azure Active Directory integrated AKS clusters.",
4+
"displayName": "Configure Microsoft Entra ID integrated Azure Kubernetes Service Clusters with required Admin Group Access",
5+
"description": "Ensure to improve cluster security by centrally govern Administrator access to Microsoft Entra ID integrated AKS clusters.",
66
"metadata": {
7-
"version": "2.0.1",
7+
"version": "2.0.3",
88
"category": "Kubernetes"
99
},
10-
"version": "2.0.1",
10+
"version": "2.0.3",
1111
"mode": "Indexed",
1212
"parameters": {
1313
"effect": {
@@ -160,12 +160,12 @@
160160
"networkProfile": "[if(contains(parameters('aksClusterContent').properties, 'networkProfile'), parameters('aksClusterContent').properties.networkProfile, json('null'))]",
161161
"aadProfile": {
162162
"adminGroupObjectIds": "[parameters('adminGroupObjectIDs')]",
163-
"managed": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'managed'), parameters('aksClusterContent').properties.aadProfile.managed, json('null'))]",
164-
"enableAzureRBAC": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'enableAzureRBAC'), parameters('aksClusterContent').properties.aadProfile.enableAzureRBAC, json('null'))]",
165-
"tenantID": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'tenantID'), parameters('aksClusterContent').properties.aadProfile.tenantID, json('null'))]",
166-
"clientAppID": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'clientAppID'), parameters('aksClusterContent').properties.aadProfile.clientAppID, json('null'))]",
167-
"serverAppID": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'serverAppID'), parameters('aksClusterContent').properties.aadProfile.serverAppID, json('null'))]",
168-
"serverAppSecret": "[if(contains(parameters('aksClusterContent').properties.aadProfile, 'serverAppSecret'), parameters('aksClusterContent').properties.aadProfile.serverAppSecret, json('null'))]"
163+
"managed": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'managed')), parameters('aksClusterContent').properties.aadProfile.managed, json('null'))]",
164+
"enableAzureRBAC": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'enableAzureRBAC')), parameters('aksClusterContent').properties.aadProfile.enableAzureRBAC, json('null'))]",
165+
"tenantID": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'tenantID')), parameters('aksClusterContent').properties.aadProfile.tenantID, json('null'))]",
166+
"clientAppID": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'clientAppID')), parameters('aksClusterContent').properties.aadProfile.clientAppID, json('null'))]",
167+
"serverAppID": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'serverAppID')), parameters('aksClusterContent').properties.aadProfile.serverAppID, json('null'))]",
168+
"serverAppSecret": "[if(and(contains(parameters('aksClusterContent').properties, 'aadProfile'), contains(parameters('aksClusterContent').properties.aadProfile, 'serverAppSecret')), parameters('aksClusterContent').properties.aadProfile.serverAppSecret, json('null'))]"
169169
},
170170
"autoScalerProfile": "[if(contains(parameters('aksClusterContent').properties, 'autoScalerProfile'), parameters('aksClusterContent').properties.autoScalerProfile, json('null'))]",
171171
"autoUpgradeProfile": "[if(contains(parameters('aksClusterContent').properties, 'autoUpgradeProfile'), parameters('aksClusterContent').properties.autoUpgradeProfile, json('null'))]",

‎built-in-policies/policyDefinitions/Kubernetes/AKS_AAD_Integration_Audit.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"properties": {
33
"policyType": "BuiltIn",
4-
"displayName": "Azure Kubernetes Service Clusters should enable Azure Active Directory integration",
5-
"description": "AKS-managed Azure Active Directory integration can manage the access to the clusters by configuring Kubernetes role-based access control (Kubernetes RBAC) based on a user's identity or directory group membership. Learn more at: https://aka.ms/aks-managed-aad.",
4+
"displayName": "Azure Kubernetes Service Clusters should enable Microsoft Entra ID integration",
5+
"description": "AKS-managed Microsoft Entra ID integration can manage the access to the clusters by configuring Kubernetes role-based access control (Kubernetes RBAC) based on a user's identity or directory group membership. Learn more at: https://aka.ms/aks-managed-aad.",
66
"metadata": {
7-
"version": "1.0.1",
7+
"version": "1.0.2",
88
"category": "Kubernetes"
99
},
10-
"version": "1.0.1",
10+
"version": "1.0.2",
1111
"mode": "Indexed",
1212
"parameters": {
1313
"effect": {

‎built-in-policies/policyDefinitions/Kubernetes/AKS_DisableRunCommand_Deploy.json

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"description": "Disabling command invoke can enhance the security by rejecting invoke-command access to the cluster",
66
"mode": "Indexed",
77
"metadata": {
8-
"version": "1.0.1",
8+
"version": "1.0.2",
99
"category": "Kubernetes"
1010
},
11-
"version": "1.0.1",
11+
"version": "1.0.2",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -124,11 +124,7 @@
124124
"autoScalerProfile": "[if(contains(parameters('aksClusterContent').properties, 'autoScalerProfile'), parameters('aksClusterContent').properties.autoScalerProfile, json('null'))]",
125125
"autoUpgradeProfile": "[if(contains(parameters('aksClusterContent').properties, 'autoUpgradeProfile'), parameters('aksClusterContent').properties.autoUpgradeProfile, json('null'))]",
126126
"apiServerAccessProfile": {
127-
"authorizedIPRanges": "[if(contains(parameters('aksClusterContent').properties.apiServerAccessProfile, 'authorizedIPRanges'), parameters('aksClusterContent').properties.apiServerAccessProfile.authorizedIPRanges, json('null'))]",
128-
"disableRunCommand": true,
129-
"enablePrivateCluster": "[if(contains(parameters('aksClusterContent').properties.apiServerAccessProfile, 'enablePrivateCluster'), parameters('aksClusterContent').properties.apiServerAccessProfile.enablePrivateCluster, json('null'))]",
130-
"enablePrivateClusterPublicFQDN": "[if(contains(parameters('aksClusterContent').properties.apiServerAccessProfile, 'enablePrivateClusterPublicFQDN'), parameters('aksClusterContent').properties.apiServerAccessProfile.enablePrivateClusterPublicFQDN, json('null'))]",
131-
"privateDNSZone": "[if(contains(parameters('aksClusterContent').properties.apiServerAccessProfile, 'privateDNSZone'), parameters('aksClusterContent').properties.apiServerAccessProfile.privateDNSZone, json('null'))]"
127+
"disableRunCommand": true
132128
},
133129
"diskEncryptionSetID": "[if(contains(parameters('aksClusterContent').properties, 'diskEncryptionSetID'), parameters('aksClusterContent').properties.diskEncryptionSetID, json('null'))]",
134130
"disableLocalAccounts": "[if(contains(parameters('aksClusterContent').properties, 'disableLocalAccounts'), parameters('aksClusterContent').properties.disableLocalAccounts, json('null'))]",

‎built-in-policies/policyDefinitions/Kubernetes/AKS_ImageCleaner_Deploy.json

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"description": "Deploy Image Cleaner on Azure Kubernetes clusters. For more info, visit https://aka.ms/aks/image-cleaner",
66
"mode": "Indexed",
77
"metadata": {
8-
"version": "1.0.0",
8+
"version": "1.0.2",
99
"category": "Kubernetes"
1010
},
11-
"version": "1.0.0",
11+
"version": "1.0.2",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -126,15 +126,13 @@
126126
"properties": {
127127
"kubernetesVersion": "[parameters('aksClusterContent').properties.kubernetesVersion]",
128128
"dnsPrefix": "[parameters('aksClusterContent').properties.dnsPrefix]",
129-
"agentPoolProfiles": "[if(contains(parameters('aksClusterContent').properties, 'agentPoolProfiles'), parameters('aksClusterContent').properties.agentPoolProfiles, json('null'))]",
130129
"linuxProfile": "[if(contains(parameters('aksClusterContent').properties, 'linuxProfile'), parameters('aksClusterContent').properties.linuxProfile, json('null'))]",
131130
"windowsProfile": "[if(contains(parameters('aksClusterContent').properties, 'windowsProfile'), parameters('aksClusterContent').properties.windowsProfile, json('null'))]",
132131
"servicePrincipalProfile": "[if(contains(parameters('aksClusterContent').properties, 'servicePrincipalProfile'), parameters('aksClusterContent').properties.servicePrincipalProfile, json('null'))]",
133132
"nodeResourceGroup": "[parameters('aksClusterContent').properties.nodeResourceGroup]",
134133
"enableRBAC": "[if(contains(parameters('aksClusterContent').properties, 'enableRBAC'), parameters('aksClusterContent').properties.enableRBAC, json('null'))]",
135134
"enablePodSecurityPolicy": "[if(contains(parameters('aksClusterContent').properties, 'enablePodSecurityPolicy'), parameters('aksClusterContent').properties.enablePodSecurityPolicy, json('null'))]",
136135
"networkProfile": "[if(contains(parameters('aksClusterContent').properties, 'networkProfile'), parameters('aksClusterContent').properties.networkProfile, json('null'))]",
137-
"addonProfiles": "[if(contains(parameters('aksClusterContent').properties, 'addonProfiles'), parameters('aksClusterContent').properties.addonProfiles, json('null'))]",
138136
"oidcIssuerProfile": "[if(contains(parameters('aksClusterContent').properties, 'oidcIssuerProfile'), parameters('aksClusterContent').properties.oidcIssuerProfile, json('null'))]",
139137
"aadProfile": "[if(contains(parameters('aksClusterContent').properties, 'aadProfile'), parameters('aksClusterContent').properties.aadProfile, json('null'))]",
140138
"autoScalerProfile": "[if(contains(parameters('aksClusterContent').properties, 'autoScalerProfile'), parameters('aksClusterContent').properties.autoScalerProfile, json('null'))]",
@@ -147,13 +145,10 @@
147145
"podIdentityProfile": "[if(contains(parameters('aksClusterContent').properties, 'podIdentityProfile'), parameters('aksClusterContent').properties.podIdentityProfile, json('null'))]",
148146
"privateLinkResources": "[if(contains(parameters('aksClusterContent').properties, 'privateLinkResources'), parameters('aksClusterContent').properties.privateLinkResources, json('null'))]",
149147
"securityProfile": {
150-
"azureKeyVaultKms": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'azureKeyVaultKms'), parameters('aksClusterContent').properties.securityProfile.azureKeyVaultKms, json('null'))]",
151148
"imageCleaner": {
152149
"enabled": true,
153-
"intervalHours": "[if(and(contains(parameters('aksClusterContent').properties.securityProfile, 'imageCleaner'), contains(parameters('aksClusterContent').properties.securityProfile.imageCleaner, 'intervalHours')), parameters('aksClusterContent').properties.securityProfile.imageCleaner.intervalHours, parameters('defaultIntervalHours'))]"
154-
},
155-
"workloadIdentity": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'workloadIdentity'), parameters('aksClusterContent').properties.securityProfile.workloadIdentity, json('null'))]",
156-
"defender": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'defender'), parameters('aksClusterContent').properties.securityProfile.defender, json('null'))]"
150+
"intervalHours": "[if(and(contains(parameters('aksClusterContent').properties, 'securityProfile'), contains(parameters('aksClusterContent').properties.securityProfile, 'imageCleaner'), contains(parameters('aksClusterContent').properties.securityProfile.imageCleaner, 'intervalHours')), parameters('aksClusterContent').properties.securityProfile.imageCleaner.intervalHours, parameters('defaultIntervalHours'))]"
151+
}
157152
},
158153
"identityProfile": "[if(contains(parameters('aksClusterContent').properties, 'identityProfile'), parameters('aksClusterContent').properties.identityProfile, json('null'))]"
159154
}

‎built-in-policies/policyDefinitions/Kubernetes/AKS_ImageIntegrity_Deploy.json

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"description": "Deploy both Image Integrity and Policy Add-Ons Azure Kubernetes clusters. For more info, visit https://aka.ms/aks/image-integrity",
66
"mode": "Indexed",
77
"metadata": {
8-
"version": "1.0.1-preview",
8+
"version": "1.0.3-preview",
99
"category": "Kubernetes"
1010
},
11-
"version": "1.0.1-preview",
11+
"version": "1.0.3-preview",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -111,7 +111,6 @@
111111
"properties": {
112112
"kubernetesVersion": "[parameters('aksClusterContent').properties.kubernetesVersion]",
113113
"dnsPrefix": "[parameters('aksClusterContent').properties.dnsPrefix]",
114-
"agentPoolProfiles": "[if(contains(parameters('aksClusterContent').properties, 'agentPoolProfiles'), parameters('aksClusterContent').properties.agentPoolProfiles, json('null'))]",
115114
"linuxProfile": "[if(contains(parameters('aksClusterContent').properties, 'linuxProfile'), parameters('aksClusterContent').properties.linuxProfile, json('null'))]",
116115
"windowsProfile": "[if(contains(parameters('aksClusterContent').properties, 'windowsProfile'), parameters('aksClusterContent').properties.windowsProfile, json('null'))]",
117116
"servicePrincipalProfile": "[if(contains(parameters('aksClusterContent').properties, 'servicePrincipalProfile'), parameters('aksClusterContent').properties.servicePrincipalProfile, json('null'))]",
@@ -140,12 +139,7 @@
140139
"securityProfile": {
141140
"imageIntegrity": {
142141
"enabled": true
143-
},
144-
"azureKeyVaultKms": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'azureKeyVaultKms'), parameters('aksClusterContent').properties.securityProfile.azureKeyVaultKms, json('null'))]",
145-
"imageCleaner": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'imageCleaner'), parameters('aksClusterContent').properties.securityProfile.imageCleaner, json('null'))]",
146-
"nodeRestriction": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'nodeRestriction'), parameters('aksClusterContent').properties.securityProfile.nodeRestriction, json('null'))]",
147-
"workloadIdentity": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'workloadIdentity'), parameters('aksClusterContent').properties.securityProfile.workloadIdentity, json('null'))]",
148-
"defender": "[if(contains(parameters('aksClusterContent').properties.securityProfile, 'defender'), parameters('aksClusterContent').properties.securityProfile.defender, json('null'))]"
142+
}
149143
},
150144
"identityProfile": "[if(contains(parameters('aksClusterContent').properties, 'identityProfile'), parameters('aksClusterContent').properties.identityProfile, json('null'))]"
151145
}

‎built-in-policies/policyDefinitions/Tags/DenyTag.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Denies the creation of a resource that contains the given tag. Does not apply to resource groups.",
77
"metadata": {
8-
"version": "1.0.1",
8+
"version": "2.0.0",
99
"category": "Tags"
1010
},
11-
"version": "1.0.1",
11+
"version": "2.0.0",
1212
"parameters": {
1313
"tagName": {
1414
"type": "String",

0 commit comments

Comments
 (0)