Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
55 commits
Select commit Hold shift + click to select a range
df214b4
Added UMI resource
oZakari May 24, 2024
64ef976
Add data collection rule
oZakari May 24, 2024
5b03e34
Update vm insights dcr name
oZakari May 28, 2024
4f9e579
Add change tracking DCR
oZakari May 28, 2024
9e573a4
Add MDFC for SQL data collection rule
oZakari May 29, 2024
c9fab0a
Remove legacy solutions
oZakari May 29, 2024
58aed9c
Change DCR default names
oZakari May 29, 2024
d560bbf
Update Policy Library (automated)
actions-user Jun 3, 2024
09816fb
Update Policy Library (automated)
actions-user Jun 5, 2024
675a0d9
Update Policy Library (automated)
actions-user Jun 6, 2024
e0d27c9
Update Policy Library (automated)
actions-user Jun 11, 2024
25e7429
Merge branch 'main' of https://github.com/Azure/ALZ-Bicep into patch-…
oZakari Jun 15, 2024
8c5fb51
Update policy and policy set definition variables
oZakari Jun 15, 2024
255aad8
Update superseded definition for mdfcconfig
oZakari Jun 15, 2024
7fe4784
Add enforce_backup assignment and deployment
oZakari Jun 16, 2024
dda1cc5
Replace custom diag intiative with built-in
oZakari Jun 16, 2024
ab58efe
Added missing endpoint for using machine learning with private dns zones
oZakari Jun 16, 2024
8b20af3
Update policy assignments api version to 2024-04-01
oZakari Jun 16, 2024
eb20521
Add policy assignment for trusted launch initiative
oZakari Jun 17, 2024
e9daeac
Supersede Deploy-EncryptTransit with Deploy-EncryptTransit_20240509
oZakari Jun 17, 2024
595c2a4
Added MD Endpoints AMA initiative and assignment
oZakari Jun 17, 2024
979fb1b
Update Policy Library (automated)
actions-user Jun 17, 2024
9294e4e
Merge remote-tracking branch 'origin/ama-integration' into patch-poli…
oZakari Jun 18, 2024
97ef20b
Cleanup param files of old workspace solutions
oZakari Jun 18, 2024
d0ddbea
Generate Parameter Markdowns [oZakari/56e2292c]
github-actions[bot] Jun 18, 2024
f814dd8
Remove resource lock for umi
oZakari Jun 18, 2024
7c369d4
Merge branch 'patch-policy-library' of https://github.com/Azure/ALZ-B…
oZakari Jun 18, 2024
b61c969
Generate Parameter Markdowns [oZakari/56e2292c]
github-actions[bot] Jun 18, 2024
e82e997
Configure change tracking assignments
oZakari Jun 19, 2024
79945e0
Add VM insights policy assignments
oZakari Jun 19, 2024
f45cd36
Add AUM-CheckUpdates enforce policy assignment
oZakari Jun 19, 2024
58e1b0f
Add assignment for mdfc-sql-ama
oZakari Jun 19, 2024
903f832
Generate Parameter Markdowns [oZakari/56e2292c]
github-actions[bot] Jun 19, 2024
8a8e968
Update Policy Library (automated)
actions-user Jun 19, 2024
d5ea40a
Remove additional unneeded LAW solutions
oZakari Jun 19, 2024
d0ae2fd
Merge branches 'patch-policy-library' and 'patch-policy-library' of h…
oZakari Jun 19, 2024
9ea826b
Change UAMI API to GA version
oZakari Jun 19, 2024
960ca75
Generate Parameter Markdowns [oZakari/56e2292c]
github-actions[bot] Jun 19, 2024
20291d8
Update infra-as-code/bicep/modules/logging/logging.bicep
oZakari Jun 19, 2024
3795283
Update infra-as-code/bicep/modules/logging/logging.bicep
oZakari Jun 19, 2024
a0f7a90
Update infra-as-code/bicep/modules/logging/logging.bicep
oZakari Jun 19, 2024
94c7cf0
Merge branches 'patch-policy-library' and 'patch-policy-library' of h…
oZakari Jun 19, 2024
e659e87
Update VM, VMSS, and ArcVM monitoring assignments to align to enterpr…
oZakari Jun 19, 2024
a174cfc
Add new AMA related resource IDs to accelerator config
oZakari Jun 19, 2024
7a5a435
Add ama resource outputs and update documentation
oZakari Jun 19, 2024
12f4de6
Generate Parameter Markdowns [oZakari/56e2292c]
github-actions[bot] Jun 19, 2024
f2faabe
Update infra-as-code/bicep/modules/policy/assignments/alzDefaults/alz…
oZakari Jun 19, 2024
8bbba66
Match policy assignment api version to match the version referenced i…
oZakari Jun 20, 2024
8051f68
Added policy assignment to block deletion of UAMI
oZakari Jun 20, 2024
a8d42a8
Update Policy Library (automated)
actions-user Jun 20, 2024
37b01dd
update to align to .txt file output
jtracey93 Jun 20, 2024
bd7c8fa
output typo
jtracey93 Jun 20, 2024
fdc813a
add outputs for UAMI
jtracey93 Jun 20, 2024
10c7217
Generate Parameter Markdowns [jtracey93/56e2292c]
github-actions[bot] Jun 20, 2024
0bec879
align to txt file
jtracey93 Jun 20, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update Policy Library (automated)
  • Loading branch information
actions-user committed Jun 6, 2024
commit 675a0d901b573c65e427a806034dfc050afce4c7
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,10 @@
name: 'DenyAction-ActivityLogs'
libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-ActivityLogs.json')
}
{
name: 'DenyAction-DeleteResources'
libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DeleteResources.json')
}
{
name: 'DenyAction-DiagnosticLogs'
libDefinition: loadJsonContent('lib/policy_definitions/policy_definition_es_DenyAction-DiagnosticLogs.json')
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
{
"name": "DenyAction-DeleteResources",
"type": "Microsoft.Authorization/policyDefinitions",
"apiVersion": "2021-06-01",
"scope": null,
"properties": {
"policyType": "Custom",
"mode": "All",
"displayName": "Do not allow deletion of specified resource and resource type",
"description": "This policy enables you to specify the resource and resource type that your organization can protect from accidentals deletion by blocking delete calls using the deny action effect.",
"metadata": {
"version": "1.0.0",
"category": "General",
"source": "https://github.com/Azure/Enterprise-Scale/",
"alzCloudEnvironments": [
"AzureCloud",
"AzureChinaCloud",
"AzureUSGovernment"
]
},
"parameters": {
"resourceName": {
"type": "String",
"metadata": {
"displayName": "Resource Name",
"description": "Provide the name of the resource that you want to protect from accidental deletion."
}
},
"resourceType": {
"type": "String",
"metadata": {
"displayName": "Resource Type",
"description": "Provide the resource type that you want to protect from accidental deletion."
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DenyAction",
"Disabled"
],
"defaultValue": "DenyAction"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "[parameters('resourceType')]"
},
{
"field": "name",
"like": "[parameters('resourceName')]"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"actionNames": [
"delete"
]
}
}
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -1846,9 +1846,9 @@ var varCustomPolicySetDefinitionsArray = [
definitionGroups: []
}
{
definitionReferenceId: 'Deny-EH-MINTLS'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-MINTLS'
definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-EH-MINTLS'].parameters
definitionReferenceId: 'Deny-EH-minTLS'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-minTLS'
definitionParameters: varPolicySetDefinitionEsEnforceEncryptTransit_20240509Parameters['Deny-EH-minTLS'].parameters
definitionGroups: []
}
{
Expand Down Expand Up @@ -3172,9 +3172,9 @@ var varCustomPolicySetDefinitionsArray = [
definitionGroups: []
}
{
definitionReferenceId: 'Deny-Subnet-Without-UDR'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-UDR'
definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-UDR'].parameters
definitionReferenceId: 'Deny-Subnet-Without-Udr'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr'
definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsNetworkParameters['Deny-Subnet-Without-Udr'].parameters
definitionGroups: []
}
{
Expand Down Expand Up @@ -3460,9 +3460,9 @@ var varCustomPolicySetDefinitionsArray = [
definitionGroups: []
}
{
definitionReferenceId: 'Deny-Storage-Sftp'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-Sftp'
definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-Sftp'].parameters
definitionReferenceId: 'Deny-Storage-SFTP'
definitionId: '${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP'
definitionParameters: varPolicySetDefinitionEsEnforceGuardrailsStorageParameters['Deny-Storage-SFTP'].parameters
definitionGroups: []
}
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -882,8 +882,8 @@
"groupNames": []
},
{
"policyDefinitionReferenceId": "Deny-EH-MINTLS",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-MINTLS",
"policyDefinitionReferenceId": "Deny-EH-minTLS",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-EH-minTLS",
"parameters": {
"effect": {
"value": "[[parameters('eventHubMinTls')]"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@
}
}
},
"Deny-EH-MINTLS": {
"Deny-EH-minTLS": {
"parameters": {
"effect": {
"value": "[[parameters('eventHubMinTls')]"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,16 +28,18 @@
]
}
},
"policyDefinitions": {
"policyDefinitionReferenceId": "Deny-ContainerInstance-Vnet",
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8af8f826-edcb-4178-b35f-851ea6fea615",
"parameters": {
"effect": {
"value": "[[parameters('containerInstanceVnet')]"
}
},
"groupNames": []
},
"policyDefinitions": [
{
"policyDefinitionReferenceId": "Deny-ContainerInstance-Vnet",
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8af8f826-edcb-4178-b35f-851ea6fea615",
"parameters": {
"effect": {
"value": "[[parameters('containerInstanceVnet')]"
}
},
"groupNames": []
}
],
"policyDefinitionGroups": null
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -408,8 +408,8 @@
"groupNames": []
},
{
"policyDefinitionReferenceId": "Deny-Subnet-Without-UDR",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-UDR",
"policyDefinitionReferenceId": "Deny-Subnet-Without-Udr",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Udr",
"parameters": {
"effect": {
"value": "[[parameters('subnetUdr')]"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@
}
}
},
"Deny-Subnet-Without-UDR": {
"Deny-Subnet-Without-Udr": {
"parameters": {
"effect": {
"value": "[[parameters('subnetUdr')]"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,16 +27,18 @@
]
}
},
"policyDefinitions": {
"policyDefinitionReferenceId": "Dine-PostgreSql-Adv-Threat-Protection",
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/db048e65-913c-49f9-bb5f-1084184671d3",
"parameters": {
"effect": {
"value": "[[parameters('postgreSqlAdvThreatProtection')]"
}
},
"groupNames": []
},
"policyDefinitions": [
{
"policyDefinitionReferenceId": "Dine-PostgreSql-Adv-Threat-Protection",
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/db048e65-913c-49f9-bb5f-1084184671d3",
"parameters": {
"effect": {
"value": "[[parameters('postgreSqlAdvThreatProtection')]"
}
},
"groupNames": []
}
],
"policyDefinitionGroups": null
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -262,8 +262,8 @@
"groupNames": []
},
{
"policyDefinitionReferenceId": "Deny-Storage-Sftp",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-Sftp",
"policyDefinitionReferenceId": "Deny-Storage-SFTP",
"policyDefinitionId": "${varTargetManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Deny-Storage-SFTP",
"parameters": {
"effect": {
"value": "[[parameters('storageSftp')]"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@
}
}
},
"Deny-Storage-Sftp": {
"Deny-Storage-SFTP": {
"parameters": {
"effect": {
"value": "[[parameters('storageSftp')]"
Expand Down