New generic policy for PaaS resources private endpoint to override Private DNS zone.

docs/wiki/Whats-new.md

@@ -84,16 +84,11 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
     - Add an additional role assignment for ChangeTracking Policies that are assigned at Landing Zone management group scope, granting the Managed Identity the Reader role on the Platform management group.
     - Add an additional role assignment to Azure Update Manger Policies, granting Managed Identity Operator at the same scope as the assignment.
   - **To update an existing deployment:**
-    - For each of the VMInsights and ChangeTracking Initiative assignments:
-      - **Only required for the Initiatives assigned to Landing Zones Management group scope**
-      - Go to the Initiative assignment, go to the Managed Identity tab and copy the Principal ID
-      - Go to Management Groups, select the Platform Management group and go to Access control (IAM)
-      - Add a new role assignment and assign the Reader role the Principal ID that was copied in the first step.
-    - For each of the Azure Update Manger Initiative assignments:
-      - **Applies to the Initiatives assigned to both the Landing Zones and the Platform Management group scopes**
-      - Go to the Initiative assignment, go to the Managed Identity tab and copy the Principal ID
-      - Go to Management Groups, select the same management group as the assignment you copied the Principal ID from and go to Access control (IAM)
-      - Add a new role assignment and assign the Managed Identity Operator role the Principal ID that was copied in the first step.
+    - This script [Set-RBACAmaPolicyAssignment.ps1](https://github.com/Azure/Enterprise-Scale/blob/main/src/scripts/Set-RBACAmaPolicyAssignment.ps1) will update the required role assignments. The `enterpriseScaleCompanyPrefix` parameter is required for running the script and should contain the intermediate root management group name.
+
+      ```powershell
+      .\Set-RBACAmaPolicyAssignment.ps1 -enterpriseScaleCompanyPrefix contoso
+      ```
 
 ### February 2024
 

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-Private DNS zone-PaaS-Private endpoint-Allowed values.json

@@ -0,0 +1,233 @@
+    {
+    "name": "Configure a private DNS Zone ID for Paas services-Generic policy for PaaS services dosent has builtin policies",
+    "type": "Microsoft.Authorization/policyDefinitions",
+    "apiVersion": "2021-06-01",
+    "scope": null,
+    "properties": {
+        "policyType": "Custom",
+        "mode": "All",
+        "displayName": "Configure a private DNS Zone ID for Paas services-Generic policy for PaaS services dosent has builtin policies",
+        "description": "Configure private DNS zone group to override the DNS resolution for PaaS services private endpoint",
+        "metadata": {
+        "version": "1.1.0",
+        "category": "Generic",
+        "source": "https://github.com/Azure/Enterprise-Scale/",
+        "alzCloudEnvironments": [
+            "AzureCloud"
+        ]
+        },
+        "parameters": {
+        "effect": {
+            "type": "String",
+            "metadata": {
+            "displayName": "Effect",
+            "description": "Enable or disable the execution of the policy"
+            },
+            "allowedValues": [
+            "DeployIfNotExists",
+            "Disabled"
+            ],
+            "defaultValue": "DeployIfNotExists"
+        },
+            "privateDnsZoneId": {
+            "type": "String",
+            "metadata": {
+            "displayName": "Private DNS Zone ID for Paas services",
+            "description": "The private DNS zone name required for specific Paas Services to resolve a private DNS Zone.",
+            "strongType": "Microsoft.Network/privateDnsZones",
+            "assignPermissions": true
+            }
+        },
+        "ResourceType": {
+            "type": "String",
+            "metadata": {
+            "displayName": "PaaS private endpoint resource type",
+            "description": "The PaaS service endpoint resource type."
+            },
+      "allowedValues": [
+        "Microsoft.CognitiveServices/accounts",
+        "Microsoft.BotService/botServices",
+        "Microsoft.Synapse/privateLinkHubs",
+        "Microsoft.EventHub/namespaces",
+        "Microsoft.ServiceBus/namespaces",
+        "Microsoft.DataFactory/factories",
+        "Microsoft.Kusto/Clusters",
+        "Microsoft.PowerBI/privateLinkServicesForPowerBI",
+        "Microsoft.Databricks/workspaces",
+        "Microsoft.Batch/batchAccounts",
+        "Microsoft.DesktopVirtualization/workspaces",
+        "Microsoft.DesktopVirtualization/hostpools",
+        "Microsoft.ContainerService/managedClusters",
+        "Microsoft.ContainerRegistry/registries",
+        "Microsoft.Sql/servers",
+        "Microsoft.Sql/managedInstances",
+        "Microsoft.DocumentDB/databaseAccounts",
+        "Microsoft.DBforPostgreSQL/serverGroupsv2",
+        "Microsoft.DBforPostgreSQL/servers",
+        "Microsoft.DBforMySQL/servers",
+        "Microsoft.DBforMySQL/flexibleServers",
+        "Microsoft.DBforMariaDB/servers",
+        "Microsoft.Cache/RedisEnterprise",
+        "Microsoft.EventGrid/partnerNamespaces",
+        "Microsoft.ApiManagement/service",
+        "Microsoft.HealthcareApis/workspaces",
+        "Microsoft.Devices/ProvisioningServices",
+        "Microsoft.DeviceUpdate/accounts",
+        "Microsoft.IoTCentral/IoTApps",
+        "Microsoft.DigitalTwins/digitalTwinsInstances",
+        "Microsoft.RecoveryServices/vaults",
+        "Microsoft.Purview/accounts",
+        "Microsoft.Authorization/resourceManagementPrivateLinks",
+        "Microsoft.Dashboard/grafana",
+        "Microsoft.KeyVault/managedHSMs",
+        "Microsoft.AppConfiguration/configurationStores",
+        "Microsoft.Attestation/attestationProviders",
+        "Microsoft.Storage/storageAccounts",
+        "Microsoft.StorageSync/storageSyncServices",
+        "Microsoft.Compute/diskAccesses",
+        "Microsoft.Search/searchServices",
+        "Microsoft.Relay/namespaces"
+      ]
+        },
+        "groupId": {
+            "type": "String",
+            "metadata": {
+            "displayName": "PaaS Private endpoint group ID",
+            "description": "The group ID of the PaaS private endpoint."
+            },
+      "allowedValues": [
+        "Account",
+        "Bot",
+        "Token",
+        "Web",
+        "namespace",
+        "dataFactory",
+        "portal",
+        "cluster",
+        "tenant",
+        "databricks_ui_api",
+        "browser_authentication",
+        "nodeManagement",
+        "global",
+        "feed",
+        "connection",
+        "management",
+        "registry",
+        "sqlServer",
+        "managedInstance",
+        "Analytical",
+        "coordinator",
+        "postgresqlServer",
+        "mysqlServer",
+        "mariadbServer",
+        "redisEnterprise",
+        "partnernamespace",
+        "gateway",
+        "healthcareworkspace",
+        "iotDps",
+        "DeviceUpdate",
+        "iotApp",
+        "API",
+        "AzureBackup",
+        "account",
+        "ResourceManagement",
+        "grafana",
+        "managedhsm",
+        "configurationStores",
+        "standard",
+        "table",
+        "table_secondary",
+        "afs",
+        "disks",
+        "searchService"
+      ]
+        },
+        "policyRule": {
+            "if": {
+            "allOf": [
+                {
+                "field": "type",
+                "equals": "Microsoft.Network/privateEndpoints"
+                },
+                {
+                "count": {
+                    "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]",
+                    "where": {
+                    "allOf": [
+                        {
+                        "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId",
+                        "contains": "[parameters('ResourceType')]"
+                        },
+                        {
+                        "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
+                        "equals": "[parameters('groupId')]"
+                        }
+                    ]
+                    }
+                },
+                "greaterOrEquals": 1
+                }
+            ]
+            },
+            "then": {
+            "effect": "[parameters('effect')]",
+            "details": {
+                "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                "roleDefinitionIds": [
+                "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
+                ],
+                "deployment": {
+                "properties": {
+                    "mode": "incremental",
+                    "template": {
+                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                    "contentVersion": "1.0.0.0",
+                    "parameters": {
+                        "privateDnsZoneId": {
+                        "type": "string"
+                        },
+                        "privateEndpointName": {
+                        "type": "string"
+                        },
+                        "location": {
+                        "type": "string"
+                        }
+                    },
+                    "resources": [
+                        {
+                        "name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
+                        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                        "apiVersion": "2020-03-01",
+                        "location": "[parameters('location')]",
+                        "properties": {
+                            "privateDnsZoneConfigs": [
+                            {
+                                "name": "PaasService-privateDnsZone",
+                                "properties": {
+                                "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
+                                }
+                            }
+                            ]
+                        }
+                        }
+                    ]
+                    },
+                "parameters": {
+                "privateDnsZoneId": {
+                    "value": "[parameters('privateDnsZoneId')]"
+                },
+                "privateEndpointName": {
+                    "value": "[field('name')]"
+                },
+                "location": {
+                    "value": "[field('location')]"
+                }
+                }
+            }
+            }
+        }
+        }
+    }
+    }
+    }
+    }

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-Private DNS zone-PaaS-Private endpoint.json

@@ -0,0 +1,143 @@
+    {
+    "name": "Configure a private DNS Zone ID for Paas services-Generic policy",
+    "type": "Microsoft.Authorization/policyDefinitions",
+    "apiVersion": "2021-06-01",
+    "scope": null,
+    "properties": {
+        "policyType": "Custom",
+        "mode": "All",
+        "displayName": "Configure a private DNS Zone ID for Paas services-Generic policy",
+        "description": "Configure private DNS zone group to override the DNS resolution for PaaS services private endpoint",
+        "metadata": {
+        "version": "1.1.0",
+        "category": "Generic",
+        "source": "https://github.com/Azure/Enterprise-Scale/",
+        "alzCloudEnvironments": [
+            "AzureCloud"
+        ]
+        },
+        "parameters": {
+        "effect": {
+            "type": "String",
+            "metadata": {
+            "displayName": "Effect",
+            "description": "Enable or disable the execution of the policy"
+            },
+            "allowedValues": [
+            "DeployIfNotExists",
+            "Disabled"
+            ],
+            "defaultValue": "DeployIfNotExists"
+        },
+            "privateDnsZoneId": {
+            "type": "String",
+            "metadata": {
+            "displayName": "Private DNS Zone ID for Paas services",
+            "description": "The private DNS zone name required for specific Paas Services to resolve a private DNS Zone.",
+            "strongType": "Microsoft.Network/privateDnsZones",
+            "assignPermissions": true
+            }
+        },
+        "ResourceType": {
+            "type": "String",
+            "metadata": {
+            "displayName": "PaaS private endpoint resource type",
+            "description": "The PaaS endpoint resource type."
+            }
+        },
+        "groupId": {
+            "type": "String",
+            "metadata": {
+            "displayName": "PaaS Private endpoint group ID",
+            "description": "The group ID of the PaaS private endpoint."
+            }
+        },
+        "policyRule": {
+            "if": {
+            "allOf": [
+                {
+                "field": "type",
+                "equals": "Microsoft.Network/privateEndpoints"
+                },
+                {
+                "count": {
+                    "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]",
+                    "where": {
+                    "allOf": [
+                        {
+                        "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId",
+                        "contains": "[parameters('ResourceType')]"
+                        },
+                        {
+                        "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
+                        "equals": "[parameters('groupId')]"
+                        }
+                    ]
+                    }
+                },
+                "greaterOrEquals": 1
+                }
+            ]
+            },
+            "then": {
+            "effect": "[parameters('effect')]",
+            "details": {
+                "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                "roleDefinitionIds": [
+                "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
+                ],
+                "deployment": {
+                "properties": {
+                    "mode": "incremental",
+                    "template": {
+                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                    "contentVersion": "1.0.0.0",
+                    "parameters": {
+                        "privateDnsZoneId": {
+                        "type": "string"
+                        },
+                        "privateEndpointName": {
+                        "type": "string"
+                        },
+                        "location": {
+                        "type": "string"
+                        }
+                    },
+                    "resources": [
+                        {
+                        "name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
+                        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                        "apiVersion": "2020-03-01",
+                        "location": "[parameters('location')]",
+                        "properties": {
+                            "privateDnsZoneConfigs": [
+                            {
+                                "name": "PaasService-privateDnsZone",
+                                "properties": {
+                                "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
+                                }
+                            }
+                            ]
+                        }
+                        }
+                    ]
+                    },
+                "parameters": {
+                "privateDnsZoneId": {
+                    "value": "[parameters('privateDnsZoneId')]"
+                },
+                "privateEndpointName": {
+                    "value": "[field('name')]"
+                },
+                "location": {
+                    "value": "[field('location')]"
+                }
+                }
+            }
+            }
+        }
+        }
+    }
+    }
+    }
+    }