Skip to content

Commit 1c5f290

Browse files
gokmen-msftAzure Policy Bot
gokmen-msft
and
Azure Policy Bot
authored
Built-in Policy Release 8feb5a11 (Azure#1285)
Co-authored-by: Azure Policy Bot <azgovpolicy@microsoft.com>
1 parent eab2188 commit 1c5f290

File tree

34 files changed

+1061
-143
lines changed

34 files changed

+1061
-143
lines changed

‎built-in-policies/policyDefinitions/Azure Ai Services/CognitiveServices_DisableLocalAuth_Audit.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"properties": {
3+
"displayName": "Azure AI Services resources should have key access disabled (disable local authentication)",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Key access (local authentication) is recommended to be disabled for security. Azure OpenAI Studio, typically used in development/testing, requires key access and will not function if key access is disabled. After disabling, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. Learn more at: https://aka.ms/AI/auth",
7+
"metadata": {
8+
"version": "1.1.0",
9+
"category": "Azure Ai Services"
10+
},
11+
"version": "1.1.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"defaultValue": "Audit",
16+
"allowedValues": [
17+
"Audit",
18+
"Deny",
19+
"Disabled"
20+
],
21+
"metadata": {
22+
"displayName": "Effect",
23+
"description": "Enable or disable the execution of the policy"
24+
}
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"anyOf": [
30+
{
31+
"allOf": [
32+
{
33+
"field": "type",
34+
"equals": "Microsoft.CognitiveServices/accounts"
35+
},
36+
{
37+
"field": "Microsoft.CognitiveServices/accounts/disableLocalAuth",
38+
"notEquals": true
39+
}
40+
]
41+
},
42+
{
43+
"allOf": [
44+
{
45+
"field": "type",
46+
"equals": "Microsoft.Search/searchServices"
47+
},
48+
{
49+
"field": "Microsoft.Search/searchServices/disableLocalAuth",
50+
"notEquals": true
51+
}
52+
]
53+
}
54+
]
55+
},
56+
"then": {
57+
"effect": "[parameters('effect')]"
58+
}
59+
}
60+
},
61+
"id": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc",
62+
"name": "71ef260a-8f18-47b7-abcb-62d0673d94dc"
63+
}

‎built-in-policies/policyDefinitions/Azure Ai Services/CognitiveServices_NetworkAcls_Audit.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"properties": {
3+
"displayName": "Azure AI Services resources should restrict network access",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "By restricting network access, you can ensure that only allowed networks can access the service. This can be achieved by configuring network rules so that only applications from allowed networks can access the Azure AI service.",
7+
"metadata": {
8+
"version": "3.1.0",
9+
"category": "Azure Ai Services"
10+
},
11+
"version": "3.1.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "string",
15+
"defaultValue": "Audit",
16+
"allowedValues": [
17+
"Audit",
18+
"Deny",
19+
"Disabled"
20+
],
21+
"metadata": {
22+
"displayName": "Effect",
23+
"description": "The effect determines what happens when the policy rule is evaluated to match"
24+
}
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"anyOf": [
30+
{
31+
"allOf": [
32+
{
33+
"field": "type",
34+
"equals": "Microsoft.CognitiveServices/accounts"
35+
},
36+
{
37+
"field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
38+
"notEquals": "Disabled"
39+
},
40+
{
41+
"field": "Microsoft.CognitiveServices/accounts/networkAcls.defaultAction",
42+
"notEquals": "Deny"
43+
}
44+
]
45+
},
46+
{
47+
"allOf": [
48+
{
49+
"field": "type",
50+
"equals": "Microsoft.Search/searchServices"
51+
},
52+
{
53+
"field": "Microsoft.Search/searchServices/networkRuleSet.ipRules[*]",
54+
"exists": "false"
55+
}
56+
]
57+
}
58+
]
59+
},
60+
"then": {
61+
"effect": "[parameters('effect')]"
62+
}
63+
}
64+
},
65+
"id": "/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3",
66+
"name": "037eea7a-bd0a-46c5-9a66-03aea78705d3"
67+
}

‎built-in-policies/policyDefinitions/Azure Update Manager/AzUpdateMgmtCenter_CRP_AutoAssessmentMode_Modify.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Configure auto-assessment (every 24 hours) for OS updates on native Azure virtual machines. You can control the scope of assignment according to machine subscription, resource group, location or tag. Learn more about this for Windows: https://aka.ms/computevm-windowspatchassessmentmode, for Linux: https://aka.ms/computevm-linuxpatchassessmentmode.",
77
"metadata": {
8-
"version": "4.6.0",
8+
"version": "4.7.0",
99
"category": "Azure Update Manager"
1010
},
11-
"version": "4.6.0",
11+
"version": "4.7.0",
1212
"parameters": {
1313
"assessmentMode": {
1414
"type": "String",
@@ -942,7 +942,7 @@
942942
"effect": "modify",
943943
"details": {
944944
"roleDefinitionIds": [
945-
"/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
945+
"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
946946
],
947947
"conflictEffect": "audit",
948948
"operations": [

‎built-in-policies/policyDefinitions/Backup/VirtualMachineApplicationCentricBackup_DINE_WithOutTag.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.",
77
"metadata": {
8-
"version": "9.1.0",
8+
"version": "9.2.0",
99
"category": "Backup"
1010
},
11-
"version": "9.1.0",
11+
"version": "9.2.0",
1212
"parameters": {
1313
"exclusionTagName": {
1414
"type": "String",
@@ -357,6 +357,10 @@
357357
{
358358
"field": "Microsoft.Compute/imageSKU",
359359
"like": "20_04-lts*"
360+
},
361+
{
362+
"field": "Microsoft.Compute/imageSKU",
363+
"like": "22_04-lts-gen2"
360364
}
361365
]
362366
}

‎built-in-policies/policyDefinitions/Backup/VirtualMachineApplicationCentricBackup_DINE_WithTag.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally include virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupIncludeTag.",
77
"metadata": {
8-
"version": "9.1.0",
8+
"version": "9.2.0",
99
"category": "Backup"
1010
},
11-
"version": "9.1.0",
11+
"version": "9.2.0",
1212
"parameters": {
1313
"inclusionTagName": {
1414
"type": "String",
@@ -367,6 +367,10 @@
367367
{
368368
"field": "Microsoft.Compute/imageSKU",
369369
"like": "20_04-lts*"
370+
},
371+
{
372+
"field": "Microsoft.Compute/imageSKU",
373+
"like": "22_04-lts-gen2"
370374
}
371375
]
372376
}

‎built-in-policies/policyDefinitions/Backup/VirtualMachineBackup_Backup_DeployIfNotExists.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Enforce backup for all virtual machines by backing them up to an existing central recovery services vault in the same location and subscription as the virtual machine. Doing this is useful when there is a central team in your organization managing backups for all resources in a subscription. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMCentralBackupExcludeTag.",
77
"metadata": {
8-
"version": "9.1.0",
8+
"version": "9.2.0",
99
"category": "Backup"
1010
},
11-
"version": "9.1.0",
11+
"version": "9.2.0",
1212
"parameters": {
1313
"vaultLocation": {
1414
"type": "String",
@@ -389,6 +389,10 @@
389389
{
390390
"field": "Microsoft.Compute/imageSKU",
391391
"like": "20_04-lts*"
392+
},
393+
{
394+
"field": "Microsoft.Compute/imageSKU",
395+
"like": "22_04-lts-gen2"
392396
}
393397
]
394398
}

‎built-in-policies/policyDefinitions/Backup/VirtualMachineWithTag_Backup_Deploy.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "Enforce backup for all virtual machines by backing them up to an existing central recovery services vault in the same location and subscription as the virtual machine. Doing this is useful when there is a central team in your organization managing backups for all resources in a subscription. You can optionally include virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMCentralBackupIncludeTag.",
77
"metadata": {
8-
"version": "9.1.0",
8+
"version": "9.2.0",
99
"category": "Backup"
1010
},
11-
"version": "9.1.0",
11+
"version": "9.2.0",
1212
"parameters": {
1313
"vaultLocation": {
1414
"type": "String",
@@ -374,6 +374,10 @@
374374
{
375375
"field": "Microsoft.Compute/imageSKU",
376376
"like": "20_04-lts*"
377+
},
378+
{
379+
"field": "Microsoft.Compute/imageSKU",
380+
"like": "22_04-lts-gen2"
377381
}
378382
]
379383
}

‎built-in-policies/policyDefinitions/Cognitive Services/CognitiveServices_DisableLocalAuth_Audit.json‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎built-in-policies/policyDefinitions/Cognitive Services/CognitiveServices_NetworkAcls_Audit.json‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎built-in-policies/policyDefinitions/Kubernetes/CannotEditIndividualNodes.json‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,24 @@
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Cannot Edit Individual Nodes. Users should not edit individual nodes. Please edit node pools.",
77
"metadata": {
8-
"version": "1.0.3-preview",
8+
"version": "1.1.0-preview",
99
"category": "Kubernetes",
1010
"preview": true
1111
},
12-
"version": "1.0.3-preview",
12+
"version": "1.1.0-preview",
1313
"parameters": {
14+
"warn": {
15+
"type": "Boolean",
16+
"metadata": {
17+
"displayName": "Warn",
18+
"description": "Whether or not to return warnings back to the user in the kubectl cli"
19+
},
20+
"allowedValues": [
21+
true,
22+
false
23+
],
24+
"defaultValue": false
25+
},
1426
"effect": {
1527
"type": "String",
1628
"metadata": {
@@ -126,6 +138,7 @@
126138
"then": {
127139
"effect": "[parameters('effect')]",
128140
"details": {
141+
"warn": "[parameters('warn')]",
129142
"templateInfo": {
130143
"sourceType": "PublicURL",
131144
"url": "https://store.policy.core.windows.net/kubernetes/restricted-node-edits/v1/template.yaml"

0 commit comments

Comments
 (0)