Skip to content
This repository was archived by the owner on Mar 15, 2025. It is now read-only.

update platform resource config #385

Merged
krnese merged 7 commits into from
Mar 7, 2023
Merged

update platform resource config #385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b25a80e
update platform resource config
krnese Mar 5, 2023
5e9fab8
updated default value for policydef
krnese Mar 5, 2023
3fbcf9e
updated resourceNames for policy
krnese Mar 5, 2023
72f4e2c
adding udr and nsg to private dns
krnese Mar 6, 2023
a2fd50a
Allowed resourceTypes wave #1
krnese Mar 6, 2023
ab9067a
allowed corp resources + peering with udr and nsg
krnese Mar 6, 2023
0dde83b
updated resource types and NW sequencing for ERGW
krnese Mar 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions ...tions/core/managementGroupTemplates/policyAssignments/DENY-ResourcesPolicyAssignment.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"enforcementMode": {
"type": "string",
"allowedValues": [
"Default",
"DoNotEnforce"
],
"defaultValue": "Default"
},
"listOfResourceTypesAllowed": {
"type": "array",
"defaultValue": []
}
},
"variables": {
"policyDefinitions": {
"azureResources": "/providers/Microsoft.Authorization/policyDefinitions/a08ec900-254a-4555-9bf5-e42af04b5c5c"
},
"policyAssignmentNames": {
"resources": "Deny-Azure-Resources",
"description": "This policy enables the Azure services your organization can deploy into the landing zones.",
"displayName": "Azure Service Enablement - Allowed Azure services to be used in the FSI Landing Zones"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2022-06-01",
"name": "[variables('policyAssignmentNames').resources]",
"location": "[deployment().location]",
"properties": {
"description": "[variables('policyAssignmentNames').description]",
"displayName": "[variables('policyAssignmentNames').displayName]",
"policyDefinitionId": "[variables('policyDefinitions').azureResources]",
"enforcementMode": "[parameters('enforcementMode')]",
"parameters": {
"listOfResourceTypesAllowed": {
"value": "[parameters('listOfResourceTypesAllowed')]"
}
}
}
}

],
"outputs": {}
}
22 changes: 5 additions & 17 deletions .../core/managementGroupTemplates/policyDefinitions/Compliant-CorpLzPolicySetDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,26 +51,14 @@
{
"name": "Encryption",
"category": "Data Protection",
"displayName": "Ensure Storage Account is using secure encryption",
"description": "Policy to ensure Storage Account is using secure encryption"
"displayName": "Ensure Corp connected resources are using secure encryption",
"description": "Policy to ensure Corp connected resources are using secure encryption"
},
{
"name": "Network",
"category": "Network Security",
"displayName": "Ensure Storage Account is not accessible over the public internet",
"description": "Policy to ensure Storage Account is not accessible over the public internet"
},
{
"name": "Identity",
"category": "Identity Management",
"displayName": "Ensure usage of centralized identity and auhtorization system for Storage Account",
"description": "Policy to ensure Storage Account is not using local authorization"
},
{
"name": "Logging",
"category": "Logging and Threat Detection",
"displayName": "Ensure Storage Account is logging all events to Log Analytics",
"description": "Policy to ensure Storage Account is logging all events to Log Analytics workspace"
"displayName": "Ensure Corp connected landing zones are not accessible over the public internet",
"description": "Policy to ensure Corp connected landing zones are not accessible over the public internet"
}
],
"parameters": {
Expand Down Expand Up @@ -336,7 +324,7 @@
}
},
"policyDefinitions": [
{
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34804460-d88b-4922-a7ca-537165e060ed",
"policyDefinitionReferenceId": "Dine-Workspace-DNS-Zone",
"groupNames": [
Expand Down
4 changes: 2 additions & 2 deletions ...ore/managementGroupTemplates/policyDefinitions/Compliant-KeyVaultPolicySetDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@
},
"keyVaultCertificatesPeriod": {
"type": "string",
"defaultValue": "Deny"
"defaultValue": "Disabled"
},
"keyVaultCertValidPeriod": {
"type": "integer",
Expand All @@ -133,7 +133,7 @@
},
"keysValidPeriod": {
"type": "string",
"defaultValue": "Deny"
"defaultValue": "Disabled"
},
"keysValidityInDays": {
"type": "integer",
Expand Down
25 changes: 8 additions & 17 deletions ...core/managementGroupTemplates/policyDefinitions/Compliant-StoragePolicySetDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,7 +306,14 @@
"Logging, Metrics, AzureServices"
],
"defaultValue": [
"None"
"Logging",
"Metrics",
"AzureServices",
"Logging, Metrics",
"Logging, AzureServices",
"Metrics, AzureServices",
"Logging, Metrics, AzureServices",
"Logging, Metrics, AzureServices"
]
}
},
Expand Down Expand Up @@ -861,10 +868,6 @@
"type": "string",
"defaultValue": "Deny"
},
"storageAccountsTrustedMsftServices": {
"type": "string",
"defaultValue": "Deny"
},
"storageQueueCmk": {
"type": "string",
"defaultValue": "Deny"
Expand Down Expand Up @@ -1202,18 +1205,6 @@
}
}
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c9d007d0-c057-4772-b18c-01e546713bcd",
"policyDefinitionReferenceId": "Deny-Storage-Account-Msft-Trusted",
"groupNames": [
"Network"
],
"parameters": {
"effect": {
"value": "[[parameters('storageAccountsTrustedMsftServices')]"
}
}
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d",
"policyDefinitionReferenceId": "Deny-Storage-Account-Encryption",
Expand Down
78 changes: 71 additions & 7 deletions ...ions/azure/referenceImplementations/core/subscriptionTemplates/hubspoke-connectivity.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,10 @@
"avnmDeploymentName": "[take(concat(deployment().name, '-avnetmanager', parameters('location')), 64)]",
"dnsResolverInboundSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', variables('rgName'),'/providers/Microsoft.Network/virtualNetworks/', variables('hubname'), '/subnets/DnsResolverInboundSubnet')]",
"dnsResolverOutboundSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', variables('rgName'),'/providers/Microsoft.Network/virtualNetworks/', variables('hubname'), '/subnets/DnsResolverOutboundSubnet')]",
// Creating variable that later will be used in conjunction with the union() function to cater for conditional subnet creation while ensuring idempotency
"nsgDnsResolverName": "[concat(parameters('topLevelManagementGroupPrefix'), '-nsg-dns-', parameters('location'))]",
"nsgDnsResolverResourceId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', variables('rgName'), '/providers/Microsoft.Network/networkSecurityGroups/', variables('nsgDnsResolverName'))]",
"udrDnsResolverName": "[concat(parameters('topLevelManagementGroupPrefix'), '-udr-dns-', parameters('location'))]",
"udrDnsResolverResourceId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', variables('rgName'), '/providers/Microsoft.Network/routeTables/', variables('udrDnsResolverName'))]",
"gwSubnet": [
{
"name": "GatewaySubnet",
Expand All @@ -219,15 +222,27 @@
{
"name": "DnsResolverInboundSubnet",
"properties": {
"addressPrefix": "[parameters('subnetMaskForDnsResolverInbound')]"
"addressPrefix": "[parameters('subnetMaskForDnsResolverInbound')]",
"networkSecurityGroup": {
"id": "[variables('nsgDnsResolverResourceId')]"
},
"routeTable": {
"id": "[variables('udrDnsResolverResourceId')]"
}
}
}
],
"dnsResolverOutboundSubnet": [
{
"name": "DnsResolverOutboundSubnet",
"properties": {
"addressPrefix": "[parameters('subnetMaskForDnsResolverOutbound')]"
"addressPrefix": "[parameters('subnetMaskForDnsResolverOutbound')]",
"networkSecurityGroup": {
"id": "[variables('nsgDnsResolverResourceId')]"
},
"routeTable": {
"id": "[variables('udrDnsResolverResourceId')]"
}
}
}
],
Expand All @@ -248,7 +263,7 @@
"type": "Microsoft.Resources/deployments",
"apiVersion": "2019-10-01",
"location": "[parameters('location')]",
"name": "[concat('afo', '-connectivityHubSub', deployment().location)]",
"name": "[concat('fsi', '-connectivityHubSub', deployment().location)]",
"subscriptionId": "[parameters('connectivitySubscriptionId')]",
"properties": {
"mode": "Incremental",
Expand Down Expand Up @@ -327,11 +342,55 @@
"contentVersion": "1.0.0.0",
"parameters": {},
"resources": [
{
"condition": "[not(empty(parameters('subnetMaskForDnsResolverInbound')))]",
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2022-07-01",
"name": "[variables('nsgDnsResolverName')]",
"location": "[parameters('location')]",
"properties": {
"securityRules": []
}
},
{
"condition": "[not(empty(parameters('subnetMaskForDnsResolverInbound')))]",
"type": "Microsoft.Network/routeTables",
"apiVersion": "2020-11-01",
"name": "[variables('udrDnsResolverName')]",
"location": "[parameters('location')]",
"properties": {
"disableBgpRoutePropagation": false,
"routes": []
}
},
{
"condition": "[and(not(empty(parameters('subnetMaskForDnsResolverInbound'))), not(empty(parameters('logAnalyticsWorkspaceId'))))]",
"type": "Microsoft.Network/networkSecurityGroups/providers/diagnosticSettings",
"apiVersion": "2021-05-01-preview",
"name": "[concat(variables('nsgDnsResolverName'), '/', 'Microsoft.Insights/setByPolicy')]",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/networkSecurityGroups/', variables('nsgDnsResolverName'))]"
],
"properties": {
"workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
"logs": [
{
"categoryGroup": "allLogs",
"enabled": true
}
]
}
},
{
"name": "[variables('hubName')]",
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2022-01-01",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/networkSecurityGroups/', variables('nsgDnsResolverName'))]",
"[concat('Microsoft.Network/routeTables/', variables('udrDnsResolverName'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
Expand Down Expand Up @@ -696,7 +755,8 @@
"name": "[variables('dnsResolverName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]"
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]",
"[concat('Microsoft.Network/azureFirewalls/', variables('azFwName'))]"
],
"properties": {
"virtualNetwork": {
Expand All @@ -712,7 +772,9 @@
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/dnsResolvers/', variables('dnsResolverName'))]",
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]"
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]",
"[concat('Microsoft.Network/virtualNetworkGateways/', variables('vpngwname'))]",
"[concat('Microsoft.Network/virtualNetworkGateways/', variables('erGwName'))]"
],
"properties": {
"ipConfigurations": [
Expand All @@ -733,7 +795,9 @@
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Network/dnsResolvers/', variables('dnsResolverName'))]",
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]"
"[concat('Microsoft.Network/virtualNetworks/', variables('hubName'))]",
"[concat('Microsoft.Network/virtualNetworkGateways/', variables('vpngwname'))]",
"[concat('Microsoft.Network/virtualNetworkGateways/', variables('erGwName'))]"
],
"properties": {
"subnet": {
Expand Down
6 changes: 3 additions & 3 deletions ...ions/azure/referenceImplementations/core/subscriptionTemplates/logAnalyticsWorkspace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@
"condition": "[not(empty(parameters('dataExports')))]",
"type": "Microsoft.EventHub/namespaces/providers/diagnosticSettings",
"apiVersion": "2021-05-01-preview",
"name": "[concat(parameters('eventHubNamespaceName'), '/', 'Microsoft.Insights/setByPolicy')]",
"name": "[concat(parameters('eventHubNamespaceName'), '/', 'Microsoft.Insights/setbypolicy_logAnalytics')]",
"location": "[deployment().location]",
"dependsOn": [
"[concat('Microsoft.EventHub/namespaces/', parameters('eventHubNamespaceName'))]",
Expand Down Expand Up @@ -359,7 +359,7 @@
"minimumTlsVersion": "1.2",
"publicNetworkAccess": "Enabled",
"disableLocalAuth": true,
"zoneRedundant": true,
"zoneRedundant": false,
"isAutoInflateEnabled": true,
"maximumThroughputUnits": 5,
"kafkaEnabled": true
Expand All @@ -369,7 +369,7 @@
"condition": "[not(empty(parameters('dataExports')))]",
"type": "Microsoft.EventHub/namespaces/providers/diagnosticSettings",
"apiVersion": "2021-05-01-preview",
"name": "[concat(parameters('eventHubNamespaceName'), '/', 'Microsoft.Insights/setByPolicy')]",
"name": "[concat(parameters('eventHubNamespaceName'), '/', 'Microsoft.Insights/setbypolicy_logAnalytics')]",
"location": "[deployment().location]",
"dependsOn": [
"[concat('Microsoft.EventHub/namespaces/', parameters('eventHubNamespaceName'))]",
Expand Down
Loading