Skip to content

Commit

Permalink
Include AMBA policies in portal accelerator (#1414)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jfaurskov
jfaurskov authored Oct 4, 2023
1 parent 947d508 commit f9facfd
Show file tree
Hide file tree
Showing 35 changed files with 529 additions and 64 deletions.
6 changes: 3 additions & 3 deletions docs/reference/adventureworks/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@ Please refer to the [Enterprise-Scale Landing Zones User Guide](https://github.c

If customer started with a Enterprise-Scale foundation deployment, and if the business requirements changes over time, such as migration of on-premise applications to Azure that requires hybrid connectivity, you will simply create the **Connectivity** Subscription, place it into the **Platform > Connectivity** Management Group and assign Azure Policy for the hub and spoke network topology.

## Pre-requisites
## Prerequisites

To deploy this ARM template, your user/service principal must have Owner permission at the Tenant root.
See the following [instructions](../../EnterpriseScale-Setup-azure.md) on how to grant access.
To deploy this ARM template, there are a number of prerequisites that must be met.
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.

### Optional prerequisites

Expand Down
6 changes: 3 additions & 3 deletions docs/reference/contoso/Readme.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ Please refer to [Enterprise-Scale Landing Zones User Guide](https://github.com/A

If customer started with a Enterprise-Scale foundation deployment, and if the business requirements changes over time, such as migration of on-prem applications to Azure that requires hybrid connectivity, you will simply create the **Connectivity** Subscription and place it into the **Platform > Connectivity** Management Group and assign Azure Policy for the VWAN network topology.

## Pre-requisites
## Prerequisites

To deploy this ARM template, your user/service principal must have Owner permission at the Tenant root.
See the following [instructions](../../EnterpriseScale-Setup-azure.md) on how to grant access.
To deploy this ARM template, there are a number of prerequisites that must be met.
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.

### Optional prerequisites

Expand Down
5 changes: 3 additions & 2 deletions docs/reference/treyresearch/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,10 @@ Please refer to [Enterprise-Scale Landing Zones User Guide](https://github.com/A

If the business requirements change over time, the architecture allows for creating additional subscriptions and placing them into the suitable management group and assigning Azure policies. For more details, see the next steps section at the end of this document.

## Pre-requisites
## Prerequisites

To deploy this ARM template, your user/service principal must have Owner permission at the Microsoft Entra Tenant root. See the following [instructions](https://learn.microsoft.com/azure/role-based-access-control/elevate-access-global-admin) on how to grant access before you proceed.
To deploy this ARM template, there are a number of prerequisites that must be met.
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.

## Optional pre-requisites

Expand Down
6 changes: 3 additions & 3 deletions docs/reference/wingtip/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@ Please refer to [Enterprise-Scale Landing Zones User Guide](https://github.com/A
If the business requirements changes over time, such as migration of on-prem applications to Azure that requires hybrid connectivity, the architecture allows you to expand and implement networking without refactoring Azure Design with no disruption to what is already in Azure. The Enterprise-Scale architecture allows to create the Connectivity Subscription and place it into the platform Management Group and assign Azure Policies or/and deploy the target networking topology using either Virtual WAN or Hub and Spoke networking topology.
For more details, see the *next steps* section at the end of this document.

## Pre-requisites
## Prerequisites

To deploy this ARM template, your user/service principal must have Owner permission at the Tenant root.
See the following [instructions](../../EnterpriseScale-Setup-azure.md) on how to grant access before you proceed.
To deploy this ARM template, there are a number of prerequisites that must be met.
See [here](../../wiki/Deploying-ALZ-Pre-requisites.md) for more details.

### Optional pre-requisites

Expand Down
17 changes: 12 additions & 5 deletions docs/wiki/ALZ-Policies.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ This management group is a parent to all the other management groups created wit

| **Policy Type** | **Count** |
| :--- | :---: |
| `Policy Definition Sets` | **9** |
| `Policy Definition Sets` | **10** |
| `Policy Definitions` | **2** |
</td></tr> </table>

Expand All @@ -87,6 +87,8 @@ The table below provides the specific **Custom** and **Built-in** **policy defin
| **Deny the Deployment of Classic Resources** | **Not allowed resource types** | `Policy Definition`, **Built-in** | Denies deployment of classic resource types under the assigned scope | Deny |
| **Audit-UnusedResourcesCostOptimization** | **Audit-UnusedResourcesCostOptimization** | `Policy Definition Set`, **Custom** | Optimize cost by detecting unused but chargeable resources. Leverage this Azure Policy Initiative as a cost control tool to reveal orphaned resources that are contributing cost. | Audit |
| **Deny Virtual Machines and Virtual Machine Scale Sets from not using OS Managed Disks** | **Deny Virtual Machines and Virtual Machine Scale Sets from not using OS Managed Disks** | `Policy Definition`, **Custom** | Deny virtual machines not using managed disk. It checks the managedDisk property on virtual machine OS Disk fields. | Deny |
| **Deploy Azure Monitor Baseline Alerts for Service Health** | **Deploy Azure Monitor Baseline Alerts for Service Health** | `Policy Definition Set`, **Custom** | Deploys service health alerts, action group and alert processing rule. For more detail on policies included please refer to https://aka.ms/amba/alz/wiki under Policy Initiatives/Service Health initiative. | DeployIfNotExists |


### Platform

Expand Down Expand Up @@ -126,7 +128,7 @@ This management group contains a dedicated subscription for connectivity. This s

| **Policy Type** | **Count** |
| :--- | :---: |
| `Policy Definition Sets` | **0** |
| `Policy Definition Sets` | **1** |
| `Policy Definitions` | **1** |
</td></tr> </table>

Expand All @@ -135,6 +137,7 @@ The table below provides the specific **Custom** and **Built-in** **policy defin
| Assignment Name | Definition Name | Policy Type | Description | Effect(s) |
| -------------------------------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| **Virtual networks should be protected by Azure DDoS Network Protection** | **Virtual networks should be protected by Azure DDoS Network Protection** | `Policy Definition`, **Built-in** | Protect your virtual networks against volumetric and protocol attacks with Azure DDoS Network Protection. For more information, visit https://aka.ms/ddosprotectiondocs. | Modify |
| **Deploy Azure Monitor Baseline Alerts for Connectivity** | **Deploy Azure Monitor Baseline Alerts for Connectivity** | `Policy Definition Set`, **Custom** | Deploys alerting for connectivity related resources. For more detail on policies included please refer to https://aka.ms/amba/alz/wiki under Policy Initiatives/Connectivity initiative. | DeployIfNotExists |

### Management

Expand All @@ -151,7 +154,7 @@ This management group contains a dedicated subscription for management, monitori

| **Policy Type** | **Count** |
| :--- | :---: |
| `Policy Definition Sets` | **0** |
| `Policy Definition Sets` | **1** |
| `Policy Definitions` | **1** |
</td></tr> </table>

Expand All @@ -160,6 +163,8 @@ The table below provides the specific **Custom** and **Built-in** **policy defin
| Assignment Name | Definition Name | Policy Type | Description | Effect(s) |
| ------------------------ | ---------------------------------------------------------------------------------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ----------------- |
| **Deploy-Log-Analytics** | **Configure Log Analytics workspace and automation account to centralize logs and monitoring** | `Policy Definition`, **Built-in** | Deploy resource group containing Log Analytics workspace and linked automation account to centralize logs and monitoring. | DeployIfNotExists |
| **Deploy Azure Monitor Baseline Alerts for Management** | **Deploy Azure Monitor Baseline Alerts for Management** | `Policy Definition Set`, **Custom** | Deploys alerting for management related resources. For more detail on policies included please refer to https://aka.ms/amba/alz/wiki under Policy Initiatives/Management initiative. | DeployIfNotExists |


### Identity

Expand All @@ -176,7 +181,7 @@ This management group contains a dedicated subscription for identity. This subsc

| **Policy Type** | **Count** |
| :--- | :---: |
| `Policy Definition Sets` | **0** |
| `Policy Definition Sets` | **1** |
| `Policy Definitions` | **4** |
</td></tr> </table>

Expand All @@ -188,6 +193,7 @@ The table below provides the specific **Custom** and **Built-in** **policy defin
| **Management port access from the Internet should be blocked** | **Management port access from the Internet should be blocked** | `Policy Definition`, **Custom** | This policy denies any network security rule that allows management port access from Internet (Default port 22, 3389). | Deny |
| **Subnets should have a Network Security Group** | **Subnets should have a Network Security Group** | `Policy Definition`, **Custom** | This policy denies the creation of a subnet without a Network Security Group. NSG help to protect traffic across subnet-level. | Deny |
| **Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy** | **Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy** | `Policy Definition`, **Built-in** | Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. | DeployIfNotExists |
| **Deploy Azure Monitor Baseline Alerts for Identity** | **Deploy Azure Monitor Baseline Alerts for Identity** | `Policy Definition Set`, **Custom** | Deploys alerting for identity related resources. For more detail on policies included please refer to https://aka.ms/amba/alz/wiki under Policy Initiatives/Identity initiative. | DeployIfNotExists |

### Landing Zones

Expand All @@ -204,7 +210,7 @@ This is the parent management group for all the landing zone child management gr

| **Policy Type** | **Count** |
| :--- | :---: |
| `Policy Definition Sets` | **3** |
| `Policy Definition Sets` | **4** |
| `Policy Definitions` | **14** |
</td></tr> </table>

Expand All @@ -229,6 +235,7 @@ The table below provides the specific **Custom** and **Built-in** **policy defin
| **Kubernetes clusters should not allow container privilege escalation** | **Kubernetes clusters should not allow container privilege escalation** | `Policy Definition`, **Built-in** | Do not allow containers to run with privilege escalation to root in a Kubernetes cluster. This recommendation is part of CIS 5.2.5 which is intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. | Audit |
| **Kubernetes clusters should be accessible only over HTTPS** | **Kubernetes clusters should be accessible only over HTTPS** | `Policy Definition`, **Built-in** | Use of HTTPS ensures authentication and protects data in transit from network layer eavesdropping attacks. This capability is currently generally available for Kubernetes Service (AKS), and in preview for AKS Engine and Azure Arc enabled Kubernetes. | Deny |
| **Web Application Firewall (WAF) should be enabled for Application Gateway** | **Web Application Firewall (WAF) should be enabled for Application Gateway** | `Policy Definition`, **Built-in** | Deploy Azure Web Application Firewall (WAF) in front of public facing web applications for additional inspection of incoming traffic. Web Application Firewall (WAF) provides centralized protection of your web applications from common exploits and vulnerabilities such as SQL injections, Cross-Site Scripting, local and remote file executions. You can also restrict access to your web applications by countries, IP address ranges, and other http(s) parameters via custom rules. | Audit |
| **Deploy Azure Monitor Baseline Alerts for Landing Zone** | **Deploy Azure Monitor Baseline Alerts for Landing Zone** | `Policy Definition Set`, **Custom** | Deploys alerting for landing zone related resources. For more detail on policies included please refer to https://aka.ms/amba/alz/wiki under Policy Initiatives. | DeployIfNotExists |

### Corp

Expand Down
Loading

0 comments on commit f9facfd

Please sign in to comment.