mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
7f42115b63
YAML-driven test cases for the core Azure Policy compiler. These cover alias resolution, field conditions, logical operators, type coercion, count expressions, template functions, effect compilation, and policy definition parsing. 24 files, each a self-contained scenario exercised by the test runner in the companion code PR. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1215 lines
36 KiB
YAML
1215 lines
36 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# Azure Policy Scenarios with ARM-shaped resources
|
|
#
|
|
# These tests model real-world Azure Policy rules that enterprise customers
|
|
# commonly deploy. Policy rules use fully-qualified alias names as required by
|
|
# the Azure Policy language. Resources use raw ARM shapes with `properties`
|
|
# wrappers; the normalizer flattens them before evaluation.
|
|
|
|
aliases: test_aliases.json
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# VM SKU Restriction — Deny non-allowed VM sizes
|
|
# =========================================================================
|
|
|
|
- note: vm_sku_restriction_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{
|
|
"not": {
|
|
"field": "Microsoft.Compute/virtualMachines/sku.name",
|
|
"in": "[parameters('allowedSKUs')]"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
allowedSKUs:
|
|
- "Standard_D2s_v3"
|
|
- "Standard_D4s_v3"
|
|
- "Standard_D8s_v3"
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_E64i_v3"
|
|
want_effect: "deny"
|
|
|
|
- note: vm_sku_restriction_allowed
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{
|
|
"not": {
|
|
"field": "Microsoft.Compute/virtualMachines/sku.name",
|
|
"in": "[parameters('allowedSKUs')]"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
allowedSKUs:
|
|
- "Standard_D2s_v3"
|
|
- "Standard_D4s_v3"
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
hardwareProfile:
|
|
vmSize: "Standard_D2s_v3"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Storage — Require blob encryption enabled
|
|
# =========================================================================
|
|
|
|
- note: storage_blob_encryption_required_deny
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/enableBlobEncryption",
|
|
"notEquals": true
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage123"
|
|
location: "westus2"
|
|
properties:
|
|
encryption:
|
|
services:
|
|
blob:
|
|
enabled: false
|
|
file:
|
|
enabled: true
|
|
want_effect: "audit"
|
|
|
|
- note: storage_blob_encryption_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"field": "Microsoft.Storage/storageAccounts/enableBlobEncryption",
|
|
"notEquals": true
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage123"
|
|
location: "westus2"
|
|
properties:
|
|
encryption:
|
|
services:
|
|
blob:
|
|
enabled: true
|
|
file:
|
|
enabled: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Key Vault — Require soft delete enabled
|
|
# =========================================================================
|
|
|
|
- note: keyvault_soft_delete_required
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.KeyVault/vaults" },
|
|
{ "field": "Microsoft.KeyVault/vaults/enableSoftDelete", "notEquals": true }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
name: "myvault"
|
|
location: "eastus"
|
|
properties:
|
|
enableSoftDelete: false
|
|
enablePurgeProtection: true
|
|
want_effect: "deny"
|
|
|
|
- note: keyvault_soft_delete_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.KeyVault/vaults" },
|
|
{ "field": "Microsoft.KeyVault/vaults/enableSoftDelete", "notEquals": true }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
name: "myvault"
|
|
location: "eastus"
|
|
properties:
|
|
enableSoftDelete: true
|
|
enablePurgeProtection: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Web App — Enforce minimum TLS version
|
|
# =========================================================================
|
|
|
|
- note: webapp_min_tls_version_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Web/sites" },
|
|
{
|
|
"field": "Microsoft.Web/sites/siteConfig.minTlsVersion",
|
|
"less": "1.2"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Web/sites"
|
|
name: "mywebapp"
|
|
location: "eastus"
|
|
kind: "app"
|
|
properties:
|
|
siteConfig:
|
|
minTlsVersion: "1.0"
|
|
ftpsState: "Disabled"
|
|
want_effect: "deny"
|
|
|
|
- note: webapp_min_tls_version_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Web/sites" },
|
|
{
|
|
"field": "Microsoft.Web/sites/siteConfig.minTlsVersion",
|
|
"less": "1.2"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Web/sites"
|
|
name: "mywebapp"
|
|
location: "eastus"
|
|
kind: "app"
|
|
properties:
|
|
siteConfig:
|
|
minTlsVersion: "1.2"
|
|
ftpsState: "Disabled"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# AKS — Require RBAC enabled
|
|
# =========================================================================
|
|
|
|
- note: aks_rbac_required_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.ContainerService/managedClusters" },
|
|
{ "field": "Microsoft.ContainerService/managedClusters/enableRBAC", "notEquals": true }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.ContainerService/managedClusters"
|
|
name: "myaks"
|
|
location: "eastus"
|
|
properties:
|
|
enableRBAC: false
|
|
kubernetesVersion: "1.28.0"
|
|
want_effect: "deny"
|
|
|
|
- note: aks_rbac_required_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.ContainerService/managedClusters" },
|
|
{ "field": "Microsoft.ContainerService/managedClusters/enableRBAC", "notEquals": true }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.ContainerService/managedClusters"
|
|
name: "myaks"
|
|
location: "eastus"
|
|
properties:
|
|
enableRBAC: true
|
|
kubernetesVersion: "1.28.0"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Disk Encryption — Require managed disk encryption
|
|
# =========================================================================
|
|
|
|
- note: disk_encryption_required
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/disks" },
|
|
{
|
|
"field": "Microsoft.Compute/disks/encryptionSettingsCollection.enabled",
|
|
"notEquals": true
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/disks"
|
|
name: "mydisk"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Premium_LRS"
|
|
tier: "Premium"
|
|
properties:
|
|
encryptionSettingsCollection:
|
|
enabled: false
|
|
want_effect: "audit"
|
|
|
|
- note: disk_encryption_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/disks" },
|
|
{
|
|
"field": "Microsoft.Compute/disks/encryptionSettingsCollection.enabled",
|
|
"notEquals": true
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/disks"
|
|
name: "mydisk"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Premium_LRS"
|
|
tier: "Premium"
|
|
properties:
|
|
encryptionSettingsCollection:
|
|
enabled: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Storage — Network ACLs default deny
|
|
# =========================================================================
|
|
|
|
- note: storage_network_acls_default_deny
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{ "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction", "notEquals": "Deny" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage123"
|
|
location: "westus2"
|
|
sku:
|
|
name: "Standard_LRS"
|
|
tier: "Standard"
|
|
properties:
|
|
networkAcls:
|
|
defaultAction: "Allow"
|
|
bypass: "AzureServices"
|
|
ipRules: []
|
|
virtualNetworkRules: []
|
|
want_effect: "audit"
|
|
|
|
- note: storage_network_acls_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{ "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction", "notEquals": "Deny" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage123"
|
|
location: "westus2"
|
|
sku:
|
|
name: "Standard_LRS"
|
|
tier: "Standard"
|
|
properties:
|
|
networkAcls:
|
|
defaultAction: "Deny"
|
|
bypass: "AzureServices"
|
|
ipRules:
|
|
- value: "10.0.0.0/24"
|
|
action: "Allow"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# NSG — Deny SSH from Internet (realistic multi-condition)
|
|
# =========================================================================
|
|
|
|
- note: nsg_deny_ssh_from_internet
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Network/networkSecurityGroups" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"allOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access", "equals": "Allow" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction", "equals": "Inbound" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange", "equals": "22" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange", "equals": "*" }
|
|
]
|
|
},
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix", "equals": "*" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix", "equals": "Internet" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix", "equals": "0.0.0.0/0" }
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
name: "myNsg"
|
|
location: "eastus"
|
|
properties:
|
|
securityRules:
|
|
- name: "AllowHTTPS"
|
|
properties:
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
protocol: "Tcp"
|
|
destinationPortRange: "443"
|
|
sourceAddressPrefix: "*"
|
|
priority: 100
|
|
- name: "AllowSSH"
|
|
properties:
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
protocol: "Tcp"
|
|
destinationPortRange: "22"
|
|
sourceAddressPrefix: "Internet"
|
|
priority: 200
|
|
want_effect: "deny"
|
|
|
|
- note: nsg_deny_ssh_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Network/networkSecurityGroups" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
|
|
"where": {
|
|
"allOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access", "equals": "Allow" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction", "equals": "Inbound" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange", "equals": "22" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].destinationPortRange", "equals": "*" }
|
|
]
|
|
},
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix", "equals": "*" },
|
|
{ "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix", "equals": "Internet" }
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkSecurityGroups"
|
|
name: "myNsg"
|
|
location: "eastus"
|
|
properties:
|
|
securityRules:
|
|
- name: "AllowHTTPS"
|
|
properties:
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
protocol: "Tcp"
|
|
destinationPortRange: "443"
|
|
sourceAddressPrefix: "*"
|
|
priority: 100
|
|
- name: "AllowSSHRestricted"
|
|
properties:
|
|
access: "Allow"
|
|
direction: "Inbound"
|
|
protocol: "Tcp"
|
|
destinationPortRange: "22"
|
|
sourceAddressPrefix: "10.0.0.0/24"
|
|
priority: 200
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# VM — Require managed disks (check storageProfile)
|
|
# =========================================================================
|
|
|
|
- note: vm_require_managed_disks
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*]",
|
|
"where": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.id",
|
|
"exists": false
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Standard_D4s_v3"
|
|
properties:
|
|
storageProfile:
|
|
osDisk:
|
|
osType: "Linux"
|
|
managedDisk:
|
|
storageAccountType: "Premium_LRS"
|
|
dataDisks:
|
|
- lun: 0
|
|
name: "datadisk0"
|
|
managedDisk:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/disks/datadisk0"
|
|
storageAccountType: "Premium_LRS"
|
|
- lun: 1
|
|
name: "datadisk1"
|
|
vhd:
|
|
uri: "https://mystorage.blob.core.windows.net/vhds/datadisk1.vhd"
|
|
want_effect: "deny"
|
|
|
|
- note: vm_all_managed_disks_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*]",
|
|
"where": {
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.id",
|
|
"exists": false
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
properties:
|
|
storageProfile:
|
|
dataDisks:
|
|
- lun: 0
|
|
name: "datadisk0"
|
|
managedDisk:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/disks/datadisk0"
|
|
- lun: 1
|
|
name: "datadisk1"
|
|
managedDisk:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/disks/datadisk1"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Allowed resource types — deny everything not in allow-list
|
|
# =========================================================================
|
|
|
|
- note: allowed_resource_types_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"field": "type",
|
|
"in": "[parameters('allowedTypes')]"
|
|
}
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
allowedTypes:
|
|
- "Microsoft.Compute/virtualMachines"
|
|
- "Microsoft.Storage/storageAccounts"
|
|
- "Microsoft.Network/networkSecurityGroups"
|
|
- "Microsoft.Network/virtualNetworks"
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "myserver"
|
|
location: "eastus"
|
|
want_effect: "deny"
|
|
|
|
- note: allowed_resource_types_allowed
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"not": {
|
|
"field": "type",
|
|
"in": "[parameters('allowedTypes')]"
|
|
}
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
allowedTypes:
|
|
- "Microsoft.Compute/virtualMachines"
|
|
- "Microsoft.Storage/storageAccounts"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Multi-tag requirement with value count + current() + concat
|
|
# =========================================================================
|
|
|
|
- note: multi_tag_requirement_missing_tags
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "notEquals": "Microsoft.Resources/subscriptions" },
|
|
{
|
|
"count": {
|
|
"value": "[parameters('requiredTags')]",
|
|
"name": "tagName",
|
|
"where": {
|
|
"field": "[concat('tags[', current('tagName'), ']')]",
|
|
"exists": true
|
|
}
|
|
},
|
|
"notEquals": "[length(parameters('requiredTags'))]"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
requiredTags:
|
|
- "Environment"
|
|
- "CostCenter"
|
|
- "Owner"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
tags:
|
|
Environment: "Production"
|
|
CostCenter: "12345"
|
|
want_effect: "deny"
|
|
|
|
- note: multi_tag_requirement_all_present
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "notEquals": "Microsoft.Resources/subscriptions" },
|
|
{
|
|
"count": {
|
|
"value": "[parameters('requiredTags')]",
|
|
"name": "tagName",
|
|
"where": {
|
|
"field": "[concat('tags[', current('tagName'), ']')]",
|
|
"exists": true
|
|
}
|
|
},
|
|
"notEquals": "[length(parameters('requiredTags'))]"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
requiredTags:
|
|
- "Environment"
|
|
- "CostCenter"
|
|
- "Owner"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
tags:
|
|
Environment: "Production"
|
|
CostCenter: "12345"
|
|
Owner: "teamA"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Storage — Require minimum TLS version
|
|
# =========================================================================
|
|
|
|
- note: storage_min_tls_version_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion", "exists": false },
|
|
{ "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion", "less": "TLS1_2" }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Standard_LRS"
|
|
properties:
|
|
minimumTlsVersion: "TLS1_0"
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: "deny"
|
|
|
|
- note: storage_min_tls_version_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion", "exists": false },
|
|
{ "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion", "less": "TLS1_2" }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Standard_LRS"
|
|
properties:
|
|
minimumTlsVersion: "TLS1_2"
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# SQL Server — Require TLS 1.2
|
|
# =========================================================================
|
|
|
|
- note: sql_server_min_tls_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Sql/servers" },
|
|
{ "field": "Microsoft.Sql/servers/minimalTlsVersion", "less": "1.2" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "myserver"
|
|
location: "eastus"
|
|
kind: "v12.0"
|
|
properties:
|
|
minimalTlsVersion: "1.0"
|
|
administratorLogin: "sqladmin"
|
|
want_effect: "audit"
|
|
|
|
- note: sql_server_min_tls_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Sql/servers" },
|
|
{ "field": "Microsoft.Sql/servers/minimalTlsVersion", "less": "1.2" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "myserver"
|
|
location: "eastus"
|
|
kind: "v12.0"
|
|
properties:
|
|
minimalTlsVersion: "1.2"
|
|
administratorLogin: "sqladmin"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# Combined: type check + parameterized condition + expression
|
|
# Deny storage accounts with wrong naming convention
|
|
# =========================================================================
|
|
|
|
- note: storage_naming_convention_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"not": {
|
|
"field": "name",
|
|
"like": "[concat(parameters('prefix'), '*')]"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
prefix: "sa"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorageaccount"
|
|
location: "eastus"
|
|
want_effect: "deny"
|
|
|
|
- note: storage_naming_convention_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{
|
|
"not": {
|
|
"field": "name",
|
|
"like": "[concat(parameters('prefix'), '*')]"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
parameters:
|
|
prefix: "sa"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "saprodeast01"
|
|
location: "eastus"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# NIC — Deny public IP association (count over ipConfigurations)
|
|
# =========================================================================
|
|
|
|
- note: nic_deny_public_ip
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Network/networkInterfaces" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*]",
|
|
"where": {
|
|
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].publicIPAddress.id",
|
|
"exists": true
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkInterfaces"
|
|
name: "myNic"
|
|
location: "eastus"
|
|
properties:
|
|
ipConfigurations:
|
|
- name: "ipconfig1"
|
|
properties:
|
|
privateIPAddress: "10.0.0.4"
|
|
privateIPAllocationMethod: "Dynamic"
|
|
subnet:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/subnet1"
|
|
publicIPAddress:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pip1"
|
|
want_effect: "deny"
|
|
|
|
- note: nic_no_public_ip_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Network/networkInterfaces" },
|
|
{
|
|
"count": {
|
|
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*]",
|
|
"where": {
|
|
"field": "Microsoft.Network/networkInterfaces/ipConfigurations[*].publicIPAddress.id",
|
|
"exists": true
|
|
}
|
|
},
|
|
"greater": 0
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
resource:
|
|
type: "Microsoft.Network/networkInterfaces"
|
|
name: "myNic"
|
|
location: "eastus"
|
|
properties:
|
|
ipConfigurations:
|
|
- name: "ipconfig1"
|
|
properties:
|
|
privateIPAddress: "10.0.0.4"
|
|
privateIPAllocationMethod: "Dynamic"
|
|
subnet:
|
|
id: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/subnet1"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# API Version — Require minimum API version for storage accounts
|
|
# =========================================================================
|
|
|
|
- note: storage_require_min_api_version_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{ "field": "apiVersion", "less": "2019-06-01" }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2018-11-01"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: "deny"
|
|
|
|
- note: storage_require_min_api_version_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
|
|
{ "field": "apiVersion", "less": "2019-06-01" }
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2023-01-01"
|
|
resource:
|
|
type: "Microsoft.Storage/storageAccounts"
|
|
name: "mystorage"
|
|
location: "eastus"
|
|
properties:
|
|
supportsHttpsTrafficOnly: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# API Version — Deny old SQL Server API versions
|
|
# =========================================================================
|
|
|
|
- note: sql_deny_old_api_version
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Sql/servers" },
|
|
{ "field": "apiVersion", "less": "2020-01-01" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
api_version: "2019-06-01-preview"
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "myserver"
|
|
location: "eastus"
|
|
kind: "v12.0"
|
|
properties:
|
|
minimalTlsVersion: "1.2"
|
|
want_effect: "audit"
|
|
|
|
- note: sql_deny_old_api_version_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Sql/servers" },
|
|
{ "field": "apiVersion", "less": "2020-01-01" }
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
api_version: "2023-05-01-preview"
|
|
resource:
|
|
type: "Microsoft.Sql/servers"
|
|
name: "myserver"
|
|
location: "eastus"
|
|
kind: "v12.0"
|
|
properties:
|
|
minimalTlsVersion: "1.2"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# API Version + properties — VM with api_version and nested check
|
|
# =========================================================================
|
|
|
|
- note: vm_old_api_with_encryption_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{ "field": "apiVersion", "less": "2020-06-01" },
|
|
{
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.storageAccountType",
|
|
"notEquals": "Premium_LRS"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2019-07-01"
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Standard_D4s_v3"
|
|
properties:
|
|
storageProfile:
|
|
osDisk:
|
|
osType: "Linux"
|
|
managedDisk:
|
|
storageAccountType: "Standard_LRS"
|
|
want_effect: "deny"
|
|
|
|
- note: vm_new_api_with_encryption_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
|
|
{ "field": "apiVersion", "less": "2020-06-01" },
|
|
{
|
|
"field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.storageAccountType",
|
|
"notEquals": "Premium_LRS"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2023-03-01"
|
|
resource:
|
|
type: "Microsoft.Compute/virtualMachines"
|
|
name: "myVM"
|
|
location: "eastus"
|
|
sku:
|
|
name: "Standard_D4s_v3"
|
|
properties:
|
|
storageProfile:
|
|
osDisk:
|
|
osType: "Linux"
|
|
managedDisk:
|
|
storageAccountType: "Standard_LRS"
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# API Version — Key Vault require recent API version
|
|
# =========================================================================
|
|
|
|
- note: keyvault_require_recent_api_version_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.KeyVault/vaults" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "apiVersion", "exists": false },
|
|
{ "field": "apiVersion", "less": "2021-06-01-preview" }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
api_version: "2019-09-01"
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
name: "myvault"
|
|
location: "eastus"
|
|
properties:
|
|
enableSoftDelete: true
|
|
enablePurgeProtection: true
|
|
want_effect: "audit"
|
|
|
|
- note: keyvault_require_recent_api_version_compliant
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.KeyVault/vaults" },
|
|
{
|
|
"anyOf": [
|
|
{ "field": "apiVersion", "exists": false },
|
|
{ "field": "apiVersion", "less": "2021-06-01-preview" }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "audit" }
|
|
}
|
|
api_version: "2023-07-01"
|
|
resource:
|
|
type: "Microsoft.KeyVault/vaults"
|
|
name: "myvault"
|
|
location: "eastus"
|
|
properties:
|
|
enableSoftDelete: true
|
|
enablePurgeProtection: true
|
|
want_effect: ~
|
|
|
|
# =========================================================================
|
|
# API Version — Web app deny old API versions with TLS check
|
|
# =========================================================================
|
|
|
|
- note: webapp_old_api_tls_denied
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Web/sites" },
|
|
{ "field": "apiVersion", "lessOrEquals": "2018-11-01" },
|
|
{
|
|
"field": "Microsoft.Web/sites/siteConfig.minTlsVersion",
|
|
"less": "1.2"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2018-02-01"
|
|
resource:
|
|
type: "Microsoft.Web/sites"
|
|
name: "mywebapp"
|
|
location: "eastus"
|
|
kind: "app"
|
|
properties:
|
|
siteConfig:
|
|
minTlsVersion: "1.0"
|
|
want_effect: "deny"
|
|
|
|
- note: webapp_new_api_tls_skip
|
|
policy_rule: |
|
|
{
|
|
"if": {
|
|
"allOf": [
|
|
{ "field": "type", "equals": "Microsoft.Web/sites" },
|
|
{ "field": "apiVersion", "lessOrEquals": "2018-11-01" },
|
|
{
|
|
"field": "Microsoft.Web/sites/siteConfig.minTlsVersion",
|
|
"less": "1.2"
|
|
}
|
|
]
|
|
},
|
|
"then": { "effect": "deny" }
|
|
}
|
|
api_version: "2023-01-01"
|
|
resource:
|
|
type: "Microsoft.Web/sites"
|
|
name: "mywebapp"
|
|
location: "eastus"
|
|
kind: "app"
|
|
properties:
|
|
siteConfig:
|
|
minTlsVersion: "1.0"
|
|
want_effect: ~
|