Skip to content

Commit 44c9d2e

Browse files
pilorAzure Policy Bot
and
Azure Policy Bot
authoredSep 23, 2021
Built-in Policy Release b05e19b7 (#831)
Co-authored-by: Azure Policy Bot <[email protected]>
1 parent b760cdc commit 44c9d2e

17 files changed

+884
-21
lines changed
 
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"properties": {
3+
"displayName": "Azure Automation account should have local authentication method disabled",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Disabling local authentication methods improves security by ensuring that Azure Automation accounts exclusively require Azure Active Directory identities for authentication.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Automation"
10+
},
11+
"parameters": {
12+
"effect": {
13+
"type": "String",
14+
"defaultValue": "Audit",
15+
"allowedValues": [
16+
"Audit",
17+
"Deny",
18+
"Disabled"
19+
],
20+
"metadata": {
21+
"displayName": "Effect",
22+
"description": "Enable or disable the execution of the policy"
23+
}
24+
}
25+
},
26+
"policyRule": {
27+
"if": {
28+
"allOf": [
29+
{
30+
"field": "type",
31+
"equals": "Microsoft.Automation/automationAccounts"
32+
},
33+
{
34+
"field": "Microsoft.Automation/automationAccounts/disableLocalAuth",
35+
"notEquals": true
36+
}
37+
]
38+
},
39+
"then": {
40+
"effect": "[parameters('effect')]"
41+
}
42+
}
43+
},
44+
"id": "/providers/Microsoft.Authorization/policyDefinitions/48c5f1cb-14ad-4797-8e3b-f78ab3f8d700",
45+
"name": "48c5f1cb-14ad-4797-8e3b-f78ab3f8d700"
46+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"properties": {
3+
"displayName": "Configure Azure Automation account to disable local authentication",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Disable local authentication methods so that your Azure Automation accounts exclusively require Azure Active Directory identities for authentication.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Automation"
10+
},
11+
"parameters": {
12+
"effect": {
13+
"type": "String",
14+
"defaultValue": "Modify",
15+
"allowedValues": [
16+
"Modify",
17+
"Disabled"
18+
],
19+
"metadata": {
20+
"displayName": "Effect",
21+
"description": "Enable or disable the execution of the policy"
22+
}
23+
}
24+
},
25+
"policyRule": {
26+
"if": {
27+
"allOf": [
28+
{
29+
"field": "type",
30+
"equals": "Microsoft.Automation/automationAccounts"
31+
},
32+
{
33+
"field": "Microsoft.Automation/automationAccounts/disableLocalAuth",
34+
"notEquals": true
35+
}
36+
]
37+
},
38+
"then": {
39+
"effect": "[parameters('effect')]",
40+
"details": {
41+
"conflictEffect": "audit",
42+
"roleDefinitionIds": [
43+
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
44+
],
45+
"operations": [
46+
{
47+
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-06-22')]",
48+
"operation": "addOrReplace",
49+
"field": "Microsoft.Automation/automationAccounts/disableLocalAuth",
50+
"value": true
51+
}
52+
]
53+
}
54+
}
55+
}
56+
},
57+
"id": "/providers/Microsoft.Authorization/policyDefinitions/30d1d58e-8f96-47a5-8564-499a3f3cca81",
58+
"name": "30d1d58e-8f96-47a5-8564-499a3f3cca81"
59+
}

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/AllowedUsersGroups.json

+5-5
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Control the user, primary group, supplemental group and file system group IDs that pods and containers can use to run in a Kubernetes Cluster. This recommendation is part of Pod Security Policies which are intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.",
77
"metadata": {
8-
"version": "4.0.1",
8+
"version": "4.0.2",
99
"category": "Kubernetes"
1010
},
1111
"parameters": {
@@ -105,7 +105,7 @@
105105
"type": "String",
106106
"metadata": {
107107
"displayName": "Run as user rule",
108-
"description": "The 'RunAsUser' rule that containers are allowed to run with."
108+
"description": "The 'RunAsUser' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MustRunAsNonRoot requires the pod be submitted with non-zero runAsUser or have USER directive defined (using a numeric UID) in the image. RunAsAny allows any runAsUser to be specified"
109109
},
110110
"allowedValues": [
111111
"MustRunAs",
@@ -156,7 +156,7 @@
156156
"type": "String",
157157
"metadata": {
158158
"displayName": "Run as group rule",
159-
"description": "The 'RunAsGroup' rule that containers are allowed to run with."
159+
"description": "The 'RunAsGroup' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'RunAsGroup' be specified. RunAsAny allows any"
160160
},
161161
"allowedValues": [
162162
"MustRunAs",
@@ -207,7 +207,7 @@
207207
"type": "String",
208208
"metadata": {
209209
"displayName": "Supplemental group rule",
210-
"description": "The 'SupplementalGroups' rule that containers are allowed to run with."
210+
"description": "The 'SupplementalGroups' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'SupplementalGroups' be specified. RunAsAny allows any"
211211
},
212212
"allowedValues": [
213213
"MustRunAs",
@@ -258,7 +258,7 @@
258258
"type": "String",
259259
"metadata": {
260260
"displayName": "File system group rule",
261-
"description": "The 'FSGroup' rule that containers are allowed to run with."
261+
"description": "The 'FSGroup' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'FSGroup' be specified. RunAsAny allows any"
262262
},
263263
"allowedValues": [
264264
"MustRunAs",
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
"properties": {
3+
"displayName": "Kubernetes clusters should not allow endpoint edit permissions of ClusterRole/system:aggregate-to-edit",
4+
"policyType": "BuiltIn",
5+
"mode": "Microsoft.Kubernetes.Data",
6+
"description": "ClusterRole/system:aggregate-to-edit should not allow endpoint edit permissions due to CVE-2021-25740, Endpoint & EndpointSlice permissions allow cross-Namespace forwarding, https://github.com/kubernetes/kubernetes/issues/103675. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Kubernetes"
10+
},
11+
"parameters": {
12+
"effect": {
13+
"type": "String",
14+
"metadata": {
15+
"displayName": "Effect",
16+
"description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Disabled' turns off the policy."
17+
},
18+
"allowedValues": [
19+
"Audit",
20+
"Disabled"
21+
],
22+
"defaultValue": "Audit"
23+
},
24+
"excludedNamespaces": {
25+
"type": "Array",
26+
"metadata": {
27+
"displayName": "Namespace exclusions",
28+
"description": "List of Kubernetes namespaces to exclude from policy evaluation."
29+
},
30+
"defaultValue": [
31+
"kube-system",
32+
"gatekeeper-system",
33+
"azure-arc"
34+
]
35+
},
36+
"namespaces": {
37+
"type": "Array",
38+
"metadata": {
39+
"displayName": "Namespace inclusions",
40+
"description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
41+
},
42+
"defaultValue": []
43+
},
44+
"labelSelector": {
45+
"type": "object",
46+
"metadata": {
47+
"displayName": "Kubernetes label selector",
48+
"description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
49+
},
50+
"defaultValue": {},
51+
"schema": {
52+
"description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
53+
"type": "object",
54+
"properties": {
55+
"matchLabels": {
56+
"description": "matchLabels is a map of {key,value} pairs.",
57+
"type": "object",
58+
"additionalProperties": {
59+
"type": "string"
60+
},
61+
"minProperties": 1
62+
},
63+
"matchExpressions": {
64+
"description": "matchExpressions is a list of values, a key, and an operator.",
65+
"type": "array",
66+
"items": {
67+
"type": "object",
68+
"properties": {
69+
"key": {
70+
"description": "key is the label key that the selector applies to.",
71+
"type": "string"
72+
},
73+
"operator": {
74+
"description": "operator represents a key's relationship to a set of values.",
75+
"type": "string",
76+
"enum": [
77+
"In",
78+
"NotIn",
79+
"Exists",
80+
"DoesNotExist"
81+
]
82+
},
83+
"values": {
84+
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
85+
"type": "array",
86+
"items": {
87+
"type": "string"
88+
}
89+
}
90+
},
91+
"required": [
92+
"key",
93+
"operator"
94+
],
95+
"additionalProperties": false
96+
},
97+
"minItems": 1
98+
}
99+
},
100+
"additionalProperties": false
101+
}
102+
}
103+
},
104+
"policyRule": {
105+
"if": {
106+
"field": "type",
107+
"in": [
108+
"Microsoft.ContainerService/managedClusters"
109+
]
110+
},
111+
"then": {
112+
"effect": "[parameters('effect')]",
113+
"details": {
114+
"constraintTemplate": "https://store.policy.azure.us/kubernetes/block-endpoint-edit-default-role/v1/template.yaml",
115+
"constraint": "https://store.policy.azure.us/kubernetes/block-endpoint-edit-default-role/v1/constraint.yaml",
116+
"excludedNamespaces": "[parameters('excludedNamespaces')]",
117+
"namespaces": "[parameters('namespaces')]",
118+
"labelSelector": "[parameters('labelSelector')]"
119+
}
120+
}
121+
}
122+
},
123+
"id": "/providers/Microsoft.Authorization/policyDefinitions/1ddac26b-ed48-4c30-8cc5-3a68c79b8001",
124+
"name": "1ddac26b-ed48-4c30-8cc5-3a68c79b8001"
125+
}

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/ContainerNoPrivilegeEscalation.json

+15-4
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Do not allow containers to run with privilege escalation to root in a Kubernetes cluster. This recommendation is part of CIS 5.2.5 which is intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.",
77
"metadata": {
8-
"version": "3.0.1",
8+
"version": "4.0.0",
99
"category": "Kubernetes"
1010
},
1111
"parameters": {
@@ -100,6 +100,14 @@
100100
},
101101
"additionalProperties": false
102102
}
103+
},
104+
"excludedContainers": {
105+
"type": "Array",
106+
"metadata": {
107+
"displayName": "Containers exclusions",
108+
"description": "The list of InitContainers and Containers to exclude from policy evaluation. The identify is the name of container. Use an empty list to apply this policy to all containers in all namespaces."
109+
},
110+
"defaultValue": []
103111
}
104112
},
105113
"policyRule": {
@@ -112,11 +120,14 @@
112120
"then": {
113121
"effect": "[parameters('effect')]",
114122
"details": {
115-
"constraintTemplate": "https://store.policy.azure.us/kubernetes/container-no-privilege-escalation/v1/template.yaml",
116-
"constraint": "https://store.policy.azure.us/kubernetes/container-no-privilege-escalation/v1/constraint.yaml",
123+
"constraintTemplate": "https://store.policy.azure.us/kubernetes/container-no-privilege-escalation/v2/template.yaml",
124+
"constraint": "https://store.policy.azure.us/kubernetes/container-no-privilege-escalation/v2/constraint.yaml",
117125
"excludedNamespaces": "[parameters('excludedNamespaces')]",
118126
"namespaces": "[parameters('namespaces')]",
119-
"labelSelector": "[parameters('labelSelector')]"
127+
"labelSelector": "[parameters('labelSelector')]",
128+
"values": {
129+
"excludedContainers": "[parameters('excludedContainers')]"
130+
}
120131
}
121132
}
122133
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"properties": {
3+
"displayName": "Azure Event Grid domains should have local authentication methods disabled",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Disabling local authentication methods improves security by ensuring that Azure Event Grid domains exclusively require Azure Active Directory identities for authentication. Learn more at: https://aka.ms/aeg-disablelocalauth.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Event Grid"
10+
},
11+
"parameters": {
12+
"effect": {
13+
"type": "String",
14+
"defaultValue": "Audit",
15+
"allowedValues": [
16+
"Audit",
17+
"Deny",
18+
"Disabled"
19+
],
20+
"metadata": {
21+
"displayName": "Effect",
22+
"description": "Enable or disable the execution of the policy"
23+
}
24+
}
25+
},
26+
"policyRule": {
27+
"if": {
28+
"allOf": [
29+
{
30+
"field": "type",
31+
"equals": "Microsoft.EventGrid/domains"
32+
},
33+
{
34+
"field": "Microsoft.EventGrid/domains/disableLocalAuth",
35+
"notEquals": true
36+
}
37+
]
38+
},
39+
"then": {
40+
"effect": "[parameters('effect')]"
41+
}
42+
}
43+
},
44+
"id": "/providers/Microsoft.Authorization/policyDefinitions/8bfadddb-ee1c-4639-8911-a38cb8e0b3bd",
45+
"name": "8bfadddb-ee1c-4639-8911-a38cb8e0b3bd"
46+
}

0 commit comments

Comments
 (0)
Please sign in to comment.