Skip to content

Commit be50853

Browse files
pilorAzure Policy Bot
pilor
and
Azure Policy Bot
authoredOct 9, 2023
Built-in Policy Release ff326952 (#1221)
Co-authored-by: Azure Policy Bot <[email protected]>
1 parent 885b735 commit be50853

File tree

5 files changed

+112
-13
lines changed

5 files changed

+112
-13
lines changed
 

‎built-in-policies/policyDefinitions/Azure Government/Machine Learning/Workspace_PublicNetworkAccessDisabled_Modify.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
"description": "Disable public network access for Azure Machine Learning Workspaces so that your workspaces aren't accessible over the public internet. This helps protect the workspaces against data leakage risks. You can control exposure of your workspaces by creating private endpoints instead. Learn more at: https://learn.microsoft.com/azure/machine-learning/how-to-configure-private-link?view=azureml-api-2&tabs=azure-portal.",
77
"metadata": {
88
"category": "Machine Learning",
9-
"version": "1.0.1"
9+
"version": "1.0.2"
1010
},
11-
"version": "1.0.1",
11+
"version": "1.0.2",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -40,12 +40,12 @@
4040
"effect": "[parameters('effect')]",
4141
"details": {
4242
"roleDefinitionIds": [
43-
"/providers/microsoft.authorization/roleDefinitions/f6c7c914-8db3-469d-8ca1-694a8f32e121"
43+
"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
4444
],
4545
"conflictEffect": "audit",
4646
"operations": [
4747
{
48-
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-07-01')]",
48+
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-10-01')]",
4949
"operation": "addOrReplace",
5050
"field": "Microsoft.MachineLearningServices/workspaces/publicNetworkAccess",
5151
"value": "Disabled"

‎built-in-policies/policyDefinitions/Machine Learning/Workspace_PublicNetworkAccessDisabled_Modify.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
"description": "Disable public network access for Azure Machine Learning Workspaces so that your workspaces aren't accessible over the public internet. This helps protect the workspaces against data leakage risks. You can control exposure of your workspaces by creating private endpoints instead. Learn more at: https://learn.microsoft.com/azure/machine-learning/how-to-configure-private-link?view=azureml-api-2&tabs=azure-portal.",
77
"metadata": {
88
"category": "Machine Learning",
9-
"version": "1.0.2"
9+
"version": "1.0.3"
1010
},
11-
"version": "1.0.2",
11+
"version": "1.0.3",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -45,7 +45,7 @@
4545
"conflictEffect": "audit",
4646
"operations": [
4747
{
48-
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-07-01')]",
48+
"condition": "[greaterOrEquals(requestContext().apiVersion, '2021-10-01')]",
4949
"operation": "addOrReplace",
5050
"field": "Microsoft.MachineLearningServices/workspaces/publicNetworkAccess",
5151
"value": "Disabled"

‎built-in-policies/policySetDefinitions/Azure Government/Kubernetes/AKS_Guardrails.json

+15-2
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
"policyType": "BuiltIn",
55
"description": "A collection of Kubernetes best practices that are recommended by Azure Kubernetes Service (AKS). For the best experience, use AKS Guardrails to assign this policy initiative: https://aka.ms/aks/guardrails.",
66
"metadata": {
7-
"version": "1.1.1-preview",
7+
"version": "1.2.1-preview",
88
"category": "Kubernetes",
99
"preview": true
1010
},
11-
"version": "1.1.1-preview",
11+
"version": "1.2.1-preview",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -249,6 +249,19 @@
249249
"value": "[parameters('excludedImages')]"
250250
}
251251
}
252+
},
253+
{
254+
"policyDefinitionReferenceId": "ensureCsiDriverStorageClass",
255+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4f3823b6-6dac-4b5a-9c61-ce1afb829f17",
256+
"definitionVersion": "3.*.*",
257+
"parameters": {
258+
"effect": {
259+
"value": "[parameters('effect')]"
260+
},
261+
"excludedNamespaces": {
262+
"value": "[parameters('excludedNamespaces')]"
263+
}
264+
}
252265
}
253266
]
254267
},

‎built-in-policies/policySetDefinitions/Azure Government/Security Center/AzureSecurityCenter.json

+75-2
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
"policyType": "BuiltIn",
55
"description": "The Microsoft cloud security benchmark initiative represents the policies and controls implementing security recommendations defined in Microsoft cloud security benchmark, see https://aka.ms/azsecbm. This also serves as the Microsoft Defender for Cloud default policy initiative. You can directly assign this initiative, or manage its policies and compliance results within Microsoft Defender for Cloud.",
66
"metadata": {
7-
"version": "47.6.0",
7+
"version": "47.7.0",
88
"category": "Security Center"
99
},
10-
"version": "47.6.0",
10+
"version": "47.7.0",
1111
"policyDefinitionGroups": [
1212
{
1313
"name": "Azure_Security_Benchmark_v3.0_NS-1",
@@ -5910,6 +5910,79 @@
59105910
"groupNames": [
59115911
"Azure_Security_Benchmark_v3.0_PV-4"
59125912
]
5913+
},
5914+
{
5915+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc",
5916+
"definitionVersion": "1.*.*",
5917+
"policyDefinitionReferenceId": "cognitiveServicesAccountsShouldHaveLocalAuthenticationMethodsDisabled",
5918+
"groupNames": [
5919+
"Azure_Security_Benchmark_v3.0_IM-1"
5920+
]
5921+
},
5922+
{
5923+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cddd188c-4b82-4c48-a19d-ddf74ee66a01",
5924+
"definitionVersion": "3.*.*",
5925+
"policyDefinitionReferenceId": "cognitiveServicesShouldUsePrivateLink",
5926+
"groupNames": [
5927+
"Azure_Security_Benchmark_v3.0_NS-2"
5928+
]
5929+
},
5930+
{
5931+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87",
5932+
"definitionVersion": "1.*.*",
5933+
"policyDefinitionReferenceId": "virtualMachinesAndVirtualMachineScaleSetsShouldHaveEncryptionAtHostEnabled",
5934+
"groupNames": [
5935+
"Azure_Security_Benchmark_v3.0_DP-4"
5936+
]
5937+
},
5938+
{
5939+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a",
5940+
"definitionVersion": "1.*.*",
5941+
"policyDefinitionReferenceId": "azureCosmosDBShouldDisablePublicNetworkAccess",
5942+
"groupNames": [
5943+
"Azure_Security_Benchmark_v3.0_NS-2"
5944+
]
5945+
},
5946+
{
5947+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/58440f8a-10c5-4151-bdce-dfbaad4a20b7",
5948+
"definitionVersion": "1.*.*",
5949+
"policyDefinitionReferenceId": "cosmosDBAaccountsShouldUsePrivateLink",
5950+
"groupNames": [
5951+
"Azure_Security_Benchmark_v3.0_NS-2"
5952+
]
5953+
},
5954+
{
5955+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7",
5956+
"definitionVersion": "1.*.*",
5957+
"policyDefinitionReferenceId": "vPNGatewaysShouldUseOnlyAzureActiveDirectoryAzureADAuthenticationForPointtositeUsers",
5958+
"groupNames": [
5959+
"Azure_Security_Benchmark_v3.0_IM-1"
5960+
]
5961+
},
5962+
{
5963+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf",
5964+
"definitionVersion": "2.*.*",
5965+
"policyDefinitionReferenceId": "azureSQLDatabaseShouldBeRunningTLSVersion12OrNewer",
5966+
"groupNames": [
5967+
"Azure_Security_Benchmark_v3.0_DP-3",
5968+
"Azure_Security_Benchmark_v3.0_IM-4"
5969+
]
5970+
},
5971+
{
5972+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9dfea752-dd46-4766-aed1-c355fa93fb91",
5973+
"definitionVersion": "1.*.*",
5974+
"policyDefinitionReferenceId": "azureSQLManagedInstancesShouldDisablePublicNetworkAccess",
5975+
"groupNames": [
5976+
"Azure_Security_Benchmark_v3.0_NS-2"
5977+
]
5978+
},
5979+
{
5980+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54",
5981+
"definitionVersion": "2.*.*",
5982+
"policyDefinitionReferenceId": "storageAccountsShouldPreventSharedKeyAccess",
5983+
"groupNames": [
5984+
"Azure_Security_Benchmark_v3.0_IM-1"
5985+
]
59135986
}
59145987
]
59155988
},

‎built-in-policies/policySetDefinitions/Kubernetes/AKS_Guardrails.json

+15-2
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
"policyType": "BuiltIn",
55
"description": "A collection of Kubernetes best practices that are recommended by Azure Kubernetes Service (AKS). For the best experience, use AKS Guardrails to assign this policy initiative: https://aka.ms/aks/guardrails.",
66
"metadata": {
7-
"version": "1.1.1-preview",
7+
"version": "1.2.1-preview",
88
"category": "Kubernetes",
99
"preview": true
1010
},
11-
"version": "1.1.1-preview",
11+
"version": "1.2.1-preview",
1212
"parameters": {
1313
"effect": {
1414
"type": "String",
@@ -249,6 +249,19 @@
249249
"value": "[parameters('excludedImages')]"
250250
}
251251
}
252+
},
253+
{
254+
"policyDefinitionReferenceId": "ensureCsiDriverStorageClass",
255+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4f3823b6-6dac-4b5a-9c61-ce1afb829f17",
256+
"definitionVersion": "2.*.*",
257+
"parameters": {
258+
"effect": {
259+
"value": "[parameters('effect')]"
260+
},
261+
"excludedNamespaces": {
262+
"value": "[parameters('excludedNamespaces')]"
263+
}
264+
}
252265
}
253266
]
254267
},

0 commit comments

Comments
 (0)
Please sign in to comment.