Skip to content

Commit 20c3796

Browse files
robgaAzure Policy Bot
robga
and
Azure Policy Bot
authored
Built-in Policy Release 64b24ce2 (#1493)
Co-authored-by: Azure Policy Bot <[email protected]>
1 parent 18e272a commit 20c3796

File tree

54 files changed

+5682
-9691
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+5682
-9691
lines changed

‎built-in-policies/policyDefinitions/App Service/FunctionApp_Audit_AutoGeneratedDomainNameLabelScope.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"properties": {
3+
"displayName": "Function apps should provide an auto-generated domain name label scope",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Providing an auto-generated domain name label scope for your app ensures that the app can be accessed via a unique URL. For more information, see https://aka.ms/app-service-autoGeneratedDomainNameLabelScope.",
7+
"version": "1.0.0",
8+
"metadata": {
9+
"version": "1.0.0",
10+
"category": "App Service"
11+
},
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Disabled",
22+
"Deny"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites"
33+
},
34+
{
35+
"field": "kind",
36+
"contains": "functionapp"
37+
},
38+
{
39+
"field": "kind",
40+
"notContains": "workflowapp"
41+
},
42+
{
43+
"field": "Microsoft.Web/sites/sku",
44+
"notContains": "Isolated"
45+
},
46+
{
47+
"field": "Microsoft.Web/sites/autoGeneratedDomainNameLabelScope",
48+
"exists": "false"
49+
}
50+
]
51+
},
52+
"then": {
53+
"effect": "[parameters('effect')]"
54+
}
55+
},
56+
"versions": [
57+
"1.0.0"
58+
]
59+
},
60+
"id": "/providers/Microsoft.Authorization/policyDefinitions/5f78d1de-663e-4a6b-8dd8-791621f3b6d6",
61+
"name": "5f78d1de-663e-4a6b-8dd8-791621f3b6d6"
62+
}

‎built-in-policies/policyDefinitions/App Service/FunctionApp_Slot_Audit_AutoGeneratedDomainNameLabelScope.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"properties": {
3+
"displayName": "Function app slots should provide an auto-generated domain name label scope",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Providing an auto-generated domain name label scope for your app ensures that the app can be accessed via a unique URL. For more information, see https://aka.ms/app-service-autoGeneratedDomainNameLabelScope.",
7+
"version": "1.0.0",
8+
"metadata": {
9+
"version": "1.0.0",
10+
"category": "App Service"
11+
},
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Disabled",
22+
"Deny"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites/slots"
33+
},
34+
{
35+
"field": "kind",
36+
"contains": "functionapp"
37+
},
38+
{
39+
"field": "kind",
40+
"notContains": "workflowapp"
41+
},
42+
{
43+
"field": "Microsoft.Web/sites/slots/sku",
44+
"notContains": "Isolated"
45+
},
46+
{
47+
"field": "Microsoft.Web/sites/slots/autoGeneratedDomainNameLabelScope",
48+
"exists": "false"
49+
}
50+
]
51+
},
52+
"then": {
53+
"effect": "[parameters('effect')]"
54+
}
55+
},
56+
"versions": [
57+
"1.0.0"
58+
]
59+
},
60+
"id": "/providers/Microsoft.Authorization/policyDefinitions/67da6a60-29e0-471d-b856-4cd2dee72fc0",
61+
"name": "67da6a60-29e0-471d-b856-4cd2dee72fc0"
62+
}

‎built-in-policies/policyDefinitions/App Service/WebApp_Audit_AutoGeneratedDomainNameLabelScope.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"properties": {
3+
"displayName": "App Service apps should provide an auto-generated domain name label scope",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Providing an auto-generated domain name label scope for your app ensures that the app can be accessed via a unique URL. For more information, see https://aka.ms/app-service-autoGeneratedDomainNameLabelScope.",
7+
"version": "1.0.0",
8+
"metadata": {
9+
"version": "1.0.0",
10+
"category": "App Service"
11+
},
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Disabled",
22+
"Deny"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites"
33+
},
34+
{
35+
"field": "Microsoft.Web/sites/sku",
36+
"notContains": "Isolated"
37+
},
38+
{
39+
"field": "Microsoft.Web/sites/autoGeneratedDomainNameLabelScope",
40+
"exists": "false"
41+
}
42+
]
43+
},
44+
"then": {
45+
"effect": "[parameters('effect')]"
46+
}
47+
},
48+
"versions": [
49+
"1.0.0"
50+
]
51+
},
52+
"id": "/providers/Microsoft.Authorization/policyDefinitions/80a53f01-1f9a-49af-a5d5-0248e947dc8e",
53+
"name": "80a53f01-1f9a-49af-a5d5-0248e947dc8e"
54+
}

‎built-in-policies/policyDefinitions/App Service/WebApp_Slot_Audit_AutoGeneratedDomainNameLabelScope.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"properties": {
3+
"displayName": "App Service app slots should provide an auto-generated domain name label scope",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Providing an auto-generated domain name label scope for your app ensures that the app can be accessed via a unique URL. For more information, see https://aka.ms/app-service-autoGeneratedDomainNameLabelScope.",
7+
"version": "1.0.0",
8+
"metadata": {
9+
"version": "1.0.0",
10+
"category": "App Service"
11+
},
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Disabled",
22+
"Deny"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites/slots"
33+
},
34+
{
35+
"field": "Microsoft.Web/sites/slots/sku",
36+
"notContains": "Isolated"
37+
},
38+
{
39+
"field": "Microsoft.Web/sites/slots/autoGeneratedDomainNameLabelScope",
40+
"exists": "false"
41+
}
42+
]
43+
},
44+
"then": {
45+
"effect": "[parameters('effect')]"
46+
}
47+
},
48+
"versions": [
49+
"1.0.0"
50+
]
51+
},
52+
"id": "/providers/Microsoft.Authorization/policyDefinitions/d1a5414f-ada4-46bf-bea7-243d5100d981",
53+
"name": "d1a5414f-ada4-46bf-bea7-243d5100d981"
54+
}

‎built-in-policies/policyDefinitions/Azure Ai Services/NetworkAcls_Audit.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
"mode": "Indexed",
66
"description": "By restricting network access, you can ensure that only allowed networks can access the service. This can be achieved by configuring network rules so that only applications from allowed networks can access the Azure AI service.",
77
"metadata": {
8-
"version": "3.2.0",
8+
"version": "3.3.0",
99
"category": "Azure Ai Services"
1010
},
11-
"version": "3.2.0",
11+
"version": "3.3.0",
1212
"parameters": {
1313
"effect": {
1414
"type": "string",
@@ -52,6 +52,10 @@
5252
{
5353
"field": "Microsoft.Search/searchServices/publicNetworkAccess",
5454
"notEquals": "Disabled"
55+
},
56+
{
57+
"field": "Microsoft.Search/searchServices/networkRuleSet.ipRules[*].value",
58+
"exists": "false"
5559
}
5660
]
5761
}
@@ -62,6 +66,7 @@
6266
}
6367
},
6468
"versions": [
69+
"3.3.0",
6570
"3.2.0",
6671
"3.1.0",
6772
"3.0.0"

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/DisallowedBadPodDisruptionBudgets.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33
"displayName": "[Preview]: Kubernetes cluster should implement accurate Pod Disruption Budgets",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
6-
"description": "Prevents faulty Pod Disruption Budgets, ensuring a minimum number of operational pods. Refer to the official Kubernetes documentation for details. Relies on Gatekeeper data replication and syncs all ingress resources scoped to it into OPA. Before applying this policy, ensure that the synced ingress resources won't strain your memory capacity. Though parameters evaluate specific namespaces, all resources of that kind across namespaces will sync. Note: currently in preview for Kubernetes Service (AKS).",
6+
"description": "Prevents faulty Pod Disruption Budgets, ensuring a minimum number of operational pods. Refer to the official Kubernetes documentation for details. Relies on Gatekeeper data replication and syncs all Deployment, StatefulSet, and PodDisruptionBudget resources scoped to it into OPA. Before applying this policy, ensure that the synced resources won't strain your memory capacity. All resources of these kinds across namespaces will sync. Note: currently in preview for Kubernetes Service (AKS).",
77
"metadata": {
8-
"version": "1.2.0-preview",
8+
"version": "1.2.1-preview",
99
"category": "Kubernetes",
1010
"preview": true
1111
},
12-
"version": "1.2.0-preview",
12+
"version": "1.2.1-preview",
1313
"parameters": {
1414
"source": {
1515
"type": "String",
@@ -152,6 +152,7 @@
152152
}
153153
},
154154
"versions": [
155+
"1.2.1-PREVIEW",
155156
"1.2.0-PREVIEW",
156157
"1.1.0-PREVIEW",
157158
"1.0.1-PREVIEW",

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/ImagesDoNotUseLatest.json‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Requires that container images do not use the latest tag in Kubernetes, it is a best practice to ensure reproducibility, prevent unintended updates, and facilitate easier debugging and rollbacks by using explicit and versioned container images.",
77
"metadata": {
8-
"version": "1.1.0-preview",
8+
"version": "2.0.0-preview",
99
"category": "Kubernetes",
1010
"preview": true
1111
},
12-
"version": "1.1.0-preview",
12+
"version": "2.0.0-preview",
1313
"parameters": {
1414
"source": {
1515
"type": "String",
@@ -137,16 +137,13 @@
137137
"warn": "[parameters('warn')]",
138138
"templateInfo": {
139139
"sourceType": "PublicURL",
140-
"url": "https://store.policy.azure.us/kubernetes/container-no-latest-image/v1/template.yaml"
140+
"url": "https://store.policy.azure.us/kubernetes/container-no-latest-image/v2/template.yaml"
141141
},
142142
"apiGroups": [
143-
"apps"
143+
""
144144
],
145145
"kinds": [
146-
"Deployment",
147-
"StatefulSet",
148-
"ReplicationController",
149-
"ReplicaSet"
146+
"Pod"
150147
],
151148
"namespaces": "[parameters('namespaces')]",
152149
"excludedNamespaces": "[parameters('excludedNamespaces')]",
@@ -155,6 +152,7 @@
155152
}
156153
},
157154
"versions": [
155+
"2.0.0-PREVIEW",
158156
"1.1.0-PREVIEW",
159157
"1.0.0-PREVIEW"
160158
]

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/MustHaveAntiAffinityRulesSet.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Must Have Anti Affinity Rules Set",
3+
"displayName": "[Preview]: Must Have Anti Affinity Rules or Topology Spread Constraints Set",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
6-
"description": "This policy ensures that pods are scheduled on different nodes within the cluster. By enforcing anti-affinity rules, availability is maintained even if one of the nodes becomes unavailable. Pods will continue to run on other nodes, enhancing resilience.",
6+
"description": "This policy ensures that pods are scheduled on different nodes within the cluster. By enforcing anti-affinity rules or pod topology spread constraints, availability is maintained even if one of the nodes becomes unavailable. Pods will continue to run on other nodes, enhancing resilience.",
77
"metadata": {
8-
"version": "1.1.0-preview",
8+
"version": "1.1.1-preview",
99
"category": "Kubernetes",
1010
"preview": true
1111
},
12-
"version": "1.1.0-preview",
12+
"version": "1.1.1-preview",
1313
"parameters": {
1414
"source": {
1515
"type": "String",
@@ -155,6 +155,7 @@
155155
}
156156
},
157157
"versions": [
158+
"1.1.1-PREVIEW",
158159
"1.1.0-PREVIEW",
159160
"1.0.2-PREVIEW",
160161
"1.0.1-PREVIEW"

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/UniqueServiceSelectors.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33
"displayName": "[Preview]: Kubernetes cluster services should use unique selectors",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
6-
"description": "Ensure Services in a Namespace Have Unique Selectors. A unique service selector ensures that each service within a namespace is uniquely identifiable based on specific criteria. This policy syncs ingress resources into OPA via Gatekeeper. Before applying, verify Gatekeeper pods memory capacity won't be exceeded. Parameters apply to specific namespaces, but it syncs all resources of that type across all namespaces. Currently in preview for Kubernetes Service (AKS).",
6+
"description": "Ensure Services in a Namespace Have Unique Selectors. A unique service selector ensures that each service within a namespace is uniquely identifiable based on specific criteria. This policy syncs service resources into OPA via Gatekeeper. Before applying, verify Gatekeeper pods memory capacity won't be exceeded. Parameters apply to specific namespaces, but it syncs all resources of that type across all namespaces. Currently in preview for Kubernetes Service (AKS).",
77
"metadata": {
8-
"version": "1.1.0-preview",
8+
"version": "1.1.1-preview",
99
"category": "Kubernetes",
1010
"preview": true
1111
},
12-
"version": "1.1.0-preview",
12+
"version": "1.1.1-preview",
1313
"parameters": {
1414
"source": {
1515
"type": "String",
@@ -152,6 +152,7 @@
152152
}
153153
},
154154
"versions": [
155+
"1.1.1-PREVIEW",
155156
"1.1.0-PREVIEW",
156157
"1.0.1-PREVIEW",
157158
"1.0.0-PREVIEW"

0 commit comments

Comments
 (0)