Skip to content

Commit 036db3d

Browse files
BernieWhiteBernieWhite
authored
Fixes for policy as rule and policy ignore Azure#1731 #181 Azure#1323 (Azure#2720)
1 parent 56ebaf3 commit 036db3d

17 files changed

+548
-54
lines changed

‎.vscode/markdown.code-snippets

+10
Original file line numberDiff line numberDiff line change
@@ -140,5 +140,15 @@
140140
"",
141141
"```"
142142
]
143+
},
144+
"rule-azure-example-policy": {
145+
"scope": "markdown",
146+
"prefix": "rule-azure-example-policy",
147+
"description": "Example for Azure Policy",
148+
"body": [
149+
"### Configure with Azure Policy",
150+
"",
151+
"To address this issue at runtime use the following policies:"
152+
]
143153
}
144154
}

‎.vscode/yaml.code-snippets

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{
22
"Azure rule with type": {
3+
"scope": "yaml",
34
"prefix": "rule-azure-with-type",
45
"description": "Rule definition for Azure",
56
"body": [

‎data/policy-ignore.json

+37-1
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,42 @@
165165
"/providers/Microsoft.Authorization/policyDefinitions/cfdc5972-75b3-4418-8ae1-7f5c36839390"
166166
],
167167
"reason": "Duplicate",
168-
"value": "Azure.Defender.Storage.SensitiveData"
168+
"value": "Azure.Defender.Storage.DataScan"
169+
},
170+
{
171+
"policyDefinitionIds": [
172+
"/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb"
173+
],
174+
"reason": "Duplicate",
175+
"value": "Azure.ContainerApp.Insecure"
176+
},
177+
{
178+
"policyDefinitionIds": [
179+
"/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7"
180+
],
181+
"reason": "Duplicate",
182+
"value": "Azure.ContainerApp.ManagedIdentity"
183+
},
184+
{
185+
"policyDefinitionIds": [
186+
"/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b"
187+
],
188+
"reason": "Duplicate",
189+
"value": "Azure.Storage.BlobPublicAccess"
190+
},
191+
{
192+
"policyDefinitionIds": [
193+
"/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9",
194+
"/providers/Microsoft.Authorization/policyDefinitions/f81e3117-0093-4b17-8a60-82363134f0eb"
195+
],
196+
"reason": "Duplicate",
197+
"value": "Azure.Storage.SecureTransfer"
198+
},
199+
{
200+
"policyDefinitionIds": [
201+
"/providers/Microsoft.Authorization/policyDefinitions/fe83a0eb-a853-422d-aac2-1bffd182c5d0"
202+
],
203+
"reason": "Duplicate",
204+
"value": "Azure.Storage.MinTLS"
169205
}
170206
]

‎docs/CHANGELOG-v1.md

+7
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,16 @@ What's changed since pre-release v1.34.0-B0047:
4848
- Renamed `Azure.Storage.DefenderCloud.SensitiveData` to `Azure.Storage.Defender.DataScan`.
4949
- Promoted `Azure.Storage.Defender.MalwareScan` to GA rule set by @BernieWhite.
5050
[#2590](https://github.com/Azure/PSRule.Rules.Azure/pull/2590)
51+
- General improvements:
52+
- Added duplicate policies to default ignore list by @BernieWhite.
53+
[#1731](https://github.com/Azure/PSRule.Rules.Azure/issues/1731)
5154
- Engineering:
5255
- Updated resource providers and policy aliases.
5356
[#2717](https://github.com/Azure/PSRule.Rules.Azure/pull/2717)
57+
- Bug fixes:
58+
- Fixes for policy as rules by @BernieWhite.
59+
[#181](https://github.com/Azure/PSRule.Rules.Azure/issues/181)
60+
[#1323](https://github.com/Azure/PSRule.Rules.Azure/issues/1323)
5461

5562
## v1.34.0-B0047 (pre-release)
5663

‎docs/en/rules/Azure.Cognitive.DisableLocalAuth.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,10 @@ resource account 'Microsoft.CognitiveServices/accounts@2023-05-01' = {
9595

9696
To address this issue at runtime use the following policies:
9797

98-
```text
99-
/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc
100-
/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555
101-
```
98+
- [Azure AI Services resources should have key access disabled (disable local authentication)](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Azure%20Ai%20Services/CognitiveServices_DisableLocalAuth_Audit.json)
99+
`/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc`
100+
- [Configure Cognitive Services accounts to disable local authentication methods](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cognitive%20Services/CognitiveServices_DisableLocalAuth_Modify.json)
101+
`/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555`
102102

103103
## LINKS
104104

‎docs/en/rules/Azure.ContainerApp.Insecure.md

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2023-04-29
2+
reviewed: 2024-03-04
33
severity: Important
44
pillar: Security
5-
category: Design
5+
category: SE:07 Encryption
66
resource: Container App
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.Insecure/
88
---
@@ -98,9 +98,16 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
9898
}
9999
```
100100

101+
### Configure with Azure Policy
102+
103+
To address this issue at runtime use the following policies:
104+
105+
- [Container Apps should only be accessible over HTTPS](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Apps/ContainerApps_EnableHTTPS_Audit.json)
106+
`/providers/Microsoft.Authorization/policyDefinitions/0e80e269-43a4-4ae9-b5bc-178126b8a5cb`
107+
101108
## LINKS
102109

103-
- [Data encryption in Azure](https://learn.microsoft.com/azure/architecture/framework/security/design-storage-encryption#data-in-transit)
104-
- [Ingress in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/ingress-overview#configuration)
110+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption#data-in-transit)
111+
- [Ingress in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/ingress-overview)
105112
- [Container Apps ARM template API specification](https://learn.microsoft.com/azure/container-apps/azure-resource-manager-api-spec?tabs=arm-template)
106113
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps)

‎docs/en/rules/Azure.ContainerApp.ManagedIdentity.md

+15-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
severity: Important
33
pillar: Security
4-
category: Authentication
4+
category: SE:05 Identity and access management
55
resource: Container App
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.ManagedIdentity/
77
---
@@ -16,10 +16,13 @@ Ensure managed identity is used for authentication.
1616

1717
Using managed identities have the following benefits:
1818

19-
- Your app connects to resources with the managed identity. You don't need to manage credentials in your container app.
19+
- Your app connects to resources with the managed identity.
20+
You don't need to manage credentials in your container app.
2021
- You can use role-based access control to grant specific permissions to a managed identity.
21-
- System-assigned identities are automatically created and managed. They're deleted when your container app is deleted.
22-
- You can add and delete user-assigned identities and assign them to multiple resources. They're independent of your container app's life cycle.
22+
- System-assigned identities are automatically created and managed.
23+
They're deleted when your container app is deleted.
24+
- You can add and delete user-assigned identities and assign them to multiple resources.
25+
They're independent of your container app's life cycle.
2326
- You can use managed identity to authenticate with a private Azure Container Registry without a username and password to pull containers for your Container App.
2427
- You can use managed identity to create connections for Dapr-enabled applications via Dapr components.
2528

@@ -102,13 +105,20 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
102105
}
103106
```
104107

108+
### Configure with Azure Policy
109+
110+
To address this issue at runtime use the following policies:
111+
112+
- [Managed Identity should be enabled for Container Apps](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Container%20Apps/ContainerApps_ManagedIdentity_Audit.json)
113+
`/providers/Microsoft.Authorization/policyDefinitions/b874ab2d-72dd-47f1-8cb5-4a306478a4e7`
114+
105115
## NOTES
106116

107117
Using managed identities in scale rules isn't supported.
108118
Init containers can't access managed identities.
109119

110120
## LINKS
111121

112-
- [Use identity-based authentication](https://learn.microsoft.com/azure/well-architected/security/design-identity-authentication#use-identity-based-authentication)
122+
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)
113123
- [Managed identities in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/managed-identity)
114124
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps#managedserviceidentity)

‎docs/en/rules/Azure.Storage.BlobAccessType.md

+18-16
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2022-01-20
2+
reviewed: 2024-03-04
33
severity: Important
44
pillar: Security
5-
category: Authentication
5+
category: SE:05 Identity and access management
66
resource: Storage Account
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.BlobAccessType/
88
---
@@ -40,16 +40,16 @@ For example:
4040

4141
```json
4242
{
43-
"type": "Microsoft.Storage/storageAccounts/blobServices/containers",
44-
"apiVersion": "2021-06-01",
45-
"name": "[format('{0}/{1}/{2}', parameters('name'), 'default', variables('containerName'))]",
46-
"properties": {
47-
"publicAccess": "None"
48-
},
49-
"dependsOn": [
50-
"[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]",
51-
"[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
52-
]
43+
"type": "Microsoft.Storage/storageAccounts/blobServices/containers",
44+
"apiVersion": "2021-06-01",
45+
"name": "[format('{0}/{1}/{2}', parameters('name'), 'default', variables('containerName'))]",
46+
"properties": {
47+
"publicAccess": "None"
48+
},
49+
"dependsOn": [
50+
"[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]",
51+
"[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
52+
]
5353
}
5454
```
5555

@@ -73,8 +73,10 @@ resource container 'Microsoft.Storage/storageAccounts/blobServices/containers@20
7373

7474
## LINKS
7575

76-
- [Authentication with Azure AD](https://learn.microsoft.com/azure/architecture/framework/security/design-identity-authentication)
77-
- [About anonymous public read access](https://docs.microsoft.com/azure/storage/blobs/anonymous-read-access-configure#about-anonymous-public-read-access)
78-
- [Use Azure Policy to enforce authorized access](https://docs.microsoft.com/azure/storage/blobs/anonymous-read-access-prevent#use-azure-policy-to-enforce-authorized-access)
79-
- [How a shared access signature works](https://docs.microsoft.com/azure/storage/common/storage-sas-overview#how-a-shared-access-signature-works)
76+
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)
77+
- [Use Microsoft Entra ID for storage authentication](https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#use-microsoft-entra-id-for-storage-authentication)
78+
- [Configure anonymous read access for containers and blobs](https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure)
79+
- [Remediate anonymous read access to blob data](https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-prevent)
80+
- [How a shared access signature works](https://learn.microsoft.com/azure/storage/common/storage-sas-overview#how-a-shared-access-signature-works)
81+
- [Authorize access to blobs using Microsoft Entra ID](https://learn.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory)
8082
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.storage/storageaccounts)

‎docs/en/rules/Azure.Storage.BlobPublicAccess.md

+13-6
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
severity: Important
33
pillar: Security
4-
category: Authentication
4+
category: SE:05 Identity and access management
55
resource: Storage Account
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.BlobPublicAccess/
77
---
@@ -89,11 +89,18 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
8989
}
9090
```
9191

92+
### Configure with Azure Policy
93+
94+
To address this issue at runtime use the following policies:
95+
96+
- [Configure your Storage account public access to be disallowed](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountDisablePublicBlobAccess_Modify.json)
97+
`/providers/Microsoft.Authorization/policyDefinitions/13502221-8df0-4414-9937-de9c5c4e396b`
98+
9299
## LINKS
93100

94-
- [Use Azure AD for storage authentication](https://docs.microsoft.com/azure/security/fundamentals/identity-management-best-practices#use-azure-ad-for-storage-authentication)
95-
- [Allow or disallow public read access for a storage account](https://docs.microsoft.com/azure/storage/blobs/anonymous-read-access-configure#allow-or-disallow-public-read-access-for-a-storage-account)
96-
- [Remediate anonymous public access](https://docs.microsoft.com/azure/storage/blobs/anonymous-read-access-prevent#remediate-anonymous-public-access)
97-
- [Use Azure Policy to enforce authorized access](https://docs.microsoft.com/azure/storage/blobs/anonymous-read-access-prevent#use-azure-policy-to-enforce-authorized-access)
98-
- [Authorize access to blobs using Azure Active Directory](https://docs.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory)
101+
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)
102+
- [Use Microsoft Entra ID for storage authentication](https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#use-microsoft-entra-id-for-storage-authentication)
103+
- [Configure anonymous read access for containers and blobs](https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure)
104+
- [Remediate anonymous read access to blob data](https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-prevent)
105+
- [Authorize access to blobs using Microsoft Entra ID](https://learn.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory)
99106
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.storage/storageaccounts)

‎docs/en/rules/Azure.Storage.MinTLS.md

+10-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2+
reviewed: 2024-03-04
23
severity: Critical
34
pillar: Security
4-
category: Encryption
5+
category: SE:07 Encryption
56
resource: Storage Account
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.MinTLS/
78
---
@@ -87,9 +88,16 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
8788
}
8889
```
8990

91+
### Configure with Azure Policy
92+
93+
To address this issue at runtime use the following policies:
94+
95+
- [Storage accounts should have the specified minimum TLS version](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountMinimumTLSVersion_Audit.json)
96+
`/providers/Microsoft.Authorization/policyDefinitions/fe83a0eb-a853-422d-aac2-1bffd182c5d0`
97+
9098
## LINKS
9199

92-
- [Data encryption in Azure](https://learn.microsoft.com/azure/architecture/framework/security/design-storage-encryption#data-in-transit)
100+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption#data-in-transit)
93101
- [TLS encryption in Azure](https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#tls-encryption-in-azure)
94102
- [Enforce a minimum required version of Transport Layer Security (TLS) for requests to a storage account](https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version)
95103
- [DP-3: Encrypt sensitive data in transit](https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline#dp-3-encrypt-sensitive-data-in-transit)

‎docs/en/rules/Azure.Storage.SecureTransfer.md

+12-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2023-09-02
2+
reviewed: 2024-03-04
33
severity: Important
44
pillar: Security
5-
category: Encryption
5+
category: SE:07 Encryption
66
resource: Storage Account
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.SecureTransfer/
88
ms-content-id: 539cb7b9-5510-4aa3-b422-41a049a10a88
@@ -101,9 +101,18 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
101101
}
102102
```
103103

104+
### Configure with Azure Policy
105+
106+
To address this issue at runtime use the following policies:
107+
108+
- [Secure transfer to storage accounts should be enabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/Storage_AuditForHTTPSEnabled_Audit.json)
109+
`/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9`
110+
- [Configure secure transfer of data on a storage account](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountSecureTransfer_Modify.json)
111+
`/providers/Microsoft.Authorization/policyDefinitions/f81e3117-0093-4b17-8a60-82363134f0eb`
112+
104113
## LINKS
105114

106-
- [Data encryption in Azure](https://learn.microsoft.com/azure/architecture/framework/security/design-storage-encryption#data-in-transit)
115+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption#data-in-transit)
107116
- [Require secure transfer in Azure Storage](https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer)
108117
- [DP-3: Encrypt sensitive data in transit](https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline#dp-3-encrypt-sensitive-data-in-transit)
109118
- [Sample policy for ensuring https traffic](https://learn.microsoft.com/azure/governance/policy/samples/built-in-policies#storage)

0 commit comments

Comments
 (0)