Skip to content

Commit 499c991

Browse files
BernieWhiteBernieWhite
authored
Rule doc quality updates Azure#2570 Azure#1731 (Azure#2823)
1 parent 44296e7 commit 499c991

19 files changed

+123
-56
lines changed

‎.vscode/markdown.code-snippets

+9-21
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
},
6666
"rule-azure-example-arm": {
6767
"scope": "markdown",
68-
"prefix": "rule-azure-example-arm",
68+
"prefix": "example-arm",
6969
"description": "Example for Azure template",
7070
"body": [
7171
"### Configure with Azure template",
@@ -83,7 +83,7 @@
8383
},
8484
"rule-azure-example-cli": {
8585
"scope": "markdown",
86-
"prefix": "rule-azure-example-cli",
86+
"prefix": "example-cli",
8787
"description": "Example for Azure CLI",
8888
"body": [
8989
"### Configure with Azure CLI",
@@ -95,7 +95,7 @@
9595
},
9696
"rule-azure-example-pwsh": {
9797
"scope": "markdown",
98-
"prefix": "rule-azure-example-pwsh",
98+
"prefix": "example-pwsh",
9999
"description": "Example for Azure PowerShell",
100100
"body": [
101101
"### Configure with Azure PowerShell",
@@ -107,7 +107,7 @@
107107
},
108108
"rule-azure-example-bicep": {
109109
"scope": "markdown",
110-
"prefix": "rule-azure-example-bicep",
110+
"prefix": "example-bicep",
111111
"description": "Example for Bicep",
112112
"body": [
113113
"### Configure with Bicep",
@@ -123,27 +123,15 @@
123123
"```"
124124
]
125125
},
126-
"rule-azure-example-bicep-br": {
126+
"rule-azure-example-bicep-avm": {
127127
"scope": "markdown",
128-
"prefix": "rule-azure-example-bicep-br",
129-
"description": "Example for Bicep Public Registry",
130-
"body": [
131-
"### Configure with Bicep Public Registry",
132-
"",
133-
"To deploy ${1:resource} that pass this rule:",
134-
"",
135-
"- ${2:steps}",
136-
"",
137-
"For example:",
138-
"",
139-
"```bicep",
140-
"",
141-
"```"
142-
]
128+
"prefix": "example-avm",
129+
"description": "Link to AVM example for Bicep",
130+
"body": "<!-- external:avm ${1:module} ${2:property} -->"
143131
},
144132
"rule-azure-example-policy": {
145133
"scope": "markdown",
146-
"prefix": "rule-azure-example-policy",
134+
"prefix": "example-policy",
147135
"description": "Example for Azure Policy",
148136
"body": [
149137
"### Configure with Azure Policy",

‎data/policy-ignore.json

+15
Original file line numberDiff line numberDiff line change
@@ -244,5 +244,20 @@
244244
],
245245
"reason": "Duplicate",
246246
"value": "Azure.AppService.PHPVersion"
247+
},
248+
{
249+
"policyDefinitionIds": [
250+
"/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf"
251+
],
252+
"reason": "Duplicate",
253+
"value": "Azure.SQL.MinTLS"
254+
},
255+
{
256+
"policyDefinitionIds": [
257+
"/providers/Microsoft.Authorization/policyDefinitions/a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9",
258+
"/providers/Microsoft.Authorization/policyDefinitions/f4c68484-132f-41f9-9b6d-3e4b1cb55036"
259+
],
260+
"reason": "Duplicate",
261+
"value": "Azure.SQL.Auditing"
247262
}
248263
]

‎docs/CHANGELOG-v1.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,11 @@ What's changed since v1.35.3:
4444
- Check that database accounts only accept a minimum of TLS 1.2 by @BernieWhite.
4545
[#2809](https://github.com/Azure/PSRule.Rules.Azure/issues/2809)
4646
- General improvements:
47-
- Quality updates to documentation by @lukemurraynz.
47+
- Quality updates to documentation by @lukemurraynz @BernieWhite.
4848
[#2789](https://github.com/Azure/PSRule.Rules.Azure/pull/2789)
49+
[#2570](https://github.com/Azure/PSRule.Rules.Azure/issues/2570)
50+
- Additional policies added to default ignore list by @BernieWhite.
51+
[#1731](https://github.com/Azure/PSRule.Rules.Azure/issues/1731)
4952
- Bug fixes:
5053
- Fixed not found warning when exporting firewall policy `signatureOverrides` by @BernieWhite.
5154
[#2806](https://github.com/Azure/PSRule.Rules.Azure/issues/2806)

‎docs/en/rules/Azure.ContainerApp.AvailabilityZone.md

+2
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,8 @@ resource containerEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
9999
}
100100
```
101101

102+
<!-- external:avm avm/res/app/managed-environment zoneRedundant -->
103+
102104
## LINKS
103105

104106
- [RE:05 Regions and availability zones](https://learn.microsoft.com/azure/well-architected/reliability/regions-availability-zones)

‎docs/en/rules/Azure.ContainerApp.ExternalIngress.md

+2
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,8 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
111111
}
112112
```
113113

114+
<!-- external:avm avm/res/app/container-app ingressExternal -->
115+
114116
## NOTES
115117

116118
This rule is skipped by default because there are common cases where external ingress is required.

‎docs/en/rules/Azure.ContainerApp.Insecure.md

+2
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
104104
}
105105
```
106106

107+
<!-- external:avm avm/res/app/container-app ingressAllowInsecure -->
108+
107109
### Configure with Azure Policy
108110

109111
To address this issue at runtime use the following policies:

‎docs/en/rules/Azure.ContainerApp.ManagedIdentity.md

+2
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,8 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
111111
}
112112
```
113113

114+
<!-- external:avm avm/res/app/container-app managedIdentities -->
115+
114116
### Configure with Azure Policy
115117

116118
To address this issue at runtime use the following policies:

‎docs/en/rules/Azure.EventHub.DisableLocalAuth.md

+2
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ resource ns 'Microsoft.EventHub/namespaces@2024-01-01' = {
8989
}
9090
```
9191

92+
<!-- external:avm avm/res/event-hub/namespace disableLocalAuth -->
93+
9294
### Configure with Azure Policy
9395

9496
To address this issue at runtime use the following policies:

‎docs/en/rules/Azure.EventHub.MinTLS.md

+7-1
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,12 @@ Older TLS versions are no longer considered secure by industry standards, such a
2121
Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2.
2222
By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.
2323

24+
When clients connect using an older version of TLS that is disabled, the connection will fail.
25+
2426
## RECOMMENDATION
2527

2628
Configure the minimum supported TLS version to be 1.2.
29+
Also consider enforcing this setting using Azure Policy.
2730

2831
## EXAMPLES
2932

@@ -87,9 +90,12 @@ resource ns 'Microsoft.EventHub/namespaces@2024-01-01' = {
8790
}
8891
```
8992

93+
<!-- external:avm avm/res/event-hub/namespace minimumTlsVersion -->
94+
9095
## LINKS
9196

92-
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption)
97+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption#data-in-transit)
98+
- [DP-3: Encrypt sensitive data in transit](https://learn.microsoft.com/security/benchmark/azure/baselines/event-hubs-security-baseline#dp-3-encrypt-sensitive-data-in-transit)
9399
- [Enforce a minimum required version of Transport Layer Security (TLS) for requests to an Event Hubs namespace](https://learn.microsoft.com/azure/event-hubs/transport-layer-security-enforce-minimum-version)
94100
- [Preparing for TLS 1.2 in Microsoft Azure](https://azure.microsoft.com/updates/azuretls12/)
95101
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.eventhub/namespaces)

‎docs/en/rules/Azure.SQL.Auditing.md

+26-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2+
reviewed: 2024-04-15
23
severity: Important
34
pillar: Security
4-
category: Security operations
5+
category: SE:10 Monitoring and threat detection
56
resource: SQL Database
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.Auditing/
78
ms-content-id: d6084913-9ff9-40b6-a65b-30fcd4d49251
@@ -16,11 +17,22 @@ Enable auditing for Azure SQL logical server.
1617
## DESCRIPTION
1718

1819
Auditing for Azure SQL Database tracks database events and writes them to an audit log.
19-
Audit logs help you find suspicious events, unusual activity, and trends.
20+
Data collected from auditing can be used to help find suspicious events, unusual activity, and trends.
21+
22+
When managing security events at scale, it is important to have a centralized location to store and analyze security data.
23+
A security information and event management (SIEM) system to consolidate security data in a central location.
24+
Once the security data is in a central location it can be correlated across various services.
25+
Security orchestration, automation, and response (SOAR) tools can be used to automate responses to security events.
26+
27+
Microsoft Sentinel is a scalable, cloud-native solution that provides:
28+
29+
- Security information and event management (SIEM).
30+
- Security orchestration, automation, and response (SOAR).
2031

2132
## RECOMMENDATION
2233

2334
Consider enabling auditing for each SQL Database logical server and review reports on a regular basis.
35+
Also consider enforcing this setting using Azure Policy.
2436

2537
## EXAMPLES
2638

@@ -113,7 +125,19 @@ az sql server audit-policy update -g '<resource_group>' -n '<server_name>' --sta
113125
Set-AzSqlServerAudit -ResourceGroupName '<resource_group>' -ServerName '<server_name>' -BlobStorageTargetState Enabled -StorageAccountResourceId '<storage_resource_id>'
114126
```
115127

128+
### Configure with Azure Policy
129+
130+
To address this issue at runtime use the following policies:
131+
132+
- [Auditing on SQL server should be enabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_Audit.json)
133+
`/providers/Microsoft.Authorization/policyDefinitions/a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9`
134+
- [Configure SQL servers to have auditing enabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServerAuditing_DINE.json)
135+
`/providers/Microsoft.Authorization/policyDefinitions/f4c68484-132f-41f9-9b6d-3e4b1cb55036`
136+
116137
## LINKS
117138

139+
- [SE:10 Monitoring and threat detection](https://learn.microsoft.com/azure/well-architected/security/monitor-threats)
140+
- [LT-3: Enable logging for security investigation](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-sql-security-baseline#logging-and-threat-detection)
118141
- [Auditing for Azure SQL Database and Azure Synapse Analytics](https://learn.microsoft.com/azure/azure-sql/database/auditing-overview)
142+
- [What is Microsoft Sentinel?](https://learn.microsoft.com/azure/sentinel/overview)
119143
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.sql/servers/auditingsettings)

‎docs/en/rules/Azure.SQL.MinTLS.md

+16-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2+
reviewed: 2024-04-15
23
severity: Critical
34
pillar: Security
4-
category: Encryption
5+
category: SE:07 Encryption
56
resource: SQL Database
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.MinTLS/
78
---
@@ -20,9 +21,12 @@ Older TLS versions are no longer considered secure by industry standards, such a
2021
Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2.
2122
By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.
2223

24+
When clients connect using an older version of TLS that is disabled, the connection will fail.
25+
2326
## RECOMMENDATION
2427

2528
Consider configuring the minimum supported TLS version to be 1.2.
29+
Also consider enforcing this setting using Azure Policy.
2630

2731
## EXAMPLES
2832

@@ -85,9 +89,19 @@ resource server 'Microsoft.Sql/servers@2022-11-01-preview' = {
8589
}
8690
```
8791

92+
<!-- external:avm avm/res/sql/server minimalTlsVersion -->
93+
94+
### Configure with Azure Policy
95+
96+
To address this issue at runtime use the following policies:
97+
98+
- [Azure SQL Database should be running TLS version 1.2 or newer](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/SQL/SqlServer_MiniumTLSVersion_Audit.json)
99+
`/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf`
100+
88101
## LINKS
89102

90-
- [Data encryption in Azure](https://learn.microsoft.com/azure/architecture/framework/security/design-storage-encryption#data-in-transit)
103+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption#data-in-transit)
104+
- [DP-3: Encrypt sensitive data in transit](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-sql-security-baseline#dp-3-encrypt-sensitive-data-in-transit)
91105
- [Minimal TLS Version](https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version)
92106
- [Preparing for TLS 1.2 in Microsoft Azure](https://azure.microsoft.com/updates/azuretls12/)
93107
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.sql/servers#serverproperties)

‎docs/en/rules/Azure.ServiceBus.DisableLocalAuth.md

+2
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@ resource ns 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' = {
8181
}
8282
```
8383

84+
<!-- external:avm avm/res/service-bus/namespace disableLocalAuth -->
85+
8486
### Configure with Azure Policy
8587

8688
To address this issue at runtime use the following policies:

‎docs/en/rules/Azure.ServiceBus.MinTLS.md

+3-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ When clients connect using an older version of TLS that is disabled, the connect
2828
## RECOMMENDATION
2929

3030
Consider configuring the minimum supported TLS version for Service Bus clients to be 1.2.
31-
Support for TLS 1.0/ 1.1 version will be removed.
31+
Also consider enforcing this setting using Azure Policy.
3232

3333
## EXAMPLES
3434

@@ -84,6 +84,8 @@ resource ns 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' = {
8484
}
8585
```
8686

87+
<!-- external:avm avm/res/service-bus/namespace minimumTlsVersion -->
88+
8789
### Configure with Azure CLI
8890

8991
```bash

‎docs/en/rules/Azure.Storage.MinTLS.md

+2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ Older TLS versions are no longer considered secure by industry standards, such a
2121
Storage Accounts lets you disable outdated protocols and enforce TLS 1.2.
2222
By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.
2323

24+
When clients connect using an older version of TLS that is disabled, the connection will fail.
25+
2426
## RECOMMENDATION
2527

2628
Consider configuring the minimum supported TLS version to be 1.2.

‎docs/examples-sql.bicep

+4-4
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ param adminLogin string
1313
param adminPrincipalId string
1414

1515
// An example Azure SQL Database logical server.
16-
resource server 'Microsoft.Sql/servers@2022-11-01-preview' = {
16+
resource server 'Microsoft.Sql/servers@2023-08-01-preview' = {
1717
name: name
1818
location: location
1919
identity: {
@@ -34,7 +34,7 @@ resource server 'Microsoft.Sql/servers@2022-11-01-preview' = {
3434
}
3535

3636
// An example administrator configuration for an Azure SQL Database logical server.
37-
resource sqlAdministrator 'Microsoft.Sql/servers/administrators@2022-02-01-preview' = {
37+
resource sqlAdministrator 'Microsoft.Sql/servers/administrators@2023-08-01-preview' = {
3838
parent: server
3939
name: 'ActiveDirectory'
4040
properties: {
@@ -45,7 +45,7 @@ resource sqlAdministrator 'Microsoft.Sql/servers/administrators@2022-02-01-previ
4545
}
4646

4747
// An example configuration to enable SQL Advanced Threat Protection for an Azure SQL Database logical server.
48-
resource defenderSql 'Microsoft.Sql/servers/securityAlertPolicies@2022-11-01-preview' = {
48+
resource defenderSql 'Microsoft.Sql/servers/securityAlertPolicies@2023-08-01-preview' = {
4949
name: 'default'
5050
parent: server
5151
properties: {
@@ -54,7 +54,7 @@ resource defenderSql 'Microsoft.Sql/servers/securityAlertPolicies@2022-11-01-pre
5454
}
5555

5656
// An example configuration to enable Azure SQL auditing for an Azure SQL Database logical server.
57-
resource sqlAuditSettings 'Microsoft.Sql/servers/auditingSettings@2022-08-01-preview' = {
57+
resource sqlAuditSettings 'Microsoft.Sql/servers/auditingSettings@2023-08-01-preview' = {
5858
name: 'default'
5959
parent: server
6060
properties: {

0 commit comments

Comments
 (0)