Skip to content

Commit de51696

Browse files
BernieWhiteBernieWhite
authored
Added pillar specific baselines Azure#1633 (Azure#2749)
1 parent 1078621 commit de51696

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+765
-68
lines changed

‎BaselineToc.Doc.ps1

+6-2
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ Document 'baseline' -If { $PSDocs.TargetObject.Name -ne 'Azure.MCSB.v1' } {
1414

1515
Title $baselineName;
1616

17+
Metadata $PSDocs.TargetObject.metadata.annotations
18+
1719
if ($obsolete) {
1820
'<!-- OBSOLETE -->'
1921
}
@@ -26,7 +28,7 @@ Document 'baseline' -If { $PSDocs.TargetObject.Name -ne 'Azure.MCSB.v1' } {
2628
Write-Verbose -Message "[Baseline] -- Found $ruleCount rules.";
2729

2830
Section 'Rules' -If { $ruleCount -gt 0 } {
29-
"The following rules are included within ``$baselineName``. This baseline includes a total of $ruleCount rules.";
31+
"The following rules are included within the ``$baselineName`` baseline. This baseline includes a total of $ruleCount rules.";
3032
$rules | Table -Property @{ Name = 'Name'; Expression = {
3133
"[$($_.Name)](../rules/$($_.Name).md)"
3234
}}, Synopsis, @{ Name = 'Severity'; Expression = {
@@ -46,6 +48,8 @@ Document 'Azure.MCSB.Baseline' -If { $PSDocs.TargetObject.Name -eq 'Azure.MCSB.v
4648

4749
Title $baselineName;
4850

51+
Metadata $PSDocs.TargetObject.metadata.annotations
52+
4953
if ($experimental) {
5054
'<!-- EXPERIMENTAL -->'
5155
}
@@ -62,7 +66,7 @@ Document 'Azure.MCSB.Baseline' -If { $PSDocs.TargetObject.Name -eq 'Azure.MCSB.v
6266
Write-Verbose -Message "[Baseline] -- Found $ruleCount rules.";
6367

6468
Section 'Controls' -If { $ruleCount -gt 0 } {
65-
"The following rules are included within ``$baselineName``. This baseline includes a total of $ruleCount rules.";
69+
"The following rules are included within the ``$baselineName`` baseline. This baseline includes a total of $ruleCount rules.";
6670
$rules | Table -Property @{ Name = 'Name'; Expression = {
6771
"[$($_.Name)](../rules/$($_.Name).md)"
6872
}}, Synopsis, @{ Name = 'Severity'; Expression = {

‎docs/CHANGELOG-v1.md

+10
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,16 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3434

3535
What's changed since v1.34.2:
3636

37+
- New features:
38+
- Added WAF pillar specific baselines by @BernieWhite.
39+
[#1633](https://github.com/Azure/PSRule.Rules.Azure/issues/1633)
40+
- Use pillar specific baselines to target a specific area of the Azure Well-Architected Framework.
41+
- The following baselines have been added:
42+
- `Azure.Pillar.CostOptimization`
43+
- `Azure.Pillar.OperationalExcellence`
44+
- `Azure.Pillar.PerformanceEfficiency`
45+
- `Azure.Pillar.Reliability`
46+
- `Azure.Pillar.Security`
3747
- General improvements:
3848
- Documentation improvements by @BernieWhite.
3949
[#2570](https://github.com/Azure/PSRule.Rules.Azure/issues/2570)

‎docs/en/baselines/Azure.All.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Includes all Azure rules.
44

55
## Rules
66

7-
The following rules are included within `Azure.All`. This baseline includes a total of 411 rules.
7+
The following rules are included within the `Azure.All` baseline. This baseline includes a total of 411 rules.
88

99
Name | Synopsis | Severity
1010
---- | -------- | --------
@@ -259,7 +259,7 @@ Name | Synopsis | Severity
259259
[Azure.Policy.Descriptors](../rules/Azure.Policy.Descriptors.md) | Policy and initiative definitions should use a display name, description, and category. | Awareness
260260
[Azure.Policy.ExemptionDescriptors](../rules/Azure.Policy.ExemptionDescriptors.md) | Policy exemptions should use a display name and description. | Awareness
261261
[Azure.Policy.WaiverExpiry](../rules/Azure.Policy.WaiverExpiry.md) | Configure policy waiver exemptions to expire. | Awareness
262-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
262+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
263263
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
264264
[Azure.PostgreSQL.AllowAzureAccess](../rules/Azure.PostgreSQL.AllowAzureAccess.md) | Determine if access from Azure services is required. | Important
265265
[Azure.PostgreSQL.DefenderCloud](../rules/Azure.PostgreSQL.DefenderCloud.md) | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important

‎docs/en/baselines/Azure.Default.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Default baseline for Azure rules.
44

55
## Rules
66

7-
The following rules are included within `Azure.Default`. This baseline includes a total of 402 rules.
7+
The following rules are included within the `Azure.Default` baseline. This baseline includes a total of 402 rules.
88

99
Name | Synopsis | Severity
1010
---- | -------- | --------
@@ -252,7 +252,7 @@ Name | Synopsis | Severity
252252
[Azure.Policy.Descriptors](../rules/Azure.Policy.Descriptors.md) | Policy and initiative definitions should use a display name, description, and category. | Awareness
253253
[Azure.Policy.ExemptionDescriptors](../rules/Azure.Policy.ExemptionDescriptors.md) | Policy exemptions should use a display name and description. | Awareness
254254
[Azure.Policy.WaiverExpiry](../rules/Azure.Policy.WaiverExpiry.md) | Configure policy waiver exemptions to expire. | Awareness
255-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
255+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
256256
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
257257
[Azure.PostgreSQL.AllowAzureAccess](../rules/Azure.PostgreSQL.AllowAzureAccess.md) | Determine if access from Azure services is required. | Important
258258
[Azure.PostgreSQL.DefenderCloud](../rules/Azure.PostgreSQL.DefenderCloud.md) | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important

‎docs/en/baselines/Azure.GA_2020_06.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2020_06
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released June 2020 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2020_06`. This baseline includes a total of 136 rules.
13+
The following rules are included within the `Azure.GA_2020_06` baseline. This baseline includes a total of 136 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2020_09.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2020_09
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released September 2020 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2020_09`. This baseline includes a total of 152 rules.
13+
The following rules are included within the `Azure.GA_2020_09` baseline. This baseline includes a total of 152 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2020_12.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2020_12
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released December 2020 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2020_12`. This baseline includes a total of 176 rules.
13+
The following rules are included within the `Azure.GA_2020_12` baseline. This baseline includes a total of 176 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2021_03.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2021_03
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released March 2021 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2021_03`. This baseline includes a total of 191 rules.
13+
The following rules are included within the `Azure.GA_2021_03` baseline. This baseline includes a total of 191 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2021_06.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2021_06
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released June 2021 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2021_06`. This baseline includes a total of 205 rules.
13+
The following rules are included within the `Azure.GA_2021_06` baseline. This baseline includes a total of 205 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2021_09.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2021_09
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released September 2021 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2021_09`. This baseline includes a total of 224 rules.
13+
The following rules are included within the `Azure.GA_2021_09` baseline. This baseline includes a total of 224 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2021_12.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2021_12
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released December 2021 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2021_12`. This baseline includes a total of 250 rules.
13+
The following rules are included within the `Azure.GA_2021_12` baseline. This baseline includes a total of 250 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2022_03.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2022_03
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released March 2022 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2022_03`. This baseline includes a total of 266 rules.
13+
The following rules are included within the `Azure.GA_2022_03` baseline. This baseline includes a total of 266 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2022_06.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2022_06
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released June 2022 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2022_06`. This baseline includes a total of 270 rules.
13+
The following rules are included within the `Azure.GA_2022_06` baseline. This baseline includes a total of 270 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2022_09.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2022_09
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released September 2022 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2022_09`. This baseline includes a total of 301 rules.
13+
The following rules are included within the `Azure.GA_2022_09` baseline. This baseline includes a total of 301 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2022_12.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2022_12
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released December 2022 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2022_12`. This baseline includes a total of 339 rules.
13+
The following rules are included within the `Azure.GA_2022_12` baseline. This baseline includes a total of 339 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2023_03.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2023_03
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released March 2023 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2023_03`. This baseline includes a total of 359 rules.
13+
The following rules are included within the `Azure.GA_2023_03` baseline. This baseline includes a total of 359 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------

‎docs/en/baselines/Azure.GA_2023_06.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2023_06
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released June 2023 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2023_06`. This baseline includes a total of 374 rules.
13+
The following rules are included within the `Azure.GA_2023_06` baseline. This baseline includes a total of 374 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------
@@ -229,7 +233,7 @@ Name | Synopsis | Severity
229233
[Azure.Policy.Descriptors](../rules/Azure.Policy.Descriptors.md) | Policy and initiative definitions should use a display name, description, and category. | Awareness
230234
[Azure.Policy.ExemptionDescriptors](../rules/Azure.Policy.ExemptionDescriptors.md) | Policy exemptions should use a display name and description. | Awareness
231235
[Azure.Policy.WaiverExpiry](../rules/Azure.Policy.WaiverExpiry.md) | Configure policy waiver exemptions to expire. | Awareness
232-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
236+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
233237
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
234238
[Azure.PostgreSQL.AllowAzureAccess](../rules/Azure.PostgreSQL.AllowAzureAccess.md) | Determine if access from Azure services is required. | Important
235239
[Azure.PostgreSQL.DefenderCloud](../rules/Azure.PostgreSQL.DefenderCloud.md) | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important

‎docs/en/baselines/Azure.GA_2023_09.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
obsolete: true
3+
---
4+
15
# Azure.GA_2023_09
26

37
<!-- OBSOLETE -->
@@ -6,7 +10,7 @@ Include rules released September 2023 or prior for Azure GA features.
610

711
## Rules
812

9-
The following rules are included within `Azure.GA_2023_09`. This baseline includes a total of 385 rules.
13+
The following rules are included within the `Azure.GA_2023_09` baseline. This baseline includes a total of 385 rules.
1014

1115
Name | Synopsis | Severity
1216
---- | -------- | --------
@@ -238,7 +242,7 @@ Name | Synopsis | Severity
238242
[Azure.Policy.Descriptors](../rules/Azure.Policy.Descriptors.md) | Policy and initiative definitions should use a display name, description, and category. | Awareness
239243
[Azure.Policy.ExemptionDescriptors](../rules/Azure.Policy.ExemptionDescriptors.md) | Policy exemptions should use a display name and description. | Awareness
240244
[Azure.Policy.WaiverExpiry](../rules/Azure.Policy.WaiverExpiry.md) | Configure policy waiver exemptions to expire. | Awareness
241-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
245+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
242246
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
243247
[Azure.PostgreSQL.AllowAzureAccess](../rules/Azure.PostgreSQL.AllowAzureAccess.md) | Determine if access from Azure services is required. | Important
244248
[Azure.PostgreSQL.DefenderCloud](../rules/Azure.PostgreSQL.DefenderCloud.md) | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important

‎docs/en/baselines/Azure.GA_2023_12.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Include rules released December 2023 or prior for Azure GA features.
44

55
## Rules
66

7-
The following rules are included within `Azure.GA_2023_12`. This baseline includes a total of 394 rules.
7+
The following rules are included within the `Azure.GA_2023_12` baseline. This baseline includes a total of 394 rules.
88

99
Name | Synopsis | Severity
1010
---- | -------- | --------
@@ -245,7 +245,7 @@ Name | Synopsis | Severity
245245
[Azure.Policy.Descriptors](../rules/Azure.Policy.Descriptors.md) | Policy and initiative definitions should use a display name, description, and category. | Awareness
246246
[Azure.Policy.ExemptionDescriptors](../rules/Azure.Policy.ExemptionDescriptors.md) | Policy exemptions should use a display name and description. | Awareness
247247
[Azure.Policy.WaiverExpiry](../rules/Azure.Policy.WaiverExpiry.md) | Configure policy waiver exemptions to expire. | Awareness
248-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
248+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
249249
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
250250
[Azure.PostgreSQL.AllowAzureAccess](../rules/Azure.PostgreSQL.AllowAzureAccess.md) | Determine if access from Azure services is required. | Important
251251
[Azure.PostgreSQL.DefenderCloud](../rules/Azure.PostgreSQL.DefenderCloud.md) | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important

‎docs/en/baselines/Azure.MCSB.v1.md

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
---
2+
taxonomy: Azure.MCSB.v1
3+
export: true
4+
experimental: true
5+
---
6+
17
# Azure.MCSB.v1
28

39
<!-- EXPERIMENTAL -->
@@ -6,7 +12,7 @@ Microsoft Cloud Security Benchmark v1.
612

713
## Controls
814

9-
The following rules are included within `Azure.MCSB.v1`. This baseline includes a total of 131 rules.
15+
The following rules are included within the `Azure.MCSB.v1` baseline. This baseline includes a total of 131 rules.
1016

1117
Name | Synopsis | Severity
1218
---- | -------- | --------
@@ -104,7 +110,7 @@ Name | Synopsis | Severity
104110
[Azure.MySQL.MinTLS](../rules/Azure.MySQL.MinTLS.md) | MySQL DB servers should reject TLS versions older than 1.2. | Critical
105111
[Azure.MySQL.UseSSL](../rules/Azure.MySQL.UseSSL.md) | Enforce encrypted MySQL connections. | Critical
106112
[Azure.NSG.Associated](../rules/Azure.NSG.Associated.md) | Network Security Groups (NSGs) should be associated to a subnet or network interface. | Awareness
107-
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Azure Active Directory (AAD) authentication with Azure Database for PostgreSQL databases. | Critical
113+
[Azure.PostgreSQL.AAD](../rules/Azure.PostgreSQL.AAD.md) | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical
108114
[Azure.PostgreSQL.AADOnly](../rules/Azure.PostgreSQL.AADOnly.md) | Ensure Azure AD-only authentication is enabled with Azure Database for PostgreSQL databases. | Important
109115
[Azure.PostgreSQL.MinTLS](../rules/Azure.PostgreSQL.MinTLS.md) | PostgreSQL DB servers should reject TLS versions older than 1.2. | Critical
110116
[Azure.PostgreSQL.UseSSL](../rules/Azure.PostgreSQL.UseSSL.md) | Enforce encrypted PostgreSQL connections. | Critical

0 commit comments

Comments
 (0)