Skip to content
This repository was archived by the owner on May 24, 2022. It is now read-only.

Commit da2b936

Browse files
matt-FFFFFFSystem
matt-FFFFFF
and
System
authored
Updated from upstream (#10)
Co-authored-by: System <noreply@azure.com>
1 parent 83c3157 commit da2b936

5 files changed

+159
-12
lines changed

‎policydefinition-deny_aa_child_resources.tf

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# This file was auto generated
2+
resource "azurerm_policy_definition" "deny_aa_child_resources" {
3+
name = "Deny-AA-child-resources"
4+
policy_type = "Custom"
5+
mode = "All"
6+
display_name = "Deny-AA-child-resources"
7+
description = "Denies creation of child resources on the Automation Account"
8+
9+
management_group_name = var.management_group_name
10+
policy_rule = <<POLICYRULE
11+
{
12+
"if": {
13+
"allOf": [
14+
{
15+
"field": "type",
16+
"in": [
17+
"Microsoft.Automation/automationAccounts/runbooks",
18+
"Microsoft.Automation/automationAccounts/variables",
19+
"Microsoft.Automation/automationAccounts/modules",
20+
"Microsoft.Automation/automationAccounts/credentials",
21+
"Microsoft.Automation/automationAccounts/connections",
22+
"Microsoft.Automation/automationAccount/certificates"
23+
]
24+
}
25+
]
26+
},
27+
"then": {
28+
"effect": "deny"
29+
}
30+
}
31+
POLICYRULE
32+
33+
34+
}
35+
36+
output "policydefinition_deny_aa_child_resources" {
37+
value = azurerm_policy_definition.deny_aa_child_resources
38+
}
39+

‎policydefinition-deny_subnet_without_udr.tf

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# This file was auto generated
2+
resource "azurerm_policy_definition" "deny_subnet_without_udr" {
3+
name = "Deny-Subnet-Without-UDR"
4+
policy_type = "Custom"
5+
mode = "All"
6+
display_name = "Deny-Subnets-Without-UDR"
7+
description = "null"
8+
9+
management_group_name = var.management_group_name
10+
policy_rule = <<POLICYRULE
11+
{
12+
"if": {
13+
"allOf": [
14+
{
15+
"field": "type",
16+
"equals": "Microsoft.Network/virtualNetworks/subnets"
17+
},
18+
{
19+
"field": "Microsoft.Network/virtualNetworks/subnets/routeTable.id",
20+
"exists": "false"
21+
}
22+
]
23+
},
24+
"then": {
25+
"effect": "deny"
26+
}
27+
}
28+
POLICYRULE
29+
30+
31+
}
32+
33+
output "policydefinition_deny_subnet_without_udr" {
34+
value = azurerm_policy_definition.deny_subnet_without_udr
35+
}
36+

‎policydefinition-deploy_diagnostics_recoveryvault.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ resource "azurerm_policy_definition" "deploy_diagnostics_recoveryvault" {
4747
},
4848
{
4949
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",
50-
"notEquals": "[parameters('logAnalytics')]"
50+
"equals": "[parameters('logAnalytics')]"
5151
},
5252
{
5353
"field": "Microsoft.Insights/diagnosticSettings/logAnalyticsDestinationType",

‎policydefinition-deploy_log_analytics.tf

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ resource "azurerm_policy_definition" "deploy_log_analytics" {
4242
"rgName": {
4343
"value": "[parameters('rgName')]"
4444
},
45+
"retentionInDays": {
46+
"value": "[parameters('retentionInDays')]"
47+
},
4548
"workspaceName": {
4649
"value": "[parameters('workspaceName')]"
4750
},
@@ -73,6 +76,9 @@ resource "azurerm_policy_definition" "deploy_log_analytics" {
7376
},
7477
"automationRegion": {
7578
"type": "string"
79+
},
80+
"retentionInDays": {
81+
"type": "string"
7682
}
7783
},
7884
"variables": {},
@@ -121,7 +127,8 @@ resource "azurerm_policy_definition" "deploy_log_analytics" {
121127
"sku": {
122128
"name": "pernode"
123129
},
124-
"enableLogAccessUsingOnlyResourcePermissions": true
130+
"enableLogAccessUsingOnlyResourcePermissions": true,
131+
"retentionInDays": "[int(parameters('retentionInDays'))]"
125132
},
126133
"resources": [
127134
{
@@ -183,6 +190,14 @@ POLICYRULE
183190
"description": "Select Azure region for Automation account"
184191
}
185192
},
193+
"retentionInDays": {
194+
"type": "String",
195+
"metadata": {
196+
"displayName": "Data retention",
197+
"description": "Select data retention (days) for Log Analytics."
198+
},
199+
"defaultValue": "30"
200+
},
186201
"rgName": {
187202
"type": "String",
188203
"metadata": {

‎policydefinition-deploy_nsg_flowlogs.tf

Lines changed: 67 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ resource "azurerm_policy_definition" "deploy_nsg_flowlogs" {
44
policy_type = "Custom"
55
mode = "All"
66
display_name = "Deploy-Nsg-FlowLogs"
7-
description = "null"
7+
description = "Deploys NSG flow logs and traffic analytics"
88

99
management_group_name = var.management_group_name
1010
policy_rule = <<POLICYRULE
@@ -20,11 +20,18 @@ resource "azurerm_policy_definition" "deploy_nsg_flowlogs" {
2020
"roleDefinitionIds": [
2121
"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
2222
],
23-
"name": "[concat('NetworkWatcher_', field('location'), '/', 'Microsoft.Network', resourceGroup().name, field('name'))]",
2423
"resourceGroupName": "NetworkWatcherRG",
2524
"existenceCondition": {
26-
"field": "Microsoft.Network/networkWatchers/flowLogs/enabled",
27-
"equals": "true"
25+
"allOf": [
26+
{
27+
"field": "Microsoft.Network/networkWatchers/flowLogs/enabled",
28+
"equals": "true"
29+
},
30+
{
31+
"field": "Microsoft.Network/networkWatchers/flowLogs/flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled",
32+
"equals": "[parameters('flowAnalyticsEnabled')]"
33+
}
34+
]
2835
},
2936
"deployment": {
3037
"properties": {
@@ -44,6 +51,15 @@ resource "azurerm_policy_definition" "deploy_nsg_flowlogs" {
4451
},
4552
"retention": {
4653
"value": "[parameters('retention')]"
54+
},
55+
"flowAnalyticsEnabled": {
56+
"value": "[parameters('flowAnalyticsEnabled')]"
57+
},
58+
"trafficAnalyticsInterval": {
59+
"value": "[parameters('trafficAnalyticsInterval')]"
60+
},
61+
"logAnalytics": {
62+
"value": "[parameters('logAnalytics')]"
4763
}
4864
},
4965
"template": {
@@ -63,16 +79,24 @@ resource "azurerm_policy_definition" "deploy_nsg_flowlogs" {
6379
"type": "string"
6480
},
6581
"retention": {
66-
"type": "int",
67-
"defaultValue": 5
82+
"type": "int"
83+
},
84+
"flowAnalyticsEnabled": {
85+
"type": "bool"
86+
},
87+
"trafficAnalyticsInterval": {
88+
"type": "int"
89+
},
90+
"logAnalytics": {
91+
"type": "string"
6892
}
6993
},
7094
"variables": {},
7195
"resources": [
7296
{
7397
"type": "Microsoft.Network/networkWatchers/flowLogs",
74-
"apiVersion": "2019-11-01",
75-
"name": "[concat('NetworkWatcher_', toLower(parameters('location')), '/', 'flowLogs')]",
98+
"apiVersion": "2020-05-01",
99+
"name": "[take(concat('NetworkWatcher_', toLower(parameters('location')), '/', parameters('networkSecurityGroupName'), '-', parameters('resourceGroupName'), '-flowlog' ), 80)]",
76100
"location": "[parameters('location')]",
77101
"properties": {
78102
"targetResourceId": "[resourceId(parameters('resourceGroupName'), 'Microsoft.Network/networkSecurityGroups', parameters('networkSecurityGroupName'))]",
@@ -85,6 +109,15 @@ resource "azurerm_policy_definition" "deploy_nsg_flowlogs" {
85109
"format": {
86110
"type": "JSON",
87111
"version": 2
112+
},
113+
"flowAnalyticsConfiguration": {
114+
"networkWatcherFlowAnalyticsConfiguration": {
115+
"enabled": "[bool(parameters('flowAnalyticsEnabled'))]",
116+
"trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
117+
"workspaceId": "[if(not(empty(parameters('logAnalytics'))), reference(parameters('logAnalytics'), '2020-03-01-preview', 'Full').properties.customerId, json('null')) ]",
118+
"workspaceRegion": "[if(not(empty(parameters('logAnalytics'))), reference(parameters('logAnalytics'), '2020-03-01-preview', 'Full').location, json('null')) ]",
119+
"workspaceResourceId": "[if(not(empty(parameters('logAnalytics'))), parameters('logAnalytics'), json('null'))]"
120+
}
88121
}
89122
}
90123
}
@@ -104,13 +137,37 @@ POLICYRULE
104137
"type": "Integer",
105138
"metadata": {
106139
"displayName": "Retention"
107-
}
140+
},
141+
"defaultValue": 5
108142
},
109143
"storageAccountResourceId": {
110144
"type": "String",
111145
"metadata": {
112-
"displayName": "Storage Account Resource Id"
146+
"displayName": "Storage Account Resource Id",
147+
"strongType": "Microsoft.Storage/storageAccounts"
113148
}
149+
},
150+
"trafficAnalyticsInterval": {
151+
"type": "Integer",
152+
"metadata": {
153+
"displayName": "Traffic Analytics processing interval mins (10/60)"
154+
},
155+
"defaultValue": 60
156+
},
157+
"flowAnalyticsEnabled": {
158+
"type": "Boolean",
159+
"metadata": {
160+
"displayName": "Enable Traffic Analytics"
161+
},
162+
"defaultValue": false
163+
},
164+
"logAnalytics": {
165+
"type": "String",
166+
"metadata": {
167+
"strongType": "omsWorkspace",
168+
"displayName": "Resource ID of Log Analytics workspace"
169+
},
170+
"defaultValue": ""
114171
}
115172
}
116173
PARAMETERS

0 commit comments

Comments
 (0)