Skip to content

Commit 8967bd8

Browse files
oZakarioZakari
committed
Initial start to refactor of policy assignments module
1 parent 0719ef6 commit 8967bd8

11 files changed

+932
-189
lines changed

‎infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep

-173
Large diffs are not rendered by default.

‎infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json

-15
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,6 @@
1111
"parDdosEnabled": {
1212
"value": true
1313
},
14-
"parTopLevelPolicyAssignmentSovereigntyGlobal": {
15-
"value": {
16-
"parTopLevelSovereigntyGlobalPoliciesEnable": false,
17-
"parListOfAllowedLocations": [],
18-
"parPolicyEffect": "Deny"
19-
}
20-
},
2114
"parPlatformMgAlzDefaultsEnable": {
2215
"value": true
2316
},
@@ -27,14 +20,6 @@
2720
"parLandingZoneMgConfidentialEnable": {
2821
"value": false
2922
},
30-
"parPolicyAssignmentSovereigntyConfidential": {
31-
"value": {
32-
"parAllowedResourceTypes": [],
33-
"parListOfAllowedLocations": [],
34-
"parAllowedVirtualMachineSKUs": [],
35-
"parPolicyEffect": "Deny"
36-
}
37-
},
3823
"parLogAnalyticsWorkSpaceAndAutomationAccountLocation": {
3924
"value": "eastus"
4025
},

‎infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_encryption_cmk.tmpl.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"name": "Enforce-Encryption-CMK",
3+
"type": "Microsoft.Authorization/policyAssignments",
4+
"apiVersion": "2025-01-01",
5+
"properties": {
6+
"description": "This initiative assignment enables additional ALZ guardrails for Customer Managed Keys.",
7+
"displayName": "Enforce recommended guardrails for Customer Managed Keys",
8+
"notScopes": [],
9+
"parameters": {},
10+
"policyDefinitionId": "${varTopLevelManagementGroupResourceId}/providers/Microsoft.Authorization/policyDefinitions/Enforce-Encryption-CMK_20250218",
11+
"scope": null,
12+
"enforcementMode": "DoNotEnforce"
13+
},
14+
"location": null,
15+
"identity": {
16+
"type": "SystemAssigned"
17+
}
18+
}

‎infra-as-code/bicep/modules/policy/assignments/workloadSpecific/README.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Module: ALZ Specific Policy Assignments
2+
3+
This module deploys the default Azure Landing Zone Azure Policy Assignments to the Management Group Hierarchy and also assigns the relevant RBAC for the system-assigned Managed Identities created for policies that require them (e.g DeployIfNotExist & Modify effect policies).
4+
5+
Exclusion of specific ALZ default policies which does not fit your organization is supported, check out [Exclude specific policy assignments from ALZ Default Policy Assignments](https://github.com/Azure/ALZ-Bicep/wiki/AssigningPolicies#what-if-i-want-to-exclude-specific-policy-assignments-from-alz-default-policy-assignments)
6+
7+
If you wish to add your own additional Azure Policy Assignments please review [How Does ALZ-Bicep Implement Azure Policies?](https://github.com/Azure/ALZ-Bicep/wiki/PolicyDeepDive) and more specifically [Adding Custom Azure Policy Definitions](https://github.com/Azure/ALZ-Bicep/wiki/AddingPolicyDefs)
8+
9+
## Parameters
10+
11+
- [Parameters for Azure Commercial Cloud](generateddocs/alzDefaultPolicyAssignments.bicep.md)
12+
- [Parameters for Azure China Cloud](generateddocs/mc-alzDefaultPolicyAssignments.bicep.md)
13+
14+
## Outputs
15+
16+
The module does not generate any outputs.
17+
18+
## Deployment
19+
20+
> For the examples below we assume you have downloaded or cloned the Git repo as-is and are in the root of the repository as your selected directory in your terminal of choice.
21+
<!-- markdownlint-disable -->
22+
> **Important:** If you decide to not use a DDoS Network Protection plan in your environment and therefore leave the parameter `parDdosProtectionPlanId` as an empty string (`''`) then the policy Enable-DDoS-VNET will not be assigned at connectivity or landing zone Management Groups to avoid VNET deployment issues. For deployment in Azure China, leave the parameter `parDdosProtectionPlanId` as an empty string (`''`) because the DDoS Protection feature is not available in Azure China.
23+
>
24+
> However, if you later do decide to deploy an DDoS Network Protection Plan, you will need to remember to come back and update the parameter `parDdosProtectionPlanId` with the resource ID of the DDoS Network Protection Plan to ensure the policy is applied to the relevant Management Groups. You can then use a policy [remediation task](https://docs.microsoft.com/azure/governance/policy/how-to/remediate-resources) to bring all non-compliant VNETs back into compliance, once a [compliance scan](https://docs.microsoft.com/azure/governance/policy/how-to/get-compliance-data#evaluation-triggers) has taken place.
25+
<!-- markdownlint-restore -->
26+
27+
### Azure CLI
28+
```bash
29+
# For Azure global regions
30+
31+
dateYMD=$(date +%Y%m%dT%H%M%S%NZ)
32+
NAME="alz-alzPolicyAssignmentDefaults-${dateYMD}"
33+
LOCATION="eastus"
34+
MGID="alz"
35+
TEMPLATEFILE="infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep"
36+
PARAMETERS="@infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json"
37+
38+
az deployment mg create --name ${NAME:0:63} --location $LOCATION --management-group-id $MGID --template-file $TEMPLATEFILE --parameters $PARAMETERS
39+
```
40+
OR
41+
```bash
42+
# For Azure China regions
43+
44+
dateYMD=$(date +%Y%m%dT%H%M%S%NZ)
45+
NAME="alz-alzPolicyAssignmentDefaults-${dateYMD}"
46+
LOCATION="chinaeast2"
47+
MGID="alz"
48+
TEMPLATEFILE="infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep"
49+
PARAMETERS="@infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json"
50+
51+
az deployment mg create --name ${NAME:0:63} --location $LOCATION --management-group-id $MGID --template-file $TEMPLATEFILE --parameters $PARAMETERS
52+
```
53+
54+
### PowerShell
55+
56+
```powershell
57+
# For Azure global regions
58+
59+
$inputObject = @{
60+
DeploymentName = -join ('alz-alzPolicyAssignmentDefaultsDeployment-{0}' -f (Get-Date -Format 'yyyyMMddTHHMMssffffZ'))[0..63]
61+
Location = 'eastus'
62+
ManagementGroupId = 'alz'
63+
TemplateFile = "infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep"
64+
TemplateParameterFile = 'infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/alzDefaultPolicyAssignments.parameters.all.json'
65+
}
66+
67+
New-AzManagementGroupDeployment @inputObject
68+
```
69+
OR
70+
```powershell
71+
# For Azure China regions
72+
73+
$inputObject = @{
74+
DeploymentName = -join ('alzPolicyAssignmentDefaultsDeployment-{0}' -f (Get-Date -Format 'yyyyMMddTHHMMssffffZ'))[0..63]
75+
Location = 'chinaeast2'
76+
ManagementGroupId = 'alz'
77+
TemplateFile = "infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep"
78+
TemplateParameterFile = 'infra-as-code/bicep/modules/policy/assignments/alzDefaults/parameters/mc-alzDefaultPolicyAssignments.parameters.all.json'
79+
}
80+
81+
New-AzManagementGroupDeployment @inputObject
82+
```
83+
84+
## Bicep Visualizer
85+
86+
![Bicep Visualizer](media/bicepVisualizer.png "Bicep Visualizer")

‎infra-as-code/bicep/modules/policy/assignments/workloadSpecific/bicepconfig.json

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
{
2+
"analyzers": {
3+
"core": {
4+
"enabled": true,
5+
"verbose": true,
6+
"rules": {
7+
"adminusername-should-not-be-literal": {
8+
"level": "error"
9+
},
10+
"no-hardcoded-env-urls": {
11+
"level": "error",
12+
"disallowedhosts": [
13+
"management.core.windows.net",
14+
"gallery.azure.com",
15+
"management.core.windows.net",
16+
"management.azure.com",
17+
"login.microsoftonline.com",
18+
"graph.windows.net",
19+
"trafficmanager.net",
20+
"vault.azure.net",
21+
"datalake.azure.net",
22+
"azuredatalakestore.net",
23+
"azuredatalakeanalytics.net",
24+
"vault.azure.net",
25+
"api.loganalytics.io",
26+
"api.loganalytics.iov1",
27+
"asazure.windows.net",
28+
"region.asazure.windows.net",
29+
"api.loganalytics.iov1",
30+
"api.loganalytics.io",
31+
"asazure.windows.net",
32+
"region.asazure.windows.net",
33+
"batch.core.windows.net"
34+
],
35+
"excludedhosts": [
36+
"schema.management.azure.com"
37+
]
38+
},
39+
"no-unnecessary-dependson": {
40+
"level": "error"
41+
},
42+
"no-unused-params": {
43+
"level": "error"
44+
},
45+
"no-unused-vars": {
46+
"level": "error"
47+
},
48+
"outputs-should-not-contain-secrets": {
49+
"level": "error"
50+
},
51+
"prefer-interpolation": {
52+
"level": "error"
53+
},
54+
"secure-parameter-default": {
55+
"level": "error"
56+
},
57+
"simplify-interpolation": {
58+
"level": "error"
59+
},
60+
"protect-commandtoexecute-secrets": {
61+
"level": "error"
62+
},
63+
"use-stable-vm-image": {
64+
"level": "error"
65+
},
66+
"explicit-values-for-loc-params": {
67+
"level": "error"
68+
},
69+
"no-hardcoded-location": {
70+
"level": "error"
71+
},
72+
"no-loc-expr-outside-params": {
73+
"level": "error"
74+
},
75+
"max-outputs": {
76+
"level": "error"
77+
},
78+
"max-params": {
79+
"level": "error"
80+
},
81+
"max-resources": {
82+
"level": "error"
83+
},
84+
"max-variables": {
85+
"level": "error"
86+
},
87+
"artifacts-parameters":{
88+
"level": "error"
89+
},
90+
"no-unused-existing-resources":{
91+
"level": "error"
92+
},
93+
"prefer-unquoted-property-names":{
94+
"level": "error"
95+
},
96+
"secure-params-in-nested-deploy":{
97+
"level": "error"
98+
},
99+
"secure-secrets-in-params":{
100+
"level": "error"
101+
},
102+
"use-recent-api-versions":{
103+
"level": "error"
104+
},
105+
"use-resource-id-functions":{
106+
"level": "error"
107+
},
108+
"use-stable-resource-identifiers":{
109+
"level": "error"
110+
}
111+
}
112+
}
113+
}
114+
}

0 commit comments

Comments
 (0)