From 3567b2e1f693f460b7726786c986dbed25fe2915 Mon Sep 17 00:00:00 2001 From: Alex Chen Date: Tue, 14 Jul 2026 18:28:36 +0300 Subject: [PATCH 1/4] feat(fleet): add Azure.Fleet.SecureBoot rule (AZR-000545) Signed-off-by: Alex Chen --- data/resource-type-mapping.json | 920 +++++++++--------- docs/changelog.md | 4 + docs/en/rules/Azure.Fleet.SecureBoot.md | 187 ++++ src/PSRule.Rules.Azure/en/PSRule-rules.psd1 | 2 + .../rules/Azure.Fleet.Rule.ps1 | 9 + .../Azure.Fleet.Tests.ps1 | 20 +- .../Resources.Fleet.json | 93 ++ 7 files changed, 777 insertions(+), 458 deletions(-) create mode 100644 docs/en/rules/Azure.Fleet.SecureBoot.md diff --git a/data/resource-type-mapping.json b/data/resource-type-mapping.json index 815afd47d1e..d794111f408 100644 --- a/data/resource-type-mapping.json +++ b/data/resource-type-mapping.json @@ -351,14 +351,6 @@ "ruleId": "Azure.AKS.ContainerInsights", "displayName": "Enable AKS Container insights" }, - { - "severity": "Important", - "pillar": "Security", - "category": "Azure resources", - "resourceType": "Microsoft.ContainerService/managedClusters", - "ruleId": "Azure.AKS.DefenderProfile", - "displayName": "Enable Defender profile" - }, { "severity": "Awareness", "pillar": "Operational Excellence", @@ -367,6 +359,14 @@ "ruleId": "Azure.AKS.DNSPrefix", "displayName": "Use valid AKS cluster DNS prefix" }, + { + "severity": "Important", + "pillar": "Security", + "category": "Azure resources", + "resourceType": "Microsoft.ContainerService/managedClusters", + "ruleId": "Azure.AKS.DefenderProfile", + "displayName": "Enable Defender profile" + }, { "severity": "Important", "pillar": "Performance Efficiency", @@ -631,22 +631,6 @@ "ruleId": "Azure.AKS.Version", "displayName": "Kubernetes Cluster version is old" }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:06 Usage and billing increments", - "resourceType": "Microsoft.Insights/scheduledQueryRules", - "ruleId": "Azure.Alert.HighFrequencyQuery", - "displayName": "Scheduled Query Alert is configured to use a high frequency query" - }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:13 Personnel time", - "resourceType": "Microsoft.Insights/metricAlerts", - "ruleId": "Azure.Alert.MetricAutoMitigate", - "displayName": "Metric Alert requires manual mitigation" - }, { "severity": "Awareness", "pillar": "Operational Excellence", @@ -671,22 +655,6 @@ "ruleId": "Azure.APIM.AvailabilityZone", "displayName": "API management instances should use availability zones in supported regions" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.ApiManagement/service", - "ruleId": "Azure.APIM.CertificateExpiry", - "displayName": "API Management uses current certificates" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:07 Encryption", - "resourceType": "Microsoft.ApiManagement/service", - "ruleId": "Azure.APIM.Ciphers", - "displayName": "Use secure ciphers for API Management" - }, { "severity": "Important", "pillar": "Security", @@ -703,6 +671,22 @@ "ruleId": "Azure.APIM.CORSPolicy", "displayName": "Avoid wildcards in APIM CORS policies" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.ApiManagement/service", + "ruleId": "Azure.APIM.CertificateExpiry", + "displayName": "API Management uses current certificates" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:07 Encryption", + "resourceType": "Microsoft.ApiManagement/service", + "ruleId": "Azure.APIM.Ciphers", + "displayName": "Use secure ciphers for API Management" + }, { "severity": "Critical", "pillar": "Security", @@ -951,6 +935,54 @@ "ruleId": "Azure.APIM.SampleProducts", "displayName": "API Management Service has default products present" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Regions and availability zones", + "resourceType": "Microsoft.Web/hostingEnvironments", + "ruleId": "Azure.ASE.AvailabilityZone", + "displayName": "Deploy app service environments using availability zones" + }, + { + "severity": "Important", + "pillar": "Operational Excellence", + "category": "Infrastructure provisioning", + "resourceType": "Microsoft.Web/hostingEnvironments", + "ruleId": "Azure.ASE.MigrateV3", + "displayName": "Migrate to App Service Environment v3" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.Network/applicationSecurityGroups", + "ruleId": "Azure.ASG.Name", + "displayName": "Use valid ASG names" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.DesktopVirtualization/hostPools", + "ruleId": "Azure.AVD.ScheduleAgentUpdate", + "displayName": "Schedule agent updates for host pools" + }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:06 Usage and billing increments", + "resourceType": "Microsoft.Insights/scheduledQueryRules", + "ruleId": "Azure.Alert.HighFrequencyQuery", + "displayName": "Scheduled Query Alert is configured to use a high frequency query" + }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:13 Personnel time", + "resourceType": "Microsoft.Insights/metricAlerts", + "ruleId": "Azure.Alert.MetricAutoMitigate", + "displayName": "Metric Alert requires manual mitigation" + }, { "severity": "Important", "pillar": "Security", @@ -1023,6 +1055,14 @@ "ruleId": "Azure.AppConfig.ReplicaLocation", "displayName": "App Configuration Store replica location is not allowed" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.AppConfiguration/configurationStores", + "ruleId": "Azure.AppConfig.SKU", + "displayName": "Use production App Configuration SKU" + }, { "severity": "Critical", "pillar": "Security", @@ -1039,14 +1079,6 @@ "ruleId": "Azure.AppConfig.SecretLeak", "displayName": "App Configuration Store key value is secret" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.AppConfiguration/configurationStores", - "ruleId": "Azure.AppConfig.SKU", - "displayName": "Use production App Configuration SKU" - }, { "severity": "Important", "pillar": "Reliability", @@ -1215,22 +1247,6 @@ "ruleId": "Azure.AppInsights.Workspace", "displayName": "Use workspace-based App Insights resources" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Application design", - "resourceType": "Microsoft.Web/sites", - "ruleId": "Azure.AppService.AlwaysOn", - "displayName": "Use App Service Always On" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Application design", - "resourceType": "Microsoft.Web/sites/slots", - "ruleId": "Azure.AppService.AlwaysOn", - "displayName": "Use App Service Always On" - }, { "severity": "Awareness", "pillar": "Performance Efficiency", @@ -1247,6 +1263,22 @@ "ruleId": "Azure.AppService.ARRAffinity", "displayName": "Disable Application Request Routing" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "Application design", + "resourceType": "Microsoft.Web/sites", + "ruleId": "Azure.AppService.AlwaysOn", + "displayName": "Use App Service Always On" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "Application design", + "resourceType": "Microsoft.Web/sites/slots", + "ruleId": "Azure.AppService.AlwaysOn", + "displayName": "Use App Service Always On" + }, { "severity": "Important", "pillar": "Reliability", @@ -1479,30 +1511,6 @@ "ruleId": "Azure.Arc.Server.MaintenanceConfig", "displayName": "Associate a maintenance configuration" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Regions and availability zones", - "resourceType": "Microsoft.Web/hostingEnvironments", - "ruleId": "Azure.ASE.AvailabilityZone", - "displayName": "Deploy app service environments using availability zones" - }, - { - "severity": "Important", - "pillar": "Operational Excellence", - "category": "Infrastructure provisioning", - "resourceType": "Microsoft.Web/hostingEnvironments", - "ruleId": "Azure.ASE.MigrateV3", - "displayName": "Migrate to App Service Environment v3" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.Network/applicationSecurityGroups", - "ruleId": "Azure.ASG.Name", - "displayName": "Use valid ASG names" - }, { "severity": "Important", "pillar": "Security", @@ -1593,11 +1601,11 @@ }, { "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.DesktopVirtualization/hostPools", - "ruleId": "Azure.AVD.ScheduleAgentUpdate", - "displayName": "Schedule agent updates for host pools" + "pillar": "Security", + "category": "Security design principles", + "resourceType": "Microsoft.DataProtection/backupVaults", + "ruleId": "Azure.BV.Immutable", + "displayName": "Immutability" }, { "severity": "Awareness", @@ -1607,14 +1615,6 @@ "ruleId": "Azure.Bastion.Name", "displayName": "Use valid names" }, - { - "severity": "Important", - "pillar": "Security", - "category": "Security design principles", - "resourceType": "Microsoft.DataProtection/backupVaults", - "ruleId": "Azure.BV.Immutable", - "displayName": "Immutability" - }, { "severity": "Awareness", "pillar": "Operational Excellence", @@ -1912,28 +1912,20 @@ "displayName": "Cosmos DB for Table account resources must use standard naming" }, { - "severity": "Critical", + "severity": "Important", "pillar": "Security", - "category": "SE:06 Network controls", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.PublicAccess", - "displayName": "Azure Databricks workspaces should disable public network access" + "category": "SE:08 Hardening resources", + "resourceType": "Microsoft.Network/dnsZones", + "ruleId": "Azure.DNS.DNSSEC", + "displayName": "DNS Zone is not signed" }, { - "severity": "Critical", + "severity": "Important", "pillar": "Security", - "category": "SE:06 Network controls", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.SecureConnectivity", - "displayName": "Enable secure connectivity for Databricks workspaces" - }, - { - "severity": "Critical", - "pillar": "Performance Efficiency", - "category": "PE:03 Selecting services", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.SKU", - "displayName": "Ensure Databricks workspaces are non-trial SKUs for production workloads" + "category": "SE:08 Hardening resources", + "resourceType": "Microsoft.Network/dnsZones/dnssecConfigs", + "ruleId": "Azure.DNS.DNSSEC", + "displayName": "DNS Zone is not signed" }, { "severity": "Awareness", @@ -1951,6 +1943,30 @@ "ruleId": "Azure.DataFactory.Version", "displayName": "Use Data Factory v2" }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:06 Network controls", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.PublicAccess", + "displayName": "Azure Databricks workspaces should disable public network access" + }, + { + "severity": "Critical", + "pillar": "Performance Efficiency", + "category": "PE:03 Selecting services", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.SKU", + "displayName": "Ensure Databricks workspaces are non-trial SKUs for production workloads" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:06 Network controls", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.SecureConnectivity", + "displayName": "Enable secure connectivity for Databricks workspaces" + }, { "severity": "Critical", "pillar": "Security", @@ -2024,36 +2040,36 @@ "displayName": "Set Microsoft Defender for open-source relational databases to the Standard tier" }, { - "severity": "Important", + "severity": "Critical", "pillar": "Security", - "category": "SE:12 Incident response", - "resourceType": "Microsoft.Security/securityContacts", - "ruleId": "Azure.Defender.SecurityContact", - "displayName": "Defender for Cloud notification contact not set" + "category": "SE:10 Monitoring and threat detection", + "resourceType": "Microsoft.Security/pricings", + "ruleId": "Azure.Defender.SQL", + "displayName": "Configure Microsoft Defender for SQL to the Standard tier" }, { "severity": "Critical", "pillar": "Security", "category": "SE:10 Monitoring and threat detection", "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.Servers", - "displayName": "Configure Microsoft Defender for Servers to the Standard tier and P2" + "ruleId": "Azure.Defender.SQLOnVM", + "displayName": "Configure Microsoft Defender for SQL Servers on machines to the Standard tier" }, { - "severity": "Critical", + "severity": "Important", "pillar": "Security", - "category": "SE:10 Monitoring and threat detection", - "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.SQL", - "displayName": "Configure Microsoft Defender for SQL to the Standard tier" + "category": "SE:12 Incident response", + "resourceType": "Microsoft.Security/securityContacts", + "ruleId": "Azure.Defender.SecurityContact", + "displayName": "Defender for Cloud notification contact not set" }, { "severity": "Critical", "pillar": "Security", "category": "SE:10 Monitoring and threat detection", "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.SQLOnVM", - "displayName": "Configure Microsoft Defender for SQL Servers on machines to the Standard tier" + "ruleId": "Azure.Defender.Servers", + "displayName": "Configure Microsoft Defender for Servers to the Standard tier and P2" }, { "severity": "Critical", @@ -2159,22 +2175,6 @@ "ruleId": "Azure.DevBox.ProjectLimit", "displayName": "Limit number of Dev Boxes per user" }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:08 Hardening resources", - "resourceType": "Microsoft.Network/dnsZones", - "ruleId": "Azure.DNS.DNSSEC", - "displayName": "DNS Zone is not signed" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:08 Hardening resources", - "resourceType": "Microsoft.Network/dnsZones/dnssecConfigs", - "ruleId": "Azure.DNS.DNSSEC", - "displayName": "DNS Zone is not signed" - }, { "severity": "Important", "pillar": "Reliability", @@ -2391,6 +2391,14 @@ "ruleId": "Azure.Fleet.PublicKey", "displayName": "Azure Fleet password-based authentication is enabled" }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:08 Hardening resources", + "resourceType": "Microsoft.AzureFleet/fleets", + "ruleId": "Azure.Fleet.SecureBoot", + "displayName": "Azure Fleet Secure Boot is not enabled" + }, { "severity": "Important", "pillar": "Security", @@ -2451,7 +2459,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.Probe", "displayName": "Use Health Probes for Front Door backends" }, @@ -2459,7 +2467,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.Probe", "displayName": "Use Health Probes for Front Door backends" }, @@ -2467,7 +2475,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.ProbeMethod", "displayName": "Use HEAD health probes for Front Door backends" }, @@ -2475,7 +2483,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.ProbeMethod", "displayName": "Use HEAD health probes for Front Door backends" }, @@ -2483,7 +2491,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.ProbePath", "displayName": "Use a Dedicated Health Endpoint for Front Door backends" }, @@ -2491,7 +2499,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.ProbePath", "displayName": "Use a Dedicated Health Endpoint for Front Door backends" }, @@ -2863,6 +2871,62 @@ "ruleId": "Azure.LogicApp.LimitHTTPTrigger", "displayName": "Logic App HTTP request trigger is not restricted" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.DocumentDB/cassandraClusters", + "ruleId": "Azure.MICassandra.AvailabilityZone", + "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.DocumentDB/cassandraClusters/dataCenters", + "ruleId": "Azure.MICassandra.AvailabilityZone", + "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" + }, + { + "severity": "Critical", + "pillar": "Cost Optimization", + "category": "CO:06 Usage and billing increments", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.ComputeIdleShutdown", + "displayName": "Configure idle shutdown for compute instances" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Connectivity", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.ComputeVnet", + "displayName": "Host ML Compute in VNet" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Authentication", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.DisableLocalAuth", + "displayName": "Disable local authentication on ML Compute" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Connectivity", + "resourceType": "Microsoft.MachineLearningServices/workspaces", + "ruleId": "Azure.ML.PublicAccess", + "displayName": "ML Workspace has public access disabled" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Identity and Access Management", + "resourceType": "Microsoft.MachineLearningServices/workspaces", + "ruleId": "Azure.ML.UserManagedIdentity", + "displayName": "Azure Machine Learning workspaces should use user-assigned managed identity" + }, { "severity": "Important", "pillar": "Security", @@ -3007,62 +3071,6 @@ "ruleId": "Azure.MariaDB.VNETRuleName", "displayName": "Use valid VNET rule names" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.DocumentDB/cassandraClusters", - "ruleId": "Azure.MICassandra.AvailabilityZone", - "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.DocumentDB/cassandraClusters/dataCenters", - "ruleId": "Azure.MICassandra.AvailabilityZone", - "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" - }, - { - "severity": "Critical", - "pillar": "Cost Optimization", - "category": "CO:06 Usage and billing increments", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.ComputeIdleShutdown", - "displayName": "Configure idle shutdown for compute instances" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Connectivity", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.ComputeVnet", - "displayName": "Host ML Compute in VNet" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Authentication", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.DisableLocalAuth", - "displayName": "Disable local authentication on ML Compute" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Connectivity", - "resourceType": "Microsoft.MachineLearningServices/workspaces", - "ruleId": "Azure.ML.PublicAccess", - "displayName": "ML Workspace has public access disabled" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Identity and Access Management", - "resourceType": "Microsoft.MachineLearningServices/workspaces", - "ruleId": "Azure.ML.UserManagedIdentity", - "displayName": "Azure Machine Learning workspaces should use user-assigned managed identity" - }, { "severity": "Critical", "pillar": "Security", @@ -3615,6 +3623,46 @@ "ruleId": "Azure.PublicIP.StandardSKU", "displayName": "Public IP address uses basic SKU" }, + { + "severity": "Important", + "pillar": "Security", + "category": "Security design principles", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.Immutable", + "displayName": "Immutability" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.Name", + "displayName": "Use valid names" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.ReplicationAlert", + "displayName": "Use geo-replicated storage" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.StorageType", + "displayName": "Use geo-replicated storage" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults/backupconfig", + "ruleId": "Azure.RSV.StorageType", + "displayName": "Use geo-replicated storage" + }, { "severity": "Important", "pillar": "Reliability", @@ -3784,236 +3832,36 @@ "displayName": "Route tables must use standard naming" }, { - "severity": "Important", + "severity": "Critical", "pillar": "Security", - "category": "Security design principles", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.Immutable", - "displayName": "Immutability" + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers", + "ruleId": "Azure.SQL.AAD", + "displayName": "Use Entra ID authentication with SQL databases" }, { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.Name", - "displayName": "Use valid names" + "severity": "Critical", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers/administrators", + "ruleId": "Azure.SQL.AAD", + "displayName": "Use Entra ID authentication with SQL databases" }, { "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.ReplicationAlert", - "displayName": "Use geo-replicated storage" + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers", + "ruleId": "Azure.SQL.AADOnly", + "displayName": "Databases use Entra ID only authentication" }, { "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.StorageType", - "displayName": "Use geo-replicated storage" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults/backupconfig", - "ruleId": "Azure.RSV.StorageType", - "displayName": "Use geo-replicated storage" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:06 Data partitioning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.IndexSLA", - "displayName": "Search index update SLA minimum replicas" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.ManagedIdentity", - "displayName": "Search services uses a managed identity" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Continuous integration", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.Name", - "displayName": "Azure AI Search name must be valid" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.Naming", - "displayName": "AI Search services must use standard naming" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:06 Data partitioning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.QuerySLA", - "displayName": "Search query SLA minimum replicas" - }, - { - "severity": "Critical", - "pillar": "Performance Efficiency", - "category": "PE:02 Capacity planning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.SKU", - "displayName": "AI Search minimum SKU" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Monitor", - "resourceType": "Microsoft.Insights/diagnosticSettings", - "ruleId": "Azure.ServiceBus.AuditLogs", - "displayName": "Audit Service Bus data plane access" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Monitor", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.AuditLogs", - "displayName": "Audit Service Bus data plane access" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.DisableLocalAuth", - "displayName": "Use identity-based authentication for Service Bus namespaces" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.GeoReplica", - "displayName": "Geo-replication" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:07 Encryption", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.MinTLS", - "displayName": "Enforce namespaces to minimum use TLS 1.2 version" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:01 Security baseline", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.ReplicaLocation", - "displayName": "Service Bus namespace replica location is not allowed" - }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:14 Consolidation", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.Usage", - "displayName": "Remove unused Service Bus namespaces" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.AAD", - "displayName": "Use Entra ID authentication with Service Fabric clusters" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.ServiceFabric/managedClusters", - "ruleId": "Azure.ServiceFabric.ManagedNaming", - "displayName": "Service Fabric managed cluster resources must use standard naming" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.Naming", - "displayName": "Service Fabric cluster resources must use standard naming" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:07 Encryption", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.ProtectionLevel", - "displayName": "Service Fabric Cluster allows unencrypted node to node communication" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Authentication", - "resourceType": "Microsoft.SignalRService/signalR", - "ruleId": "Azure.SignalR.ManagedIdentity", - "displayName": "Use managed identities for SignalR Services" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.SignalRService/SignalR", - "ruleId": "Azure.SignalR.Name", - "displayName": "Use valid SignalR service names" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.SignalRService/signalR", - "ruleId": "Azure.SignalR.SLA", - "displayName": "Use an SLA for SignalR Services" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers", - "ruleId": "Azure.SQL.AAD", - "displayName": "Use Entra ID authentication with SQL databases" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers/administrators", - "ruleId": "Azure.SQL.AAD", - "displayName": "Use Entra ID authentication with SQL databases" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers", - "ruleId": "Azure.SQL.AADOnly", - "displayName": "Databases use Entra ID only authentication" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers/azureADOnlyAuthentications", - "ruleId": "Azure.SQL.AADOnly", - "displayName": "Databases use Entra ID only authentication" + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers/azureADOnlyAuthentications", + "ruleId": "Azure.SQL.AADOnly", + "displayName": "Databases use Entra ID only authentication" }, { "severity": "Important", @@ -4263,6 +4111,166 @@ "ruleId": "Azure.SQLMI.Naming", "displayName": "SQL Managed Instance resources must use standard naming" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:06 Data partitioning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.IndexSLA", + "displayName": "Search index update SLA minimum replicas" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.ManagedIdentity", + "displayName": "Search services uses a managed identity" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Continuous integration", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.Name", + "displayName": "Azure AI Search name must be valid" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.Naming", + "displayName": "AI Search services must use standard naming" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:06 Data partitioning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.QuerySLA", + "displayName": "Search query SLA minimum replicas" + }, + { + "severity": "Critical", + "pillar": "Performance Efficiency", + "category": "PE:02 Capacity planning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.SKU", + "displayName": "AI Search minimum SKU" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Monitor", + "resourceType": "Microsoft.Insights/diagnosticSettings", + "ruleId": "Azure.ServiceBus.AuditLogs", + "displayName": "Audit Service Bus data plane access" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Monitor", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.AuditLogs", + "displayName": "Audit Service Bus data plane access" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.DisableLocalAuth", + "displayName": "Use identity-based authentication for Service Bus namespaces" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.GeoReplica", + "displayName": "Geo-replication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:07 Encryption", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.MinTLS", + "displayName": "Enforce namespaces to minimum use TLS 1.2 version" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:01 Security baseline", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.ReplicaLocation", + "displayName": "Service Bus namespace replica location is not allowed" + }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:14 Consolidation", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.Usage", + "displayName": "Remove unused Service Bus namespaces" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.AAD", + "displayName": "Use Entra ID authentication with Service Fabric clusters" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.ServiceFabric/managedClusters", + "ruleId": "Azure.ServiceFabric.ManagedNaming", + "displayName": "Service Fabric managed cluster resources must use standard naming" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.Naming", + "displayName": "Service Fabric cluster resources must use standard naming" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:07 Encryption", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.ProtectionLevel", + "displayName": "Service Fabric Cluster allows unencrypted node to node communication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Authentication", + "resourceType": "Microsoft.SignalRService/signalR", + "ruleId": "Azure.SignalR.ManagedIdentity", + "displayName": "Use managed identities for SignalR Services" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.SignalRService/SignalR", + "ruleId": "Azure.SignalR.Name", + "displayName": "Use valid SignalR service names" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.SignalRService/signalR", + "ruleId": "Azure.SignalR.SLA", + "displayName": "Use an SLA for SignalR Services" + }, { "severity": "Important", "pillar": "Security", @@ -4471,14 +4479,6 @@ "ruleId": "Azure.VM.ADE", "displayName": "Use Azure Disk Encryption" }, - { - "severity": "Important", - "pillar": "Operational Excellence", - "category": "OE:10 Automation design", - "resourceType": "Microsoft.Compute/virtualMachines", - "ruleId": "Azure.VM.Agent", - "displayName": "Virtual Machine agent is not provisioned" - }, { "severity": "Important", "pillar": "Operational Excellence", @@ -4527,6 +4527,14 @@ "ruleId": "Azure.VM.ASName", "displayName": "Use valid Availability Set names" }, + { + "severity": "Important", + "pillar": "Operational Excellence", + "category": "OE:10 Automation design", + "resourceType": "Microsoft.Compute/virtualMachines", + "ruleId": "Azure.VM.Agent", + "displayName": "Virtual Machine agent is not provisioned" + }, { "severity": "Important", "pillar": "Reliability", @@ -4663,6 +4671,14 @@ "ruleId": "Azure.VM.PublicKey", "displayName": "VM password-based authentication is enabled" }, + { + "severity": "Important", + "pillar": "Performance Efficiency", + "category": "Design for performance", + "resourceType": "Microsoft.Compute/virtualMachines", + "ruleId": "Azure.VM.SQLServerDisk", + "displayName": "Configure Premium disks or above" + }, { "severity": "Important", "pillar": "Security", @@ -4687,14 +4703,6 @@ "ruleId": "Azure.VM.ShouldNotBeStopped", "displayName": "Virtual Machine is stopped but still allocated" }, - { - "severity": "Important", - "pillar": "Performance Efficiency", - "category": "Design for performance", - "resourceType": "Microsoft.Compute/virtualMachines", - "ruleId": "Azure.VM.SQLServerDisk", - "displayName": "Configure Premium disks or above" - }, { "severity": "Important", "pillar": "Reliability", @@ -5055,14 +5063,6 @@ "ruleId": "Azure.VNG.VPNLegacySKU", "displayName": "Migrate from legacy VPN gateway SKUs" }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.Network/virtualWans", - "ruleId": "Azure.vWAN.Name", - "displayName": "Use valid vWAN names" - }, { "severity": "Important", "pillar": "Security", @@ -5078,5 +5078,13 @@ "resourceType": "Microsoft.SignalRService/webPubSub", "ruleId": "Azure.WebPubSub.SLA", "displayName": "Use an SLA for Web PubSub Services" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.Network/virtualWans", + "ruleId": "Azure.vWAN.Name", + "displayName": "Use valid vWAN names" } ] diff --git a/docs/changelog.md b/docs/changelog.md index f867b2aea2e..fa55e3701aa 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -32,6 +32,10 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers What's changed since pre-release v1.48.0-B0228: +- New rules: + - Azure Fleet: + - Added `Azure.Fleet.SecureBoot` to require Trusted Launch/Confidential VM with Secure Boot for fleet VM profiles by @l46983284-cpu. + [#3729](https://github.com/Azure/PSRule.Rules.Azure/issues/3729) - General improvements: - Added support for resolving filtered subnet IDs from existing virtual networks during Bicep expansion. [#2159](https://github.com/Azure/PSRule.Rules.Azure/issues/2159) diff --git a/docs/en/rules/Azure.Fleet.SecureBoot.md b/docs/en/rules/Azure.Fleet.SecureBoot.md new file mode 100644 index 00000000000..0f3e7dabc2d --- /dev/null +++ b/docs/en/rules/Azure.Fleet.SecureBoot.md @@ -0,0 +1,187 @@ +--- +reviewed: 2026-07-14 +severity: Important +pillar: Security +category: SE:08 Hardening resources +resource: Azure Fleet +resourceType: Microsoft.AzureFleet/fleets +online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Fleet.SecureBoot/ +--- + +# Azure Fleet Secure Boot is not enabled + +## SYNOPSIS + +Operating systems or drivers may be maliciously modified or injected if an actor gains access to VM/ OS storage or build media. + +## DESCRIPTION + +Azure Fleet virtual machine profiles are able to run a wide range of operating systems including many distributions of Windows and Linux. +A malicious actor may attempt to tamper or inject operating system and driver components to gain access to resources and persist between reboots. + +When a fleet VM instance is started, Azure is able to verify if: + +1. The operating system and drivers originate from a trusted source. +2. These components are in their original unaltered state. + +Azure is able to perform this verification by Secure Boot and Trusted Launch features. +These features verify the cryptographic signatures of early boot components before they start. + +Secure Boot and Trusted Launch are on by default for many configurations. +However, if you are running an older configuration these features may need to be enabled. + +Setting the security type to `ConfidentialVM` is also acceptable. + +## RECOMMENDATION + +Consider enabling Trusted Launch or Confidential VM with Secure Boot for Azure Fleet VM profiles to protect against boot-level attacks. + +## EXAMPLES + +### Configure with Bicep + +To deploy an Azure Fleet that passes this rule: + +- Set the `properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType` property to `TrustedLaunch` or `ConfidentialVM`. +- Set the `properties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled` property to `true`. + +For example: + +```bicep +resource windows_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = { + name: name + location: location + properties: { + computeProfile: { + baseVirtualMachineProfile: { + securityProfile: { + securityType: 'TrustedLaunch' + encryptionAtHost: true + uefiSettings: { + secureBootEnabled: true + vTpmEnabled: true + } + } + osProfile: { + computerNamePrefix: 'fleet' + adminUsername: adminUsername + adminPassword: secret + } + networkProfile: { + networkInterfaceConfigurations: [ + { + name: 'netconfig' + properties: { + ipConfigurations: [ + { + name: 'ipconfig' + properties: { + primary: true + subnet: { + id: subnetId + } + } + } + ] + } + } + ] + } + } + } + vmSizesProfile: [ + { + name: 'Standard_D8ds_v6' + rank: 0 + } + ] + regularPriorityProfile: { + minCapacity: 1 + capacity: 5 + allocationStrategy: 'Prioritized' + } + } +} +``` + +### Configure with Azure template + +To deploy an Azure Fleet that passes this rule: + +- Set the `properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType` property to `TrustedLaunch` or `ConfidentialVM`. +- Set the `properties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled` property to `true`. + +For example: + +```json +{ + "type": "Microsoft.AzureFleet/fleets", + "apiVersion": "2024-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "properties": { + "computeProfile": { + "baseVirtualMachineProfile": { + "securityProfile": { + "securityType": "TrustedLaunch", + "encryptionAtHost": true, + "uefiSettings": { + "secureBootEnabled": true, + "vTpmEnabled": true + } + }, + "osProfile": { + "computerNamePrefix": "fleet", + "adminUsername": "[parameters('adminUsername')]", + "adminPassword": "[parameters('secret')]" + }, + "networkProfile": { + "networkInterfaceConfigurations": [ + { + "name": "netconfig", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "primary": true, + "subnet": { + "id": "[parameters('subnetId')]" + } + } + } + ] + } + } + ] + } + } + }, + "vmSizesProfile": [ + { + "name": "Standard_D8ds_v6", + "rank": 0 + } + ], + "regularPriorityProfile": { + "minCapacity": 1, + "capacity": 5, + "allocationStrategy": "Prioritized" + } + } +} +``` + +## NOTES + +Currently there are a few limitations (see documentation for up to date details), including: + +- A supported VM SKU and operating system is required. +- Secure Boot and Trusted Launch is only supported on Generation 2 VM images. + +## LINKS + +- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources) +- [Security: Level 2](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level2) +- [Trusted Launch for Azure virtual machines](https://learn.microsoft.com/azure/virtual-machines/trusted-launch) +- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.azurefleet/fleets#securityprofile) diff --git a/src/PSRule.Rules.Azure/en/PSRule-rules.psd1 b/src/PSRule.Rules.Azure/en/PSRule-rules.psd1 index 890758609f7..06db5cdc5b5 100644 --- a/src/PSRule.Rules.Azure/en/PSRule-rules.psd1 +++ b/src/PSRule.Rules.Azure/en/PSRule-rules.psd1 @@ -79,6 +79,8 @@ ReplicaInSecondaryNotFound = "A replica in a secondary region was not found." VMSSPublicKey = "The virtual machine scale set '{0}' should have password authentication disabled." FleetPublicKey = "The Azure Fleet '{0}' should have password authentication disabled." + FleetSecureBoot = "The Azure Fleet '{0}' should set the 'securityType' property to 'TrustedLaunch' or 'ConfidentialVM'." + FleetSecureBootEnabled = "The Azure Fleet '{0}' should have Secure Boot enabled." ACRSoftDeletePolicy = "The container registry '{0}' should have soft delete policy enabled." ACRSoftDeletePolicyRetention = "The container registry '{0}' should have retention period value between one to 90 days for the soft delete policy." ContainerRegistryAuditDiagnosticSetting = "Minimum one diagnostic setting should have ({0}) configured or category group ({1}) configured." diff --git a/src/PSRule.Rules.Azure/rules/Azure.Fleet.Rule.ps1 b/src/PSRule.Rules.Azure/rules/Azure.Fleet.Rule.ps1 index b0f8c37903a..e6d9678b1bf 100644 --- a/src/PSRule.Rules.Azure/rules/Azure.Fleet.Rule.ps1 +++ b/src/PSRule.Rules.Azure/rules/Azure.Fleet.Rule.ps1 @@ -13,4 +13,13 @@ Rule 'Azure.Fleet.PublicKey' -Ref 'AZR-000541' -Type 'Microsoft.AzureFleet/fleet Reason($LocalizedData.FleetPublicKey, $PSRule.TargetName) } + +# Synopsis: Azure Fleet VM profiles should use Trusted Launch with Secure Boot enabled. +Rule 'Azure.Fleet.SecureBoot' -Ref 'AZR-000545' -Type 'Microsoft.AzureFleet/fleets' -Tag @{ release = 'GA'; ruleSet = '2026_09'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.WAF/maturity' = 'L2' } { + $Assert.In($TargetObject, 'properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType', @('TrustedLaunch', 'ConfidentialVM')). + Reason($LocalizedData.FleetSecureBoot, $PSRule.TargetName) + $Assert.HasFieldValue($TargetObject, 'properties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled', $True). + Reason($LocalizedData.FleetSecureBootEnabled, $PSRule.TargetName) +} + #endregion Rules diff --git a/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 b/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 index 2a73bdcdec8..2467712e213 100644 --- a/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 +++ b/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 @@ -53,8 +53,24 @@ Describe 'Azure.Fleet' -Tag 'Fleet' { # Pass $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' }); $ruleResult | Should -Not -BeNullOrEmpty; - $ruleResult.Length | Should -Be 1; - $ruleResult.TargetName | Should -Be 'fleet-001'; + $ruleResult.Length | Should -Be 2; + $ruleResult.TargetName | Should -BeIn 'fleet-001', 'fleet-005'; + } + + It 'Azure.Fleet.SecureBoot' { + $filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Fleet.SecureBoot' }; + + # Fail + $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' }); + $ruleResult | Should -Not -BeNullOrEmpty; + $ruleResult.Length | Should -Be 3; + $ruleResult.TargetName | Should -BeIn 'fleet-001', 'fleet-002', 'fleet-003'; + + # Pass + $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' }); + $ruleResult | Should -Not -BeNullOrEmpty; + $ruleResult.Length | Should -Be 2; + $ruleResult.TargetName | Should -BeIn 'fleet-004', 'fleet-005'; } } } diff --git a/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json b/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json index a5b25f8e378..54aee92b4e8 100644 --- a/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json +++ b/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json @@ -321,5 +321,98 @@ "ResourceGroupName": "test-rg", "Type": "Microsoft.AzureFleet/fleets", "Tags": {} + }, + { + "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-005", + "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-005", + "Identity": null, + "Kind": null, + "Location": "eastus", + "ManagedBy": null, + "ResourceName": "fleet-005", + "Name": "fleet-005", + "ExtensionResourceName": null, + "ParentResource": null, + "Plan": null, + "Properties": { + "computeProfile": { + "baseVirtualMachineProfile": { + "securityProfile": { + "securityType": "TrustedLaunch", + "uefiSettings": { + "secureBootEnabled": true, + "vTpmEnabled": true + } + }, + "osProfile": { + "computerNamePrefix": "fleet", + "adminUsername": "azureuser", + "linuxConfiguration": { + "disablePasswordAuthentication": true, + "ssh": { + "publicKeys": [ + { + "path": "/home/azureuser/.ssh/authorized_keys", + "keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC" + } + ] + }, + "provisionVMAgent": true + } + }, + "storageProfile": { + "osDisk": { + "createOption": "FromImage", + "caching": "ReadWrite", + "managedDisk": { + "storageAccountType": "Premium_LRS" + } + }, + "imageReference": { + "publisher": "MicrosoftCblMariner", + "offer": "Cbl-Mariner", + "sku": "cbl-mariner-2-gen2", + "version": "latest" + } + }, + "networkProfile": { + "networkInterfaceConfigurations": [ + { + "name": "netconfig", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "primary": true, + "subnet": { + "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-001/subnets/subnet-001" + } + } + } + ] + } + } + ] + } + } + }, + "vmSizesProfile": [ + { + "name": "Standard_D8ds_v6", + "rank": 0 + } + ], + "regularPriorityProfile": { + "minCapacity": 1, + "capacity": 5, + "allocationStrategy": "Prioritized" + } + }, + "ResourceType": "Microsoft.AzureFleet/fleets", + "SubscriptionId": "00000000-0000-0000-0000-000000000000", + "ResourceGroupName": "test-rg", + "Type": "Microsoft.AzureFleet/fleets", + "Tags": {} } ] From ef829bd58bd22971bf38c26d6b72beeef034b96b Mon Sep 17 00:00:00 2001 From: Alex Chen Date: Tue, 14 Jul 2026 19:00:47 +0300 Subject: [PATCH 2/4] test(fleet): cover SecureBoot securityType and uefi cases separately Signed-off-by: Alex Chen --- .../Resources.Fleet.json | 250 ++++++++++++++++++ 1 file changed, 250 insertions(+) diff --git a/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json b/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json index 54aee92b4e8..14d9f77e4d0 100644 --- a/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json +++ b/tests/PSRule.Rules.Azure.Tests/Resources.Fleet.json @@ -414,5 +414,255 @@ "ResourceGroupName": "test-rg", "Type": "Microsoft.AzureFleet/fleets", "Tags": {} + }, + { + "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-006", + "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-006", + "Identity": null, + "Kind": null, + "Location": "eastus", + "ManagedBy": null, + "ResourceName": "fleet-006", + "Name": "fleet-006", + "ExtensionResourceName": null, + "ParentResource": null, + "Plan": null, + "Properties": { + "computeProfile": { + "baseVirtualMachineProfile": { + "securityProfile": { + "securityType": "TrustedLaunch", + "encryptionAtHost": true, + "uefiSettings": { + "secureBootEnabled": false, + "vTpmEnabled": true + } + }, + "osProfile": { + "computerNamePrefix": "fleet", + "adminUsername": "azureuser", + "adminPassword": "P@ssword123!" + }, + "storageProfile": { + "osDisk": { + "createOption": "FromImage", + "caching": "ReadWrite", + "managedDisk": { + "storageAccountType": "Premium_LRS" + }, + "osType": "Windows" + }, + "imageReference": { + "publisher": "MicrosoftWindowsServer", + "offer": "WindowsServer", + "sku": "2022-datacenter-g2", + "version": "latest" + } + }, + "networkProfile": { + "networkInterfaceConfigurations": [ + { + "name": "netconfig", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "primary": true, + "subnet": { + "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-001/subnets/subnet-001" + } + } + } + ] + } + } + ] + } + } + }, + "vmSizesProfile": [ + { + "name": "Standard_D8ds_v6", + "rank": 0 + } + ], + "regularPriorityProfile": { + "minCapacity": 1, + "capacity": 5, + "allocationStrategy": "Prioritized" + } + }, + "ResourceType": "Microsoft.AzureFleet/fleets", + "SubscriptionId": "00000000-0000-0000-0000-000000000000", + "ResourceGroupName": "test-rg", + "Type": "Microsoft.AzureFleet/fleets", + "Tags": {} + }, + { + "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-007", + "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-007", + "Identity": null, + "Kind": null, + "Location": "eastus", + "ManagedBy": null, + "ResourceName": "fleet-007", + "Name": "fleet-007", + "ExtensionResourceName": null, + "ParentResource": null, + "Plan": null, + "Properties": { + "computeProfile": { + "baseVirtualMachineProfile": { + "securityProfile": { + "uefiSettings": { + "secureBootEnabled": true, + "vTpmEnabled": true + } + }, + "osProfile": { + "computerNamePrefix": "fleet", + "adminUsername": "azureuser", + "adminPassword": "P@ssword123!" + }, + "storageProfile": { + "osDisk": { + "createOption": "FromImage", + "caching": "ReadWrite", + "managedDisk": { + "storageAccountType": "Premium_LRS" + }, + "osType": "Windows" + }, + "imageReference": { + "publisher": "MicrosoftWindowsServer", + "offer": "WindowsServer", + "sku": "2022-datacenter-g2", + "version": "latest" + } + }, + "networkProfile": { + "networkInterfaceConfigurations": [ + { + "name": "netconfig", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "primary": true, + "subnet": { + "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-001/subnets/subnet-001" + } + } + } + ] + } + } + ] + } + } + }, + "vmSizesProfile": [ + { + "name": "Standard_D8ds_v6", + "rank": 0 + } + ], + "regularPriorityProfile": { + "minCapacity": 1, + "capacity": 5, + "allocationStrategy": "Prioritized" + } + }, + "ResourceType": "Microsoft.AzureFleet/fleets", + "SubscriptionId": "00000000-0000-0000-0000-000000000000", + "ResourceGroupName": "test-rg", + "Type": "Microsoft.AzureFleet/fleets", + "Tags": {} + }, + { + "ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-008", + "Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.AzureFleet/fleets/fleet-008", + "Identity": null, + "Kind": null, + "Location": "eastus", + "ManagedBy": null, + "ResourceName": "fleet-008", + "Name": "fleet-008", + "ExtensionResourceName": null, + "ParentResource": null, + "Plan": null, + "Properties": { + "computeProfile": { + "baseVirtualMachineProfile": { + "securityProfile": { + "securityType": "ConfidentialVM", + "encryptionAtHost": true, + "uefiSettings": { + "secureBootEnabled": true, + "vTpmEnabled": true + } + }, + "osProfile": { + "computerNamePrefix": "fleet", + "adminUsername": "azureuser", + "adminPassword": "P@ssword123!" + }, + "storageProfile": { + "osDisk": { + "createOption": "FromImage", + "caching": "ReadWrite", + "managedDisk": { + "storageAccountType": "Premium_LRS" + }, + "osType": "Windows" + }, + "imageReference": { + "publisher": "MicrosoftWindowsServer", + "offer": "WindowsServer", + "sku": "2022-datacenter-g2", + "version": "latest" + } + }, + "networkProfile": { + "networkInterfaceConfigurations": [ + { + "name": "netconfig", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "primary": true, + "subnet": { + "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-001/subnets/subnet-001" + } + } + } + ] + } + } + ] + } + } + }, + "vmSizesProfile": [ + { + "name": "Standard_D8ds_v6", + "rank": 0 + } + ], + "regularPriorityProfile": { + "minCapacity": 1, + "capacity": 5, + "allocationStrategy": "Prioritized" + } + }, + "ResourceType": "Microsoft.AzureFleet/fleets", + "SubscriptionId": "00000000-0000-0000-0000-000000000000", + "ResourceGroupName": "test-rg", + "Type": "Microsoft.AzureFleet/fleets", + "Tags": {} } ] From 324ca39cea8024e894b8c1f7c92381dba8c11b5a Mon Sep 17 00:00:00 2001 From: Alex Chen Date: Tue, 14 Jul 2026 19:00:52 +0300 Subject: [PATCH 3/4] test(fleet): assert SecureBoot partial fail/pass matrix Signed-off-by: Alex Chen --- tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 b/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 index 2467712e213..8d21ee27a54 100644 --- a/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 +++ b/tests/PSRule.Rules.Azure.Tests/Azure.Fleet.Tests.ps1 @@ -63,14 +63,14 @@ Describe 'Azure.Fleet' -Tag 'Fleet' { # Fail $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' }); $ruleResult | Should -Not -BeNullOrEmpty; - $ruleResult.Length | Should -Be 3; - $ruleResult.TargetName | Should -BeIn 'fleet-001', 'fleet-002', 'fleet-003'; + $ruleResult.Length | Should -Be 5; + $ruleResult.TargetName | Should -BeIn 'fleet-001', 'fleet-002', 'fleet-003', 'fleet-006', 'fleet-007'; # Pass $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' }); $ruleResult | Should -Not -BeNullOrEmpty; - $ruleResult.Length | Should -Be 2; - $ruleResult.TargetName | Should -BeIn 'fleet-004', 'fleet-005'; + $ruleResult.Length | Should -Be 3; + $ruleResult.TargetName | Should -BeIn 'fleet-004', 'fleet-005', 'fleet-008'; } } } From 28db76665108c45e4f7a61883205c41910130538 Mon Sep 17 00:00:00 2001 From: Alex Chen Date: Tue, 14 Jul 2026 19:01:32 +0300 Subject: [PATCH 4/4] chore: drop generated resource-type-mapping churn from rule PR Signed-off-by: Alex Chen --- data/resource-type-mapping.json | 924 ++++++++++++++++---------------- 1 file changed, 458 insertions(+), 466 deletions(-) diff --git a/data/resource-type-mapping.json b/data/resource-type-mapping.json index d794111f408..815afd47d1e 100644 --- a/data/resource-type-mapping.json +++ b/data/resource-type-mapping.json @@ -351,14 +351,6 @@ "ruleId": "Azure.AKS.ContainerInsights", "displayName": "Enable AKS Container insights" }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Continuous integration", - "resourceType": "Microsoft.ContainerService/managedClusters", - "ruleId": "Azure.AKS.DNSPrefix", - "displayName": "Use valid AKS cluster DNS prefix" - }, { "severity": "Important", "pillar": "Security", @@ -367,6 +359,14 @@ "ruleId": "Azure.AKS.DefenderProfile", "displayName": "Enable Defender profile" }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Continuous integration", + "resourceType": "Microsoft.ContainerService/managedClusters", + "ruleId": "Azure.AKS.DNSPrefix", + "displayName": "Use valid AKS cluster DNS prefix" + }, { "severity": "Important", "pillar": "Performance Efficiency", @@ -631,6 +631,22 @@ "ruleId": "Azure.AKS.Version", "displayName": "Kubernetes Cluster version is old" }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:06 Usage and billing increments", + "resourceType": "Microsoft.Insights/scheduledQueryRules", + "ruleId": "Azure.Alert.HighFrequencyQuery", + "displayName": "Scheduled Query Alert is configured to use a high frequency query" + }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:13 Personnel time", + "resourceType": "Microsoft.Insights/metricAlerts", + "ruleId": "Azure.Alert.MetricAutoMitigate", + "displayName": "Metric Alert requires manual mitigation" + }, { "severity": "Awareness", "pillar": "Operational Excellence", @@ -655,22 +671,6 @@ "ruleId": "Azure.APIM.AvailabilityZone", "displayName": "API management instances should use availability zones in supported regions" }, - { - "severity": "Important", - "pillar": "Security", - "category": "Design", - "resourceType": "Microsoft.ApiManagement/service", - "ruleId": "Azure.APIM.CORSPolicy", - "displayName": "Avoid wildcards in APIM CORS policies" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Design", - "resourceType": "Microsoft.ApiManagement/service/policies", - "ruleId": "Azure.APIM.CORSPolicy", - "displayName": "Avoid wildcards in APIM CORS policies" - }, { "severity": "Important", "pillar": "Reliability", @@ -687,6 +687,22 @@ "ruleId": "Azure.APIM.Ciphers", "displayName": "Use secure ciphers for API Management" }, + { + "severity": "Important", + "pillar": "Security", + "category": "Design", + "resourceType": "Microsoft.ApiManagement/service", + "ruleId": "Azure.APIM.CORSPolicy", + "displayName": "Avoid wildcards in APIM CORS policies" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Design", + "resourceType": "Microsoft.ApiManagement/service/policies", + "ruleId": "Azure.APIM.CORSPolicy", + "displayName": "Avoid wildcards in APIM CORS policies" + }, { "severity": "Critical", "pillar": "Security", @@ -935,54 +951,6 @@ "ruleId": "Azure.APIM.SampleProducts", "displayName": "API Management Service has default products present" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Regions and availability zones", - "resourceType": "Microsoft.Web/hostingEnvironments", - "ruleId": "Azure.ASE.AvailabilityZone", - "displayName": "Deploy app service environments using availability zones" - }, - { - "severity": "Important", - "pillar": "Operational Excellence", - "category": "Infrastructure provisioning", - "resourceType": "Microsoft.Web/hostingEnvironments", - "ruleId": "Azure.ASE.MigrateV3", - "displayName": "Migrate to App Service Environment v3" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.Network/applicationSecurityGroups", - "ruleId": "Azure.ASG.Name", - "displayName": "Use valid ASG names" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.DesktopVirtualization/hostPools", - "ruleId": "Azure.AVD.ScheduleAgentUpdate", - "displayName": "Schedule agent updates for host pools" - }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:06 Usage and billing increments", - "resourceType": "Microsoft.Insights/scheduledQueryRules", - "ruleId": "Azure.Alert.HighFrequencyQuery", - "displayName": "Scheduled Query Alert is configured to use a high frequency query" - }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:13 Personnel time", - "resourceType": "Microsoft.Insights/metricAlerts", - "ruleId": "Azure.Alert.MetricAutoMitigate", - "displayName": "Metric Alert requires manual mitigation" - }, { "severity": "Important", "pillar": "Security", @@ -1055,14 +1023,6 @@ "ruleId": "Azure.AppConfig.ReplicaLocation", "displayName": "App Configuration Store replica location is not allowed" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.AppConfiguration/configurationStores", - "ruleId": "Azure.AppConfig.SKU", - "displayName": "Use production App Configuration SKU" - }, { "severity": "Critical", "pillar": "Security", @@ -1079,6 +1039,14 @@ "ruleId": "Azure.AppConfig.SecretLeak", "displayName": "App Configuration Store key value is secret" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.AppConfiguration/configurationStores", + "ruleId": "Azure.AppConfig.SKU", + "displayName": "Use production App Configuration SKU" + }, { "severity": "Important", "pillar": "Reliability", @@ -1247,22 +1215,6 @@ "ruleId": "Azure.AppInsights.Workspace", "displayName": "Use workspace-based App Insights resources" }, - { - "severity": "Awareness", - "pillar": "Performance Efficiency", - "category": "PE:05 Scaling and partitioning", - "resourceType": "Microsoft.Web/sites", - "ruleId": "Azure.AppService.ARRAffinity", - "displayName": "Disable Application Request Routing" - }, - { - "severity": "Awareness", - "pillar": "Performance Efficiency", - "category": "PE:05 Scaling and partitioning", - "resourceType": "Microsoft.Web/sites/slots", - "ruleId": "Azure.AppService.ARRAffinity", - "displayName": "Disable Application Request Routing" - }, { "severity": "Important", "pillar": "Reliability", @@ -1279,6 +1231,22 @@ "ruleId": "Azure.AppService.AlwaysOn", "displayName": "Use App Service Always On" }, + { + "severity": "Awareness", + "pillar": "Performance Efficiency", + "category": "PE:05 Scaling and partitioning", + "resourceType": "Microsoft.Web/sites", + "ruleId": "Azure.AppService.ARRAffinity", + "displayName": "Disable Application Request Routing" + }, + { + "severity": "Awareness", + "pillar": "Performance Efficiency", + "category": "PE:05 Scaling and partitioning", + "resourceType": "Microsoft.Web/sites/slots", + "ruleId": "Azure.AppService.ARRAffinity", + "displayName": "Disable Application Request Routing" + }, { "severity": "Important", "pillar": "Reliability", @@ -1511,6 +1479,30 @@ "ruleId": "Azure.Arc.Server.MaintenanceConfig", "displayName": "Associate a maintenance configuration" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Regions and availability zones", + "resourceType": "Microsoft.Web/hostingEnvironments", + "ruleId": "Azure.ASE.AvailabilityZone", + "displayName": "Deploy app service environments using availability zones" + }, + { + "severity": "Important", + "pillar": "Operational Excellence", + "category": "Infrastructure provisioning", + "resourceType": "Microsoft.Web/hostingEnvironments", + "ruleId": "Azure.ASE.MigrateV3", + "displayName": "Migrate to App Service Environment v3" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.Network/applicationSecurityGroups", + "ruleId": "Azure.ASG.Name", + "displayName": "Use valid ASG names" + }, { "severity": "Important", "pillar": "Security", @@ -1601,11 +1593,11 @@ }, { "severity": "Important", - "pillar": "Security", - "category": "Security design principles", - "resourceType": "Microsoft.DataProtection/backupVaults", - "ruleId": "Azure.BV.Immutable", - "displayName": "Immutability" + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.DesktopVirtualization/hostPools", + "ruleId": "Azure.AVD.ScheduleAgentUpdate", + "displayName": "Schedule agent updates for host pools" }, { "severity": "Awareness", @@ -1615,6 +1607,14 @@ "ruleId": "Azure.Bastion.Name", "displayName": "Use valid names" }, + { + "severity": "Important", + "pillar": "Security", + "category": "Security design principles", + "resourceType": "Microsoft.DataProtection/backupVaults", + "ruleId": "Azure.BV.Immutable", + "displayName": "Immutability" + }, { "severity": "Awareness", "pillar": "Operational Excellence", @@ -1912,20 +1912,28 @@ "displayName": "Cosmos DB for Table account resources must use standard naming" }, { - "severity": "Important", + "severity": "Critical", "pillar": "Security", - "category": "SE:08 Hardening resources", - "resourceType": "Microsoft.Network/dnsZones", - "ruleId": "Azure.DNS.DNSSEC", - "displayName": "DNS Zone is not signed" + "category": "SE:06 Network controls", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.PublicAccess", + "displayName": "Azure Databricks workspaces should disable public network access" }, { - "severity": "Important", + "severity": "Critical", "pillar": "Security", - "category": "SE:08 Hardening resources", - "resourceType": "Microsoft.Network/dnsZones/dnssecConfigs", - "ruleId": "Azure.DNS.DNSSEC", - "displayName": "DNS Zone is not signed" + "category": "SE:06 Network controls", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.SecureConnectivity", + "displayName": "Enable secure connectivity for Databricks workspaces" + }, + { + "severity": "Critical", + "pillar": "Performance Efficiency", + "category": "PE:03 Selecting services", + "resourceType": "Microsoft.Databricks/workspaces", + "ruleId": "Azure.Databricks.SKU", + "displayName": "Ensure Databricks workspaces are non-trial SKUs for production workloads" }, { "severity": "Awareness", @@ -1943,30 +1951,6 @@ "ruleId": "Azure.DataFactory.Version", "displayName": "Use Data Factory v2" }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:06 Network controls", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.PublicAccess", - "displayName": "Azure Databricks workspaces should disable public network access" - }, - { - "severity": "Critical", - "pillar": "Performance Efficiency", - "category": "PE:03 Selecting services", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.SKU", - "displayName": "Ensure Databricks workspaces are non-trial SKUs for production workloads" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:06 Network controls", - "resourceType": "Microsoft.Databricks/workspaces", - "ruleId": "Azure.Databricks.SecureConnectivity", - "displayName": "Enable secure connectivity for Databricks workspaces" - }, { "severity": "Critical", "pillar": "Security", @@ -2040,36 +2024,36 @@ "displayName": "Set Microsoft Defender for open-source relational databases to the Standard tier" }, { - "severity": "Critical", + "severity": "Important", "pillar": "Security", - "category": "SE:10 Monitoring and threat detection", - "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.SQL", - "displayName": "Configure Microsoft Defender for SQL to the Standard tier" + "category": "SE:12 Incident response", + "resourceType": "Microsoft.Security/securityContacts", + "ruleId": "Azure.Defender.SecurityContact", + "displayName": "Defender for Cloud notification contact not set" }, { "severity": "Critical", "pillar": "Security", "category": "SE:10 Monitoring and threat detection", "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.SQLOnVM", - "displayName": "Configure Microsoft Defender for SQL Servers on machines to the Standard tier" + "ruleId": "Azure.Defender.Servers", + "displayName": "Configure Microsoft Defender for Servers to the Standard tier and P2" }, { - "severity": "Important", + "severity": "Critical", "pillar": "Security", - "category": "SE:12 Incident response", - "resourceType": "Microsoft.Security/securityContacts", - "ruleId": "Azure.Defender.SecurityContact", - "displayName": "Defender for Cloud notification contact not set" + "category": "SE:10 Monitoring and threat detection", + "resourceType": "Microsoft.Security/pricings", + "ruleId": "Azure.Defender.SQL", + "displayName": "Configure Microsoft Defender for SQL to the Standard tier" }, { "severity": "Critical", "pillar": "Security", "category": "SE:10 Monitoring and threat detection", "resourceType": "Microsoft.Security/pricings", - "ruleId": "Azure.Defender.Servers", - "displayName": "Configure Microsoft Defender for Servers to the Standard tier and P2" + "ruleId": "Azure.Defender.SQLOnVM", + "displayName": "Configure Microsoft Defender for SQL Servers on machines to the Standard tier" }, { "severity": "Critical", @@ -2175,6 +2159,22 @@ "ruleId": "Azure.DevBox.ProjectLimit", "displayName": "Limit number of Dev Boxes per user" }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:08 Hardening resources", + "resourceType": "Microsoft.Network/dnsZones", + "ruleId": "Azure.DNS.DNSSEC", + "displayName": "DNS Zone is not signed" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:08 Hardening resources", + "resourceType": "Microsoft.Network/dnsZones/dnssecConfigs", + "ruleId": "Azure.DNS.DNSSEC", + "displayName": "DNS Zone is not signed" + }, { "severity": "Important", "pillar": "Reliability", @@ -2391,14 +2391,6 @@ "ruleId": "Azure.Fleet.PublicKey", "displayName": "Azure Fleet password-based authentication is enabled" }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:08 Hardening resources", - "resourceType": "Microsoft.AzureFleet/fleets", - "ruleId": "Azure.Fleet.SecureBoot", - "displayName": "Azure Fleet Secure Boot is not enabled" - }, { "severity": "Important", "pillar": "Security", @@ -2459,7 +2451,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.Probe", "displayName": "Use Health Probes for Front Door backends" }, @@ -2467,7 +2459,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.Probe", "displayName": "Use Health Probes for Front Door backends" }, @@ -2475,7 +2467,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.ProbeMethod", "displayName": "Use HEAD health probes for Front Door backends" }, @@ -2483,7 +2475,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.ProbeMethod", "displayName": "Use HEAD health probes for Front Door backends" }, @@ -2491,7 +2483,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", + "resourceType": "Microsoft.Network/frontDoors", "ruleId": "Azure.FrontDoor.ProbePath", "displayName": "Use a Dedicated Health Endpoint for Front Door backends" }, @@ -2499,7 +2491,7 @@ "severity": "Important", "pillar": "Reliability", "category": "Health modeling", - "resourceType": "Microsoft.Network/frontDoors", + "resourceType": "Microsoft.Network/Frontdoors/HealthProbeSettings", "ruleId": "Azure.FrontDoor.ProbePath", "displayName": "Use a Dedicated Health Endpoint for Front Door backends" }, @@ -2871,62 +2863,6 @@ "ruleId": "Azure.LogicApp.LimitHTTPTrigger", "displayName": "Logic App HTTP request trigger is not restricted" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.DocumentDB/cassandraClusters", - "ruleId": "Azure.MICassandra.AvailabilityZone", - "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.DocumentDB/cassandraClusters/dataCenters", - "ruleId": "Azure.MICassandra.AvailabilityZone", - "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" - }, - { - "severity": "Critical", - "pillar": "Cost Optimization", - "category": "CO:06 Usage and billing increments", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.ComputeIdleShutdown", - "displayName": "Configure idle shutdown for compute instances" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Connectivity", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.ComputeVnet", - "displayName": "Host ML Compute in VNet" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Authentication", - "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", - "ruleId": "Azure.ML.DisableLocalAuth", - "displayName": "Disable local authentication on ML Compute" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "Connectivity", - "resourceType": "Microsoft.MachineLearningServices/workspaces", - "ruleId": "Azure.ML.PublicAccess", - "displayName": "ML Workspace has public access disabled" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Identity and Access Management", - "resourceType": "Microsoft.MachineLearningServices/workspaces", - "ruleId": "Azure.ML.UserManagedIdentity", - "displayName": "Azure Machine Learning workspaces should use user-assigned managed identity" - }, { "severity": "Important", "pillar": "Security", @@ -3071,6 +3007,62 @@ "ruleId": "Azure.MariaDB.VNETRuleName", "displayName": "Use valid VNET rule names" }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.DocumentDB/cassandraClusters", + "ruleId": "Azure.MICassandra.AvailabilityZone", + "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.DocumentDB/cassandraClusters/dataCenters", + "ruleId": "Azure.MICassandra.AvailabilityZone", + "displayName": "Use zone redundant Managed Instance for Apache Cassandra clusters" + }, + { + "severity": "Critical", + "pillar": "Cost Optimization", + "category": "CO:06 Usage and billing increments", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.ComputeIdleShutdown", + "displayName": "Configure idle shutdown for compute instances" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Connectivity", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.ComputeVnet", + "displayName": "Host ML Compute in VNet" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Authentication", + "resourceType": "Microsoft.MachineLearningServices/workspaces/computes", + "ruleId": "Azure.ML.DisableLocalAuth", + "displayName": "Disable local authentication on ML Compute" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "Connectivity", + "resourceType": "Microsoft.MachineLearningServices/workspaces", + "ruleId": "Azure.ML.PublicAccess", + "displayName": "ML Workspace has public access disabled" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Identity and Access Management", + "resourceType": "Microsoft.MachineLearningServices/workspaces", + "ruleId": "Azure.ML.UserManagedIdentity", + "displayName": "Azure Machine Learning workspaces should use user-assigned managed identity" + }, { "severity": "Critical", "pillar": "Security", @@ -3623,46 +3615,6 @@ "ruleId": "Azure.PublicIP.StandardSKU", "displayName": "Public IP address uses basic SKU" }, - { - "severity": "Important", - "pillar": "Security", - "category": "Security design principles", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.Immutable", - "displayName": "Immutability" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.Name", - "displayName": "Use valid names" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.ReplicationAlert", - "displayName": "Use geo-replicated storage" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults", - "ruleId": "Azure.RSV.StorageType", - "displayName": "Use geo-replicated storage" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "Design", - "resourceType": "Microsoft.RecoveryServices/vaults/backupconfig", - "ruleId": "Azure.RSV.StorageType", - "displayName": "Use geo-replicated storage" - }, { "severity": "Important", "pillar": "Reliability", @@ -3832,41 +3784,241 @@ "displayName": "Route tables must use standard naming" }, { - "severity": "Critical", + "severity": "Important", "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers", - "ruleId": "Azure.SQL.AAD", - "displayName": "Use Entra ID authentication with SQL databases" + "category": "Security design principles", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.Immutable", + "displayName": "Immutability" }, { - "severity": "Critical", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers/administrators", - "ruleId": "Azure.SQL.AAD", - "displayName": "Use Entra ID authentication with SQL databases" + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.Name", + "displayName": "Use valid names" }, { "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers", - "ruleId": "Azure.SQL.AADOnly", - "displayName": "Databases use Entra ID only authentication" + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.ReplicationAlert", + "displayName": "Use geo-replicated storage" }, { "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Sql/servers/azureADOnlyAuthentications", - "ruleId": "Azure.SQL.AADOnly", - "displayName": "Databases use Entra ID only authentication" + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults", + "ruleId": "Azure.RSV.StorageType", + "displayName": "Use geo-replicated storage" }, { "severity": "Important", - "pillar": "Security", - "category": "SE:06 Network controls", + "pillar": "Reliability", + "category": "Design", + "resourceType": "Microsoft.RecoveryServices/vaults/backupconfig", + "ruleId": "Azure.RSV.StorageType", + "displayName": "Use geo-replicated storage" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:06 Data partitioning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.IndexSLA", + "displayName": "Search index update SLA minimum replicas" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.ManagedIdentity", + "displayName": "Search services uses a managed identity" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Continuous integration", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.Name", + "displayName": "Azure AI Search name must be valid" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.Naming", + "displayName": "AI Search services must use standard naming" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:06 Data partitioning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.QuerySLA", + "displayName": "Search query SLA minimum replicas" + }, + { + "severity": "Critical", + "pillar": "Performance Efficiency", + "category": "PE:02 Capacity planning", + "resourceType": "Microsoft.Search/searchServices", + "ruleId": "Azure.Search.SKU", + "displayName": "AI Search minimum SKU" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Monitor", + "resourceType": "Microsoft.Insights/diagnosticSettings", + "ruleId": "Azure.ServiceBus.AuditLogs", + "displayName": "Audit Service Bus data plane access" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Monitor", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.AuditLogs", + "displayName": "Audit Service Bus data plane access" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.DisableLocalAuth", + "displayName": "Use identity-based authentication for Service Bus namespaces" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:05 Redundancy", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.GeoReplica", + "displayName": "Geo-replication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:07 Encryption", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.MinTLS", + "displayName": "Enforce namespaces to minimum use TLS 1.2 version" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:01 Security baseline", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.ReplicaLocation", + "displayName": "Service Bus namespace replica location is not allowed" + }, + { + "severity": "Important", + "pillar": "Cost Optimization", + "category": "CO:14 Consolidation", + "resourceType": "Microsoft.ServiceBus/namespaces", + "ruleId": "Azure.ServiceBus.Usage", + "displayName": "Remove unused Service Bus namespaces" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.AAD", + "displayName": "Use Entra ID authentication with Service Fabric clusters" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.ServiceFabric/managedClusters", + "ruleId": "Azure.ServiceFabric.ManagedNaming", + "displayName": "Service Fabric managed cluster resources must use standard naming" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "OE:04 Tools and processes", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.Naming", + "displayName": "Service Fabric cluster resources must use standard naming" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:07 Encryption", + "resourceType": "Microsoft.ServiceFabric/clusters", + "ruleId": "Azure.ServiceFabric.ProtectionLevel", + "displayName": "Service Fabric Cluster allows unencrypted node to node communication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "Authentication", + "resourceType": "Microsoft.SignalRService/signalR", + "ruleId": "Azure.SignalR.ManagedIdentity", + "displayName": "Use managed identities for SignalR Services" + }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.SignalRService/SignalR", + "ruleId": "Azure.SignalR.Name", + "displayName": "Use valid SignalR service names" + }, + { + "severity": "Important", + "pillar": "Reliability", + "category": "RE:04 Target metrics", + "resourceType": "Microsoft.SignalRService/signalR", + "ruleId": "Azure.SignalR.SLA", + "displayName": "Use an SLA for SignalR Services" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers", + "ruleId": "Azure.SQL.AAD", + "displayName": "Use Entra ID authentication with SQL databases" + }, + { + "severity": "Critical", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers/administrators", + "ruleId": "Azure.SQL.AAD", + "displayName": "Use Entra ID authentication with SQL databases" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers", + "ruleId": "Azure.SQL.AADOnly", + "displayName": "Databases use Entra ID only authentication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:05 Identity and access management", + "resourceType": "Microsoft.Sql/servers/azureADOnlyAuthentications", + "ruleId": "Azure.SQL.AADOnly", + "displayName": "Databases use Entra ID only authentication" + }, + { + "severity": "Important", + "pillar": "Security", + "category": "SE:06 Network controls", "resourceType": "Microsoft.Sql/servers", "ruleId": "Azure.SQL.AllowAzureAccess", "displayName": "Limit SQL database network access to trusted IP addresses" @@ -4111,166 +4263,6 @@ "ruleId": "Azure.SQLMI.Naming", "displayName": "SQL Managed Instance resources must use standard naming" }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:06 Data partitioning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.IndexSLA", - "displayName": "Search index update SLA minimum replicas" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.ManagedIdentity", - "displayName": "Search services uses a managed identity" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Continuous integration", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.Name", - "displayName": "Azure AI Search name must be valid" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.Naming", - "displayName": "AI Search services must use standard naming" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:06 Data partitioning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.QuerySLA", - "displayName": "Search query SLA minimum replicas" - }, - { - "severity": "Critical", - "pillar": "Performance Efficiency", - "category": "PE:02 Capacity planning", - "resourceType": "Microsoft.Search/searchServices", - "ruleId": "Azure.Search.SKU", - "displayName": "AI Search minimum SKU" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Monitor", - "resourceType": "Microsoft.Insights/diagnosticSettings", - "ruleId": "Azure.ServiceBus.AuditLogs", - "displayName": "Audit Service Bus data plane access" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Monitor", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.AuditLogs", - "displayName": "Audit Service Bus data plane access" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.DisableLocalAuth", - "displayName": "Use identity-based authentication for Service Bus namespaces" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:05 Redundancy", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.GeoReplica", - "displayName": "Geo-replication" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:07 Encryption", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.MinTLS", - "displayName": "Enforce namespaces to minimum use TLS 1.2 version" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:01 Security baseline", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.ReplicaLocation", - "displayName": "Service Bus namespace replica location is not allowed" - }, - { - "severity": "Important", - "pillar": "Cost Optimization", - "category": "CO:14 Consolidation", - "resourceType": "Microsoft.ServiceBus/namespaces", - "ruleId": "Azure.ServiceBus.Usage", - "displayName": "Remove unused Service Bus namespaces" - }, - { - "severity": "Critical", - "pillar": "Security", - "category": "SE:05 Identity and access management", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.AAD", - "displayName": "Use Entra ID authentication with Service Fabric clusters" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.ServiceFabric/managedClusters", - "ruleId": "Azure.ServiceFabric.ManagedNaming", - "displayName": "Service Fabric managed cluster resources must use standard naming" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "OE:04 Tools and processes", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.Naming", - "displayName": "Service Fabric cluster resources must use standard naming" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "SE:07 Encryption", - "resourceType": "Microsoft.ServiceFabric/clusters", - "ruleId": "Azure.ServiceFabric.ProtectionLevel", - "displayName": "Service Fabric Cluster allows unencrypted node to node communication" - }, - { - "severity": "Important", - "pillar": "Security", - "category": "Authentication", - "resourceType": "Microsoft.SignalRService/signalR", - "ruleId": "Azure.SignalR.ManagedIdentity", - "displayName": "Use managed identities for SignalR Services" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.SignalRService/SignalR", - "ruleId": "Azure.SignalR.Name", - "displayName": "Use valid SignalR service names" - }, - { - "severity": "Important", - "pillar": "Reliability", - "category": "RE:04 Target metrics", - "resourceType": "Microsoft.SignalRService/signalR", - "ruleId": "Azure.SignalR.SLA", - "displayName": "Use an SLA for SignalR Services" - }, { "severity": "Important", "pillar": "Security", @@ -4479,6 +4471,14 @@ "ruleId": "Azure.VM.ADE", "displayName": "Use Azure Disk Encryption" }, + { + "severity": "Important", + "pillar": "Operational Excellence", + "category": "OE:10 Automation design", + "resourceType": "Microsoft.Compute/virtualMachines", + "ruleId": "Azure.VM.Agent", + "displayName": "Virtual Machine agent is not provisioned" + }, { "severity": "Important", "pillar": "Operational Excellence", @@ -4527,14 +4527,6 @@ "ruleId": "Azure.VM.ASName", "displayName": "Use valid Availability Set names" }, - { - "severity": "Important", - "pillar": "Operational Excellence", - "category": "OE:10 Automation design", - "resourceType": "Microsoft.Compute/virtualMachines", - "ruleId": "Azure.VM.Agent", - "displayName": "Virtual Machine agent is not provisioned" - }, { "severity": "Important", "pillar": "Reliability", @@ -4671,14 +4663,6 @@ "ruleId": "Azure.VM.PublicKey", "displayName": "VM password-based authentication is enabled" }, - { - "severity": "Important", - "pillar": "Performance Efficiency", - "category": "Design for performance", - "resourceType": "Microsoft.Compute/virtualMachines", - "ruleId": "Azure.VM.SQLServerDisk", - "displayName": "Configure Premium disks or above" - }, { "severity": "Important", "pillar": "Security", @@ -4703,6 +4687,14 @@ "ruleId": "Azure.VM.ShouldNotBeStopped", "displayName": "Virtual Machine is stopped but still allocated" }, + { + "severity": "Important", + "pillar": "Performance Efficiency", + "category": "Design for performance", + "resourceType": "Microsoft.Compute/virtualMachines", + "ruleId": "Azure.VM.SQLServerDisk", + "displayName": "Configure Premium disks or above" + }, { "severity": "Important", "pillar": "Reliability", @@ -5063,6 +5055,14 @@ "ruleId": "Azure.VNG.VPNLegacySKU", "displayName": "Migrate from legacy VPN gateway SKUs" }, + { + "severity": "Awareness", + "pillar": "Operational Excellence", + "category": "Repeatable infrastructure", + "resourceType": "Microsoft.Network/virtualWans", + "ruleId": "Azure.vWAN.Name", + "displayName": "Use valid vWAN names" + }, { "severity": "Important", "pillar": "Security", @@ -5078,13 +5078,5 @@ "resourceType": "Microsoft.SignalRService/webPubSub", "ruleId": "Azure.WebPubSub.SLA", "displayName": "Use an SLA for Web PubSub Services" - }, - { - "severity": "Awareness", - "pillar": "Operational Excellence", - "category": "Repeatable infrastructure", - "resourceType": "Microsoft.Network/virtualWans", - "ruleId": "Azure.vWAN.Name", - "displayName": "Use valid vWAN names" } ]