Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adding ARM modules #613

Merged
merged 42 commits into from
Jul 13, 2021
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
42 commits
Select commit Hold shift + click to select a range
3ac5288
adding modules
krnese Jun 9, 2021
d19695e
defined contract
krnese Jun 11, 2021
a7b2e4b
update #3
krnese Jun 16, 2021
3a499b9
Merge branch 'main' of https://github.com/Azure/Enterprise-scale into…
krnese Jun 17, 2021
3aef708
added enforcementMode param
krnese Jun 17, 2021
871f336
adding param
krnese Jun 17, 2021
7ac8883
UX and contract changes
krnese Jun 17, 2021
9be15c3
conditional firewall for hub vs vwan
krnese Jun 18, 2021
beea150
support for single vs N platform subs
krnese Jun 21, 2021
8d3cbdc
Merge branch 'main' of https://github.com/Azure/Enterprise-scale into…
krnese Jun 21, 2021
f501c3e
updated UX for single vs dedicated platform subscriptions
krnese Jun 21, 2021
f10511d
updating built-in policy
krnese Jun 23, 2021
388fd57
correcting parameter
krnese Jun 23, 2021
d111829
navigating policies for identity
krnese Jun 23, 2021
2a77f81
Merge branch 'main' of https://github.com/Azure/Enterprise-scale into…
krnese Jun 24, 2021
be402f9
adding vwan and nva for networking
krnese Jun 24, 2021
3245165
removing peering
krnese Jun 24, 2021
291ada4
adding scaleUnit for vpnGateway and ER for vwan
krnese Jun 24, 2021
25b89e4
fixing parameter
krnese Jun 24, 2021
241fc1b
adding disclaimer for sub selection
krnese Jun 28, 2021
46fc0a0
adding private dns zones and moving to built-in policies
krnese Jul 5, 2021
96d9792
Merge branch 'main' of https://github.com/Azure/Enterprise-scale into…
krnese Jul 6, 2021
f4b6dfb
adding policySet for DINE Private DNS Zones
krnese Jul 6, 2021
7a2579b
Added policyset for public paas
daltondhcp Jul 6, 2021
dae280d
removed custom references
daltondhcp Jul 6, 2021
e1175af
Update Deny-PublicEndpointsPolicySetDefinition.json
daltondhcp Jul 6, 2021
03c0506
policy updates
krnese Jul 6, 2021
2f2154e
Merge branch 'arm-modules' of https://github.com/krnese/Enterprise-Sc…
krnese Jul 6, 2021
c204bd9
adding policies and UX enhancements
krnese Jul 7, 2021
3aa964b
removing option for private dns zones when vwan is selected
krnese Jul 8, 2021
4901bb8
adding UX for vnet peering of dedicated ID sub
krnese Jul 8, 2021
ad97f78
adding peering for identity sub
krnese Jul 9, 2021
8d82a55
adding vnet peering for corp lz
krnese Jul 9, 2021
b44bc8c
corp lz move and peering
krnese Jul 9, 2021
ddf974a
sequencing corp lz move vs peering
krnese Jul 9, 2021
b846329
updated description and displayName
krnese Jul 12, 2021
db4dee3
updating rg location for nw
krnese Jul 13, 2021
2c24791
adding condition for AzFw as DNS proxy vs not
krnese Jul 13, 2021
84f7277
adding peering support for identity to vwan hub
krnese Jul 13, 2021
c7ebaf4
Merge branch 'main' into arm-modules
krnese Jul 13, 2021
c7b0a22
updating displayName
krnese Jul 13, 2021
ad0aeb0
Merge branch 'arm-modules' of https://github.com/krnese/Enterprise-Sc…
krnese Jul 13, 2021
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
defined contract
  • Loading branch information
krnese committed Jun 11, 2021
commit d19695e02a64688b5bb0108a819848a3ce711ffe
1,410 changes: 1,410 additions & 0 deletions eslzArm/eslzArm.json

Large diffs are not rendered by default.

539 changes: 539 additions & 0 deletions eslzArm/managementGroupTemplates/hubspoke-connectivity.json

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {
"policyDefinitions": {
"denyAksNoPrivEsc": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99"
},
"policyAssignmentNames": {
"denyAksNoPrivEsc": "Deny-Priv-Esc-AKS"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2018-05-01",
"name": "[variables('policyAssignmentNames').denyAksNoPrivEsc]",
"properties": {
"description": "[variables('policyAssignmentNames').denyAksNoPrivEsc]",
"displayName": "[variables('policyAssignmentNames').denyAksNoPrivEsc]",
"policyDefinitionId": "[variables('policyDefinitions').denyAksNoPrivEsc]",
"parameters": {
"effect": {
"value": "deny"
}
}
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/tenantDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {
"policyDefinitions": {
"denyAksPriv": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4"
},
"policyAssignmentNames": {
"denyAksPriv": "Deny-Privileged-AKS"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2018-05-01",
"name": "[variables('policyAssignmentNames').denyAksPriv]",
"properties": {
"description": "[variables('policyAssignmentNames').denyAksPriv]",
"displayName": "[variables('policyAssignmentNames').denyAksPriv]",
"policyDefinitionId": "[variables('policyDefinitions').denyAksPriv]",
"parameters": {
"effect": {
"value": "deny"
}
}
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {
"policyDefinitions": {
"denyHttpIngressAks": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d"
},
"policyAssignmentNames": {
"denyHttpIngressAks": "Enforce-AKS-HTTPS"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2018-05-01",
"name": "[variables('policyAssignmentNames').denyHttpIngressAks]",
"properties": {
"description": "[variables('policyAssignmentNames').denyHttpIngressAks]",
"displayName": "[variables('policyAssignmentNames').denyHttpIngressAks]",
"policyDefinitionId": "[variables('policyDefinitions').denyHttpIngressAks]",
"parameters": {
"effect": {
"value": "deny"
}
}
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"topLevelManagementGroupPrefix": {
"type": "string",
"metadata": {
"description": "Provide the ESLZ company prefix to the intermediate root management group containing the policy definitions."
}
}
},
"variables": {
"policyDefinitions": {
"deployEncryptionInTransit": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Enforce-EncryptTransit')]"
},
"policyAssignmentNames": {
"deployEncryptionInTransit": "Enforce-TLS-SSL"
},
"rbacOwner": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
"roleAssignmentNames": {
"deployEncryptionInTransit": "[guid(concat(parameters('topLevelManagementGroupPrefix'),variables('policyAssignmentNames').deployEncryptionInTransit))]"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2019-09-01",
"name": "[variables('policyAssignmentNames').deployEncryptionInTransit]",
"location": "[deployment().location]",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"description": "[variables('policyAssignmentNames').deployEncryptionInTransit]",
"displayName": "[variables('policyAssignmentNames').deployEncryptionInTransit]",
"policyDefinitionId": "[variables('policyDefinitions').deployEncryptionInTransit]",
"parameters": {}
}
},
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2019-04-01-preview",
"name": "[variables('roleAssignmentNames').deployEncryptionInTransit]",
"dependsOn": [
"[resourceId('Microsoft.Authorization/policyAssignments', variables('policyAssignmentNames').deployEncryptionInTransit)]"
],
"properties": {
"principalType": "ServicePrincipal",
"roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacOwner'))]",
"principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').deployEncryptionInTransit), '2018-05-01', 'Full' ).identity.principalId)]"
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
},
"variables": {
"policyDefinitions": {
"denyIpForwarding": "/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900"
},
"policyAssignmentNames": {
"denyIpForwarding": "Deny-IP-forwarding"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2018-05-01",
"name": "[variables('policyAssignmentNames').denyIpForwarding]",
"properties": {
"description": "[variables('policyAssignmentNames').denyIpForwarding]",
"displayName": "[variables('policyAssignmentNames').denyIpForwarding]",
"policyDefinitionId": "[variables('policyDefinitions').denyIpForwarding]"
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"topLevelManagementGroupPrefix": {
"type": "string",
"metadata": {
"description": "Provide the ESLZ company prefix to the intermediate root management group containing the policy definitions."
}
}
},
"variables": {
"policyDefinitions": {
"denyPublicEndpoint": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Deny-PublicEndpoints')]"
},
"policyAssignmentNames": {
"denyPublicEndpoint": "Deny-Public-Endpoints"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2019-09-01",
"name": "[variables('policyAssignmentNames').denyPublicEndpoint]",
"location": "[deployment().location]",
"properties": {
"description": "[variables('policyAssignmentNames').denyPublicEndpoint]",
"displayName": "[variables('policyAssignmentNames').denyPublicEndpoint]",
"policyDefinitionId": "[variables('policyDefinitions').denyPublicEndpoint]",
"parameters": {}
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {
"policyDefinitions": {
"storageHttps": "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9"
},
"policyAssignmentNames": {
"storageHttps": "Deny-Storage-http"
}
},
"resources": [
{
"type": "Microsoft.Authorization/policyAssignments",
"apiVersion": "2018-05-01",
"name": "[variables('policyAssignmentNames').storageHttps]",
"properties": {
"description": "Enforce-Secure-Storage",
"displayName": "Enforce-Secure-Storage",
"policyDefinitionId": "[variables('policyDefinitions').storageHttps]",
"parameters": {
"effect": {
"value": "Deny"
}
}
}
}
],
"outputs": {}
}
Original file line number Diff line number Diff line change
Expand Up @@ -23,72 +23,82 @@
"enableAscForServers": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForSql": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForAppServices": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForStorage": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForRegistries": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForKeyVault": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForSqlOnVm": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForKubernetes": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForArm": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
},
"enableAscForDns": {
"type": "string",
"allowedValues": [
"Yes",
"No"
]
"Standard",
"Free"
],
"defaultValue": "Free"
}
},
"variables": {
Expand Down
Loading