-
Notifications
You must be signed in to change notification settings - Fork 246
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #97 from Azure/CAF/nov-29
Caf/nov 29 - update to match main policies
- Loading branch information
Showing
4 changed files
with
113 additions
and
108 deletions.
There are no files selected for viewing
68 changes: 0 additions & 68 deletions
68
Scripts/CloudAdoptionFramework/Assignments/CAF-CorpMG-Default.json
This file was deleted.
Oops, something went wrong.
107 changes: 107 additions & 0 deletions
107
Scripts/CloudAdoptionFramework/Assignments/CAF-CorpMG-Default.jsonc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| { | ||
| "nodeName": "/Corp/", | ||
| "scope": { | ||
| "tenant1": [ | ||
| "/providers/Microsoft.Management/managementGroups/corp" | ||
| ] | ||
| }, | ||
| "children": [ | ||
| { | ||
| "nodeName": "Networking/", | ||
| "children": [ | ||
| { | ||
| "nodeName": "PublicEndpoint", | ||
| "assignment": { | ||
| "name": "Deny-Public-Endpoints", | ||
| "displayName": "Public network access should be disabled for PaaS services", | ||
| "description": "This policy initiative is a group of policies that prevents creation of Azure PaaS services with exposed public endpoints" | ||
| }, | ||
| "definitionEntry": { | ||
| "initiativeName": "Deny-PublicPaaSEndpoints", | ||
| "friendlyNameToDocumentIfGuid": "Deny Public PaaS Endpoints" | ||
| } | ||
| }, | ||
| { | ||
| "nodeName": "DNZZones", | ||
| "assignment": { | ||
| "name": "Deploy-Private-DNS-Zones", | ||
| "displayName": "Configure Azure PaaS services to use private DNS zones", | ||
| "description": "This policy initiative is a group of policies that ensures private endpoints to Azure PaaS services are integrated with Azure Private DNS zones." | ||
| }, | ||
| "definitionEntry": { | ||
| "initiativeName": "Deploy-Private-DNS-Zones", | ||
| "friendlyNameToDocumentIfGuid": "Deploy Private DNS Zones" | ||
| }, | ||
| "parameters": { | ||
| // Replace DNSZonePrefix with a value similar to | ||
| // "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myorg-dns/providers/Microsoft.Network/privateDnsZones/" | ||
| // but modify to reference your connectivity subscription. | ||
| // Replace location with the default deployment location. | ||
| // If you don't require this then remove the assignment block. | ||
| "azureFilePrivateDnsZoneId": "DNSZonePrefix.privatelink.afs.azure.net", | ||
| "azureWebPrivateDnsZoneId": "DNSZonePrefix.privatelink.webpubsub.azure.com", | ||
| "azureBatchPrivateDnsZoneId": "DNSZonePrefix.privatelink.location.batch.azure.com", | ||
| "azureAppPrivateDnsZoneId": "DNSZonePrefix.privatelink.azconfig.io", | ||
| "azureAsrPrivateDnsZoneId": "DNSZonePrefixlocation.privatelink.siterecovery.windowsazure.com", | ||
| "azureIoTPrivateDnsZoneId": "DNSZonePrefix.privatelink.azure-devices-provisioning.net", | ||
| "azureKeyVaultPrivateDnsZoneId": "DNSZonePrefix.privatelink.vaultcore.azure.net", | ||
| "azureSignalRPrivateDnsZoneId": "DNSZonePrefix.privatelink.service.signalr.net", | ||
| "azureAppServicesPrivateDnsZoneId": "DNSZonePrefix.privatelink.azurewebsites.net", | ||
| "azureEventGridTopicsPrivateDnsZoneId": "DNSZonePrefix.privatelink.eventgrid.azure.net", | ||
| "azureDiskAccessPrivateDnsZoneId": "DNSZonePrefix.privatelink.blob.core.windows.net", | ||
| "azureCognitiveServicesPrivateDnsZoneId": "DNSZonePrefix.privatelink.cognitiveservices.azure.com", | ||
| "azureIotHubsPrivateDnsZoneId": "DNSZonePrefix.privatelink.azure-devices.net", | ||
| "azureEventGridDomainsPrivateDnsZoneId": "DNSZonePrefix.privatelink.eventgrid.azure.net", | ||
| "azureRedisCachePrivateDnsZoneId": "DNSZonePrefix.privatelink.redis.cache.windows.net", | ||
| "azureAcrPrivateDnsZoneId": "DNSZonePrefix.privatelink.azurecr.io", | ||
| "azureEventHubNamespacePrivateDnsZoneId": "DNSZonePrefix.privatelink.servicebus.windows.net", | ||
| "azureMachineLearningWorkspacePrivateDnsZoneId": "DNSZonePrefix.privatelink.api.azureml.ms", | ||
| "azureServiceBusNamespacePrivateDnsZoneId": "DNSZonePrefix.privatelink.servicebus.windows.net", | ||
| "azureCognitiveSearchPrivateDnsZoneId": "DNSZonePrefix.privatelink.search.windows.net" | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "nodeName": "Databricks/", | ||
| "children": [ | ||
| { | ||
| "nodeName": "NoDBPIP", | ||
| "assignment": { | ||
| "name": "Deny-DataB-Pip", | ||
| "displayName": "Prevent usage of Databricks with public IP", | ||
| "description": "Prevent the deployment of Databricks workspaces that do not use the noPublicIp feature to host Databricks clusters without public IPs." | ||
| }, | ||
| "definitionEntry": { | ||
| "policyName": "Deny-Databricks-NoPublicIp", | ||
| "friendlyNameToDocumentIfGuid": "Deny Databricks with Public Ip" | ||
| } | ||
| }, | ||
| { | ||
| "nodeName": "DbPremium", | ||
| "assignment": { | ||
| "name": "Deny-DataB-Sku", | ||
| "displayName": "Enforces the use of Premium Databricks workspaces", | ||
| "description": "Enforces the use of Premium Databricks workspaces to make sure appropriate security features are available including Databricks Access Controls, Credential Passthrough and SCIM provisioning for AAD." | ||
| }, | ||
| "definitionEntry": { | ||
| "policyName": "Deny-Databricks-Sku", | ||
| "friendlyNameToDocumentIfGuid": "Deny Databricks Sku" | ||
| } | ||
| }, | ||
| { | ||
| "nodeName": "DbVnet", | ||
| "assignment": { | ||
| "name": "Deny-DataB-Vnet", | ||
| "displayName": "Enforces the use of vnet injection for Databricks", | ||
| "description": "Enforces the use of vnet injection for Databricks workspaces." | ||
| }, | ||
| "definitionEntry": { | ||
| "policyName": "Deny-Databricks-VirtualNetwork", | ||
| "friendlyNameToDocumentIfGuid": "Deny Databricks Virtual Network" | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters