Added new built-in Policies into the Initiative #1109

pkorolo · 2022-11-09T15:18:42Z

Overview/Summary

This PR brings additional existing built-in DINE Policies into this initiative, as per performed gap analysis

This PR fixes/adds/changes/removes

Adds the majority of the existing DINE Policies, that were not initially added in the Initiative
The "Storage Table" Policies were not included, due to conflict with the "Cosmos DB" (Table API) Policy, which was included
The IoT Central & Bot Service Policies were not included, due to limited or conflicting information in the documentation, regarding the respective required DNS Zone integration

Breaking Changes

Private DNS Zone for "Azure Migrate" ("privatelink.prod.migration.windowsazure.com"), is not included in the RI, hence either the zone must be added as well, or the respective Policy for "Azure Migrate" must be removed

Testing Evidence

Testing URLs

The below URLs can be updated where the placeholders are, look for {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also} & {YOUR GITHUB BRANCH NAME HERE - Remove Curly Brackets Also}, to allow you to test your portal deployment experience.

Please also replace the curly brackets on the placeholders {}

Azure Public

As part of this Pull Request I have

Checked for duplicate Pull Requests
Associated it with relevant issues, for tracking and closure.
Ensured my code/branch is up-to-date with the latest changes in the main branch
Performed testing and provided evidence.
Updated relevant and associated documentation.
Updated the "What's New?" wiki page (located: /docs/wiki/whats-new.md)

jtracey93

Nice stuff @pkorolo.

A couple of things:

Can we update the Whats New Wiki page? - https://github.com/Azure/Enterprise-Scale/blob/main/docs/wiki/Whats-new.md
Do we also need to update the assignments?
- Public - https://github.com/Azure/Enterprise-Scale/blob/main/eslzArm/managementGroupTemplates/policyAssignments/DINE-PrivateDNSZonesPolicyAssignment.json
- Fairfax - https://github.com/Azure/Enterprise-Scale/blob/main/eslzArm/managementGroupTemplates/policyAssignments/gov/fairfaxDINE-PrivateDNSZonesPolicyAssignment.json

As for the Azure Migrate piece I think its worth adding this so up to you if you want to wrap into this branch/PR - might be easiest?

Might be worth you also picking up #1073 as part of this.

Let me know your thoughts

Thanks

Jack

pkorolo · 2022-11-11T16:18:10Z

Hello @jtracey93

To your points:

I am in very limited availability as we speak, due to my "WAF-Resiliency" assignment. But I will have a clearer picture early next week, if I can follow up with additional tasks or not; but:

if I cannot take this (documentation - "What's new"), I can help the one that will
Assignments definitely need to be updated; again, not sure if I can take that next week - btw, I think (maybe) I should have put default parameters in the Initiative itself for all the "groupIDs", so that the one who will eventually work with this, will have to only supply the "ZoneIDs" (as in the previous iteration), what do you think?
[If "yes", I can work with this (minor) addition and submit a new PR (?) ]

Last, for the deployment of Azure Migrate Private DNS Zone itself, if I would take that eventually, where should I touch this?

Thank you.

pkorolo · 2022-11-16T13:03:02Z

@jtracey93 can you check this conflict please?

Btw, I have updated

the Policy Definition with default values in GroupIDs
also updated the Azure Public assignments, and
added the extra private DNS zone for Azure migrate

please review, thank you!

src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json

krowlandson · 2022-11-22T19:52:12Z

eslzArm/managementGroupTemplates/policyAssignments/DINE-PrivateDNSZonesPolicyAssignment.json

+            "azureMonitorPrivateDnsZoneId2": "[concat(variables('baseId'), 'privatelink.oms.opinsights.azure.com')]",
+            "azureMonitorPrivateDnsZoneId3": "[concat(variables('baseId'), 'privatelink.ods.opinsights.azure.com')]",
+            "azureMonitorPrivateDnsZoneId4": "[concat(variables('baseId'), 'privatelink.agentsvc.azure-automation.net')]",
+            "azureMonitorPrivateDnsZoneId5": "[concat(variables('baseId'), 'privatelink.blob.core.windows.net')]",
            "azureWebPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.webpubsub.azure.com')]",


Just realised that this has probably been wrong since creation, as this is the namespace for Azure SignalR WebPubSub, but the parameter name (in my opinion) leads me to believe this was intended for Azure Web Apps.

The policy mapped to this parameter is indeed Azure SignalR WebPubSub so it technically maps correctly, but this doesn't feel correct.

you are right, if I would make it from the beginning, naming would be different for cases like this one, but I did not touch the originals

krowlandson · 2022-11-22T19:54:44Z

eslzArm/managementGroupTemplates/policyAssignments/DINE-PrivateDNSZonesPolicyAssignment.json

            "azureWebPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.webpubsub.azure.com')]",
-            "azureBatchPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.', parameters('location'), '.batch.azure.com')]",
+            "azureBatchPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.batch.azure.com')]",
            "azureAppPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azconfig.io')]",


Similarly, this appears to be the namespace for App Configuration Stores - making this an equally ambiguous parameter name. Would probably be a breaking change to reverse some of this though unfortunately.

krowlandson · 2022-11-22T20:09:10Z

eslzArm/managementGroupTemplates/policyAssignments/DINE-PrivateDNSZonesPolicyAssignment.json

            "azureAppPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azconfig.io')]",
-            "azureAsrPrivateDnsZoneId": "[concat(variables('baseId'), '.privatelink.siterecovery.windowsazure.com')]",
+            "azureAsrPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.siterecovery.windowsazure.com')]",
            "azureIotPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azure-devices-provisioning.net')]",


And another where the name is misleading given the presence of IoT hubs, although this one may be easier to switch around if needed.

krowlandson

LGTM 🔥 Thank you

krowlandson

LGTM

…lo/Enterprise-Scale into Update-Custom-PrivateDNSInitiative

krowlandson

LGTM

pkorolo · 2022-11-24T12:52:52Z

Branch to be deleted

Added new built-in Policies into the Initiative

e1afae6

ghost added the Needs: Triage 🔍 Needs triaging by the team label Nov 9, 2022

pkorolo had a problem deploying to csu-rw November 9, 2022 15:18 Error

Auto-update Portal experience [pkorolo/b6efe33e]

771b3b5

github-actions bot requested a review from a team as a code owner November 9, 2022 15:19

jtracey93 previously requested changes Nov 11, 2022

View reviewed changes

ghost added the Needs: Author Feedback label Nov 11, 2022

jtracey93 added enhancement New feature or request policy engineering engineering work and removed Needs: Author Feedback Needs: Triage 🔍 Needs triaging by the team labels Nov 11, 2022

jtracey93 added the do not merge label Nov 15, 2022

Second commit to also update assignments

e69bf06

pkorolo had a problem deploying to csu-rw November 16, 2022 12:39 Error

Auto-update Portal experience [pkorolo/3988ae38]

84ed288

3rd commit to resolve conflict

44bf538

pkorolo had a problem deploying to csu-rw November 16, 2022 13:10 Error

github-actions bot and others added 2 commits November 16, 2022 13:11

Auto-update Portal experience [pkorolo/3988ae38]

1e587e3

4th commit to resolve conflict

6747ee5

pkorolo had a problem deploying to csu-rw November 16, 2022 13:59 Error

github-actions bot and others added 2 commits November 16, 2022 13:59

Auto-update Portal experience [pkorolo/3988ae38]

9df726f

5th commit to resolve conflict

a986201

pkorolo had a problem deploying to csu-rw November 16, 2022 14:24 Error

Auto-update Portal experience [pkorolo/3988ae38]

5322f59

krowlandson reviewed Nov 16, 2022

View reviewed changes

src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json Outdated Show resolved Hide resolved

Merge branch 'main' into Update-Custom-PrivateDNSInitiative

74ced8d

pkorolo had a problem deploying to csu-rw November 16, 2022 15:01 Error

pkorolo had a problem deploying to csu-rw November 22, 2022 18:38 Error

Auto-update Portal experience [pkorolo/d4d714bb]

0359a48

krowlandson reviewed Nov 22, 2022

View reviewed changes

krowlandson mentioned this pull request Nov 23, 2022

Missing DINE policy for private DNS zone of file subresource Azure/terraform-azurerm-caf-enterprise-scale#520

Closed

krowlandson self-assigned this Nov 23, 2022

krowlandson previously approved these changes Nov 23, 2022

View reviewed changes

krowlandson marked this pull request as draft November 23, 2022 15:46

krowlandson marked this pull request as ready for review November 23, 2022 15:46

krowlandson had a problem deploying to csu-rw November 23, 2022 15:46 Error

Merge branch 'main' into Update-Custom-PrivateDNSInitiative

b652624

krowlandson dismissed their stale review via b652624 November 23, 2022 19:43

krowlandson had a problem deploying to csu-rw November 23, 2022 19:43 Error

Auto-update Portal experience [krowlandson/e04594ec]

1a16ec1

krowlandson marked this pull request as draft November 23, 2022 19:44

krowlandson marked this pull request as ready for review November 23, 2022 19:44

krowlandson had a problem deploying to csu-rw November 23, 2022 19:44 Error

krowlandson previously approved these changes Nov 23, 2022

View reviewed changes

Auto-update Portal experience [krowlandson/e04594ec]

26d340a

github-actions bot dismissed krowlandson’s stale review via 26d340a November 23, 2022 19:44

Kevin Rowlandson added 2 commits November 23, 2022 19:52

Trigger workflow

cdb04be

Merge branch 'Update-Custom-PrivateDNSInitiative' of github.com:pkoro…

507b210

…lo/Enterprise-Scale into Update-Custom-PrivateDNSInitiative

krowlandson had a problem deploying to csu-rw November 23, 2022 19:53 Failure

krowlandson temporarily deployed to csu-rw November 23, 2022 20:06 Inactive

krowlandson approved these changes Nov 23, 2022

View reviewed changes

krowlandson merged commit 4f23cea into Azure:main Nov 23, 2022

pkorolo deleted the Update-Custom-PrivateDNSInitiative branch November 24, 2022 17:00

jtracey93 linked an issue Dec 13, 2022 that may be closed by this pull request

Built-in policies DINE policies for DNSZoneGroup registration missing #725

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added new built-in Policies into the Initiative #1109

Added new built-in Policies into the Initiative #1109

pkorolo commented Nov 9, 2022 •

edited by jtracey93

Loading

jtracey93 left a comment

pkorolo commented Nov 11, 2022

pkorolo commented Nov 16, 2022

krowlandson Nov 22, 2022

pkorolo Nov 23, 2022

krowlandson Nov 22, 2022

krowlandson Nov 22, 2022

krowlandson left a comment

krowlandson left a comment

krowlandson left a comment

pkorolo commented Nov 24, 2022

Added new built-in Policies into the Initiative #1109

Added new built-in Policies into the Initiative #1109

Conversation

pkorolo commented Nov 9, 2022 • edited by jtracey93 Loading

Overview/Summary

This PR fixes/adds/changes/removes

Breaking Changes

Testing Evidence

Testing URLs

Azure Public

As part of this Pull Request I have

jtracey93 left a comment

Choose a reason for hiding this comment

pkorolo commented Nov 11, 2022

pkorolo commented Nov 16, 2022

krowlandson Nov 22, 2022

Choose a reason for hiding this comment

pkorolo Nov 23, 2022

Choose a reason for hiding this comment

krowlandson Nov 22, 2022

Choose a reason for hiding this comment

krowlandson Nov 22, 2022

Choose a reason for hiding this comment

krowlandson left a comment

Choose a reason for hiding this comment

krowlandson left a comment

Choose a reason for hiding this comment

krowlandson left a comment

Choose a reason for hiding this comment

pkorolo commented Nov 24, 2022

pkorolo commented Nov 9, 2022 •

edited by jtracey93

Loading