Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added new built-in Policies into the Initiative #1109

Merged
merged 33 commits into from
Nov 23, 2022
Merged

Added new built-in Policies into the Initiative #1109

Show file tree
Hide file tree
Changes from 30 commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
e1afae6
Added new built-in Policies into the Initiative
pkorolo Nov 9, 2022
771b3b5
Auto-update Portal experience [pkorolo/b6efe33e]
github-actions[bot] Nov 9, 2022
e69bf06
Second commit to also update assignments
pkorolo Nov 16, 2022
84ed288
Auto-update Portal experience [pkorolo/3988ae38]
github-actions[bot] Nov 16, 2022
44bf538
3rd commit to resolve conflict
pkorolo Nov 16, 2022
1e587e3
Auto-update Portal experience [pkorolo/3988ae38]
github-actions[bot] Nov 16, 2022
6747ee5
4th commit to resolve conflict
pkorolo Nov 16, 2022
9df726f
Auto-update Portal experience [pkorolo/3988ae38]
github-actions[bot] Nov 16, 2022
a986201
5th commit to resolve conflict
pkorolo Nov 16, 2022
5322f59
Auto-update Portal experience [pkorolo/3988ae38]
github-actions[bot] Nov 16, 2022
74ced8d
Merge branch 'main' into Update-Custom-PrivateDNSInitiative
pkorolo Nov 16, 2022
00970ff
Auto-update Portal experience [pkorolo/3988ae38]
github-actions[bot] Nov 16, 2022
06c6887
Merge branch 'main' into Update-Custom-PrivateDNSInitiative
pkorolo Nov 17, 2022
c9a610b
commit to resolve conflict
pkorolo Nov 17, 2022
025159a
Auto-update Portal experience [pkorolo/812afd55]
github-actions[bot] Nov 17, 2022
e6d13e4
Merge branch 'Update-Custom-PrivateDNSInitiative' of https://github.c…
pkorolo Nov 17, 2022
4aedae7
commit to include recommendations and whats new
pkorolo Nov 17, 2022
c3f3cfc
Auto-update Portal experience [pkorolo/812afd55]
github-actions[bot] Nov 17, 2022
908e588
Delete policies_20221117131533.json
Nov 17, 2022
cf72e68
Delete policies_20221117131622.json
Nov 17, 2022
ec3f9cf
Merge branch 'Azure:main' into Update-Custom-PrivateDNSInitiative
pkorolo Nov 19, 2022
5721c1b
conflict resolution
pkorolo Nov 22, 2022
8605534
Auto-update Portal experience [pkorolo/d4d714bb]
github-actions[bot] Nov 22, 2022
8a2e069
Merge branch 'main' into Update-Custom-PrivateDNSInitiative
pkorolo Nov 22, 2022
c0aab67
Auto-update Portal experience [pkorolo/d4d714bb]
github-actions[bot] Nov 22, 2022
50647e5
commit for minor fixes and whats new upd
pkorolo Nov 22, 2022
06ad4c7
Merge branch 'Update-Custom-PrivateDNSInitiative' of https://github.c…
pkorolo Nov 22, 2022
0359a48
Auto-update Portal experience [pkorolo/d4d714bb]
github-actions[bot] Nov 22, 2022
b652624
Merge branch 'main' into Update-Custom-PrivateDNSInitiative
Nov 23, 2022
1a16ec1
Auto-update Portal experience [krowlandson/e04594ec]
github-actions[bot] Nov 23, 2022
26d340a
Auto-update Portal experience [krowlandson/e04594ec]
github-actions[bot] Nov 23, 2022
cdb04be
Trigger workflow
Nov 23, 2022
507b210
Merge branch 'Update-Custom-PrivateDNSInitiative' of github.com:pkoro…
Nov 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/wiki/Whats-new.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,20 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
- Version 1.0.0 -> 1.1.0
- Added system databases master, model, tempdb, msdb, resource to exclusion parameter as default values
- Added as Policy Rule 'notIn' which will exclude the above databases from the policy
- Updated "**Deploy-Private-DNS-Zones**" Custom initiative for **Azure Public Cloud**, with latest built-in Policies. Policies were added for the following Services:
- Azure Automation
- Azure Cosmos DB (all APIs: SQL, MongoDB, Cassandra, Gremlin, Table)
- Azure Data Factory
- Azure HDInsight
- Azure Migrate (missing Private DNS Zone also added)
- Azure Storage (Blob, Queue, File, Static Web, DFS and all relative secondaries)
- Azure Synapse Analytics
- Azure Media Services
- Azure Monitor
- Minor fixes related to "**Deploy-Private-DNS-Zones**" Custom Initiative and respective Assignment:
- Added missing Zones for **"WebPubSub"** and **"azure-devices-provisioning"**, so Initiative Assignment works correctly
- Minor correction related to **ASR Private DNS Zone variable**, so Initiative Assignment works correctly
- Convertion of **"Azure Batch"** Private DNS Zone (from regional to global), to properly align with latest respective documentation and functionality
- Renamed Azure DDoS Standard Protection references to [Azure DDoS Network Protection](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-sku-comparison#ddos-network-protection).
- Incremented version for policy Deploy-DDoSProtection from "version":"1.0.0" to "version": "1.0.1"
- Added `Configure Microsoft Defender for Azure Cosmos DB to be enabled` to the `Deploy Microsoft Defender for Cloud configuration` initiative and updated version to `3.1.0` - Fixing issue [issue #1081](https://github.com/Azure/Enterprise-Scale/issues/1081)
Expand Down
7 changes: 5 additions & 2 deletions eslzArm/eslzArm.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,7 +891,7 @@
"privatelink.cassandra.cosmos.azure.com",
"privatelink.gremlin.cosmos.azure.com",
"privatelink.table.cosmos.azure.com",
"[concat('privatelink.', parameters('connectivityLocation'), '.batch.azure.com')]",
"privatelink.batch.azure.com",
"privatelink.postgres.database.azure.com",
"privatelink.mysql.database.azure.com",
"privatelink.mariadb.database.azure.com",
Expand Down Expand Up @@ -925,7 +925,10 @@
"privatelink.azurehdinsight.net",
"privatelink.his.arc.azure.com",
"privatelink.guestconfiguration.azure.com",
"privatelink.media.azure.net"
"privatelink.media.azure.net",
"privatelink.prod.migration.windowsazure.com",
"privatelink.webpubsub.azure.com",
"privatelink.azure-devices-provisioning.net"
],
"azBackupGeoCodes": {
"australiacentral": "acl",
Expand Down
128 changes: 126 additions & 2 deletions eslzArm/managementGroupTemplates/policyAssignments/DINE-PrivateDNSZonesPolicyAssignment.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,41 @@
"baseId": "[concat(parameters('dnsZoneResourceGroupId'), '/providers/Microsoft.Network/privateDnsZones/')]",
"policyParameterMapping": {
"azureFilePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.afs.azure.net')]",
"azureAutomationWebhookPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azure-automation.net')]",
"azureAutomationDSCHybridPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azure-automation.net')]",
"azureCosmosSQLPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.documents.azure.com')]",
"azureCosmosMongoPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.mongo.cosmos.azure.com')]",
"azureCosmosCassandraPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.cassandra.cosmos.azure.com')]",
"azureCosmosGremlinPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.gremlin.cosmos.azure.com')]",
"azureCosmosTablePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.table.cosmos.azure.com')]",
"azureDataFactoryPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.datafactory.azure.net')]",
"azureDataFactoryPortalPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.adf.azure.com')]",
"azureHDInsightPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azurehdinsight.net')]",
"azureMigratePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.prod.migration.windowsazure.com')]",
"azureStorageBlobPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.blob.core.windows.net')]",
"azureStorageBlobSecPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.blob.core.windows.net')]",
"azureStorageQueuePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.queue.core.windows.net')]",
"azureStorageQueueSecPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.queue.core.windows.net')]",
"azureStorageFilePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.file.core.windows.net')]",
"azureStorageStaticWebPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.web.core.windows.net')]",
"azureStorageStaticWebSecPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.web.core.windows.net')]",
"azureStorageDFSPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.dfs.core.windows.net')]",
"azureStorageDFSSecPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.dfs.core.windows.net')]",
"azureSynapseSQLPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.sql.azuresynapse.net')]",
"azureSynapseSQLODPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.sql.azuresynapse.net')]",
"azureSynapseDevPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.dev.azuresynapse.net')]",
"azureMediaServicesKeyPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.media.azure.net')]",
"azureMediaServicesLivePrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.media.azure.net')]",
"azureMediaServicesStreamPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.media.azure.net')]",
"azureMonitorPrivateDnsZoneId1": "[concat(variables('baseId'), 'privatelink.monitor.azure.com')]",
"azureMonitorPrivateDnsZoneId2": "[concat(variables('baseId'), 'privatelink.oms.opinsights.azure.com')]",
"azureMonitorPrivateDnsZoneId3": "[concat(variables('baseId'), 'privatelink.ods.opinsights.azure.com')]",
"azureMonitorPrivateDnsZoneId4": "[concat(variables('baseId'), 'privatelink.agentsvc.azure-automation.net')]",
"azureMonitorPrivateDnsZoneId5": "[concat(variables('baseId'), 'privatelink.blob.core.windows.net')]",
"azureWebPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.webpubsub.azure.com')]",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just realised that this has probably been wrong since creation, as this is the namespace for Azure SignalR WebPubSub, but the parameter name (in my opinion) leads me to believe this was intended for Azure Web Apps.

The policy mapped to this parameter is indeed Azure SignalR WebPubSub so it technically maps correctly, but this doesn't feel correct.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you are right, if I would make it from the beginning, naming would be different for cases like this one, but I did not touch the originals

"azureBatchPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.', parameters('location'), '.batch.azure.com')]",
"azureBatchPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.batch.azure.com')]",
"azureAppPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azconfig.io')]",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, this appears to be the namespace for App Configuration Stores - making this an equally ambiguous parameter name. Would probably be a breaking change to reverse some of this though unfortunately.

"azureAsrPrivateDnsZoneId": "[concat(variables('baseId'), '.privatelink.siterecovery.windowsazure.com')]",
"azureAsrPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.siterecovery.windowsazure.com')]",
"azureIotPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.azure-devices-provisioning.net')]",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And another where the name is misleading given the presence of IoT hubs, although this one may be easier to switch around if needed.

"azureKeyVaultPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.vaultcore.azure.net')]",
"azureSignalRPrivateDnsZoneId": "[concat(variables('baseId'), 'privatelink.service.signalr.net')]",
Expand Down Expand Up @@ -84,6 +115,99 @@
"azureFilePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureFilePrivateDnsZoneId]"
},
"azureAutomationWebhookPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureAutomationWebhookPrivateDnsZoneId]"
},
"azureAutomationDSCHybridPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureAutomationDSCHybridPrivateDnsZoneId]"
},
"azureCosmosSQLPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureCosmosSQLPrivateDnsZoneId]"
},
"azureCosmosMongoPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureCosmosMongoPrivateDnsZoneId]"
},
"azureCosmosCassandraPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureCosmosCassandraPrivateDnsZoneId]"
},
"azureCosmosGremlinPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureCosmosGremlinPrivateDnsZoneId]"
},
"azureCosmosTablePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureCosmosTablePrivateDnsZoneId]"
},
"azureDataFactoryPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureDataFactoryPrivateDnsZoneId]"
},
"azureDataFactoryPortalPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureDataFactoryPortalPrivateDnsZoneId]"
},
"azureHDInsightPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureHDInsightPrivateDnsZoneId]"
},
"azureMigratePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureMigratePrivateDnsZoneId]"
},
"azureStorageBlobPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageBlobPrivateDnsZoneId]"
},
"azureStorageBlobSecPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageBlobSecPrivateDnsZoneId]"
},
"azureStorageQueuePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageQueuePrivateDnsZoneId]"
},
"azureStorageQueueSecPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageQueueSecPrivateDnsZoneId]"
},
"azureStorageFilePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageFilePrivateDnsZoneId]"
},
"azureStorageStaticWebPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageStaticWebPrivateDnsZoneId]"
},
"azureStorageStaticWebSecPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageStaticWebSecPrivateDnsZoneId]"
},
"azureStorageDFSPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageDFSPrivateDnsZoneId]"
},
"azureStorageDFSSecPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureStorageDFSSecPrivateDnsZoneId]"
},
"azureSynapseSQLPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureSynapseSQLPrivateDnsZoneId]"
},
"azureSynapseSQLODPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureSynapseSQLODPrivateDnsZoneId]"
},
"azureSynapseDevPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureSynapseDevPrivateDnsZoneId]"
},
"azureMediaServicesKeyPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureMediaServicesKeyPrivateDnsZoneId]"
},
"azureMediaServicesLivePrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureMediaServicesLivePrivateDnsZoneId]"
},
"azureMediaServicesStreamPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureMediaServicesStreamPrivateDnsZoneId]"
},
"azureMonitorPrivateDnsZoneId1": {
"value": "[variables('policyParameterMapping').azureMonitorPrivateDnsZoneId1]"
},
"azureMonitorPrivateDnsZoneId2": {
"value": "[variables('policyParameterMapping').azureMonitorPrivateDnsZoneId2]"
},
"azureMonitorPrivateDnsZoneId3": {
"value": "[variables('policyParameterMapping').azureMonitorPrivateDnsZoneId3]"
},
"azureMonitorPrivateDnsZoneId4": {
"value": "[variables('policyParameterMapping').azureMonitorPrivateDnsZoneId4]"
},
"azureMonitorPrivateDnsZoneId5": {
"value": "[variables('policyParameterMapping').azureMonitorPrivateDnsZoneId5]"
},
"azureWebPrivateDnsZoneId": {
"value": "[variables('policyParameterMapping').azureWebPrivateDnsZoneId]"
},
Expand Down
Loading